A website query method, device, electronic device and storage medium

Abstract

The embodiment of the present application provides a website query method, device, electronic device and storage medium, which relates to the field of network communication technology. The method includes receiving and parsing the IP address bytes to be queried to obtain a matching method; according to the matching method, matching with the policy IP address in the access control policy list, and returning the matching result, the policy IP address includes a host address policy, a subnet address policy and a range address policy, and part or all of the IPv4 address can be input, and the range or subnet address can be quickly queried, solving the problem that the existing method can only match the host address, which limits the scope of use.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a website query method, device, electronic device and storage medium. Background Art

[0002] At present, in order to ensure the information security of network communication process, firewalls are mostly used to control various network communications. With the increase of informatization and the application of intelligent learning technology of access control policies, there are often a large number of access control policies in firewalls, which increases the difficulty of managing and maintaining access control policies. In order to quickly locate access control policies, string fuzzy matching plays an important role. Traditional string fuzzy matching is only applicable to host addresses, not range or subnet addresses, which limits its scope of use. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a URL query method, device, electronic device and storage medium, which can input part or all of the IPv4 address and quickly query the range or subnet address, thereby solving the problem that the existing method can only match the host address, which limits the scope of use.

[0004] The present invention provides a method for querying a website, which includes:

[0005] Receive and parse the IP address bytes to be queried to obtain a matching method;

[0006] According to the matching method, the policy IP address in the access control policy list is matched and a matching result is returned, wherein the policy IP address includes a host address policy, a subnet address policy and a range address policy.

[0007] In the above implementation process, part or all of the IPv4 address can be input, and fuzzy matching can be performed on three different address objects: host address, subnet address, and range address by matching each byte, thereby solving the problem that the existing method can only match the host address, which limits the scope of use.

[0008] Further, the receiving and parsing of the IP address bytes to be queried to obtain a matching method includes:

[0009] Obtain the byte length of the IP address;

[0010] The bytes of the IP address are segmented according to the separator of the IP address, so as to determine the matching mode of each byte according to the position of the separator and the byte length.

[0011] In the above implementation process, the matching mode of each byte is determined by determining the byte length of the input IP address and dividing the input IP address bytes according to the separator in the IP address.

[0012] Further, the segmenting of the bytes of the IP address according to the separator of the IP address to determine the matching mode of each byte according to the position of the separator and the byte length includes:

[0013] If there are separators on both the left and right sides of the byte, the byte is accurately matched, and the accurate match is that the byte corresponds to the byte in the policy IP address one by one;

[0014] If there is a separator on the left side of the byte, a front match is performed on the byte, where the front match is that the byte corresponds to the front byte in the policy IP address;

[0015] If there is a separator on the right side of the byte, a rear match is performed on the byte, where the rear match is that the byte corresponds to the rear byte in the policy IP address;

[0016] If there are no separators on the left and right sides of the byte, the byte is matched at any position, and the random position match means that the byte corresponds to a byte at any position in the policy IP address.

[0017] In the above implementation process, the matching method of the address bytes is determined according to the position of the delimiter.

[0018] Further, matching the policy IP address in the access control policy list according to the matching mode includes:

[0019] If the IP address bytes are a host address object, then use the string to search;

[0020] If the IP address byte is a subnet address object, convert it into a range address policy and match the IP address byte according to the range address object;

[0021] If the IP address byte is a range address object, the first byte of the range address is matched with the first byte of the IP address. If the match is successful, the second byte of the range address is matched with the second byte of the IP address. If the match fails, the second byte of the range address is re-matched with the first byte of the IP address.

[0022] In the above implementation process, a matching method of host address, subnet address and range address is given, so that the corresponding access control policy can be quickly found without giving a complete IP address.

[0023] Furthermore, the matching is performed according to the matching mode of each byte, including:

[0024] When the number of bytes in the IP address is 3 or the matching mode is an exact match, it is determined whether the bytes in the IP address are within the range of addresses. If so, the match is successful.

[0025] In the above implementation process, when performing range URL matching, if the byte consists of 3 bits or the matching mode is an exact match, a direct comparison is made to see whether the input IP address byte is between the range bytes. If so, the match is successful.

[0026] Furthermore, the matching is performed according to the matching mode of each byte, including:

[0027] When the IP address consists of a single digit and the matching mode is rear matching, if the difference of the range address is greater than 10, the match is successful;

[0028] Otherwise, if the unit digit value of the smaller value in the range address is less than or equal to the unit digit value of the larger value, it is determined whether the IP address is within the range address;

[0029] If the units digit value of the smaller value in the range address is greater than the units digit value of the larger value, determine whether the IP address satisfies the units digit value greater than the smaller value or less than the units digit value of the larger value. If so, the match is successful.

[0030] In the above implementation process, a second case of range matching is given, and whether the IP address is a range URL is determined by quick matching.

[0031] Furthermore, the matching is performed according to the matching mode of each byte, including:

[0032] When the IP address consists of a single digit and the matching mode is front matching, if the IP address is between the hundreds digit of the smaller value and the hundreds digit of the larger value in the range address, the match is successful;

[0033] Otherwise, if the IP address is between the smaller value of the tens digit and the larger value of the hundreds digit and tens digit of the range address, the match is successful;

[0034] Otherwise, if the IP address is greater than or equal to the smaller value of the range address or the larger value of the range address, the match is successful.

[0035] In the above implementation process, a third case of range matching is given, and whether the IP address is a range URL is determined by fast matching.

[0036] The present application also provides a device for querying a website, the device comprising:

[0037] The parsing module is used to receive and parse the IP address bytes to be queried to obtain a matching method;

[0038] The matching module is used to match the policy IP address in the access control policy list according to the matching method and return the matching result, wherein the policy IP address includes the host address policy, the subnet address policy and the range address policy.

[0039] In the above implementation process, part or all of the IPv4 address can be input to perform fuzzy matching on three different address objects: host address, subnet address, and range address, thereby solving the problem that the existing method can only match the host address, which limits the scope of use.

[0040] An embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the computer device to execute any one of the above-mentioned URL query methods.

[0041] An embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, any of the above-mentioned website query methods is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of a website query method provided in an embodiment of the present application;

[0044] Figure 2 A matching flow chart provided for an embodiment of the present application;

[0045] Figure 3 A structural block diagram of a website query device provided in an embodiment of the present application;

[0046] Figure 4 A structural block diagram of another URL query device provided in an embodiment of the present application.

[0047] icon:

[0048] 100-parsing module; 101-length acquisition module; 102-matching mode acquisition module; 200-matching module. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0050] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0051] Please see Figure 1 , Figure 1 A flowchart of a URL query method provided by an embodiment of the present application. The method can be used to quickly query all or part of the IPv4 address URLs. Enter the IPv4 address (part or all) to be queried in the access control search box, parse the input IP address, match the parsed bytes with the three access policy IP address types of host address, subnet address and range address in the access control policy, and return the relevant access control policy.

[0052] The method may specifically include:

[0053] Step S100: receiving and parsing the IP address bytes to be queried to obtain a matching method;

[0054] Step S200: According to the matching method, match the policy IP address in the access control policy list and return the matching result, wherein the policy IP address includes a host address policy, a subnet address policy and a range address policy.

[0055] like Figure 2 The figure shows a matching flow chart. The matching method for resolving the IP address includes:

[0056] Step S101: Obtain the byte length of the IP address;

[0057] Step S102: Segment the bytes of the IP address according to the separator of the IP address, so as to determine the matching mode of each byte according to the position of the separator and the byte length.

[0058] If there are separators on both the left and right sides of the byte, the byte is accurately matched, and the accurate match is that the byte corresponds to the byte in the policy IP address one by one;

[0059] If there is a separator on the left side of the byte, a front match is performed on the byte, where the front match is that the byte corresponds to the front byte in the policy IP address;

[0060] If there is a separator on the right side of the byte, a rear match is performed on the byte, where the rear match is that the byte corresponds to the rear byte in the policy IP address;

[0061] If there are no separators on the left and right sides of the byte, the byte is matched at any position, and the random position match means that the byte corresponds to a byte at any position in the policy IP address.

[0062] Specifically, as shown in Table 1 below, this is the IP address byte matching method:

[0063]

[0064] Match the parsed IP address bytes with the IP address bytes in the address object referenced by the access control policy. Specifically, the following steps are included:

[0065] If the IP address byte is a host address object, a string is used for searching. If the IP address is a host address, it is a complete IP address and a string can be used for searching directly.

[0066] If the IP address byte is a subnet address object, it is converted into a range address strategy, and the IP address byte is matched according to the range address object, that is, the mask of the subnet address is the same, and the last few bits need to be matched;

[0067] If the IP address byte is a range address object, it is matched according to the matching method of each byte. Specifically, the first byte of the range address is matched with the first byte of the IP address. If the match succeeds, the second byte of the range address is matched with the second byte of the IP address. If the match fails, the second byte of the range address is re-matched with the first byte of the IP address, and so on.

[0068] For example, each byte of the IP address is matched with the bytes of the range address. For example, if the range address is 192.168.102.56 and the IP address is .68.10, 68 is not in 192, so the match fails. However, 68 matches 168 in the range address, so the match succeeds, and 10 matches 102 in the range address.

[0069] The specific matching process of the range address, for example, searching for A in BC (A, B, C represent any number between 0 and 255), includes the following cases:

[0070] First, when the number of byte bits of the IP address is 3, that is, the byte consists of 3 bits or the matching mode is the exact match MATCH_WHOLE, it is determined whether the IP address byte is between the range addresses. If so, the match is successful, such as: A=100, B=10, C=110, otherwise the match fails.

[0071] Second, when the IP address consists of a single digit and the matching mode is post-matching MATCH_POST, if the difference of the range address is greater than 10, the match is successful, such as: A=9, B=10, C=20;

[0072] Otherwise, if the unit digit value of the smaller value in the range address is less than or equal to the unit digit value of the larger value, it is determined whether the IP address is between the range addresses, such as: A=6, B=12, C=18. If so, the match is successful;

[0073] Alternatively, if the units digit value of the smaller value in the range address is greater than the units digit value of the larger value, determine whether the IP address satisfies the units digit value greater than the smaller value or less than the units digit value of the larger value. If so, the match is successful, such as A=9, B=18, C=22, otherwise the match fails.

[0074] Third, when the IP address consists of a single digit and the matching mode is the front match MATCH_PRE, if the IP address is between the hundreds digit of the smaller value and the hundreds digit of the larger value in the range address, the match is successful, such as: A=1, B=100, C=200;

[0075] Otherwise, if the IP address is between the smaller value of the tens digit and the larger value of the hundreds and tens digits of the range address, the match is successful, such as: A=9, B=80, C=100;

[0076] Otherwise, if the IP address is greater than or equal to the smaller value of the range address or the larger value of the range address, the match is successful, such as: A=8, B=9, C=100, otherwise, the match fails.

[0077] In addition, when the query byte consists of 1 bit, that is, when A<10, and the matching mode is MATCH_ALL, matching is performed according to the second and third methods mentioned above.

[0078] If the query IP address bytes entered consist of two digits, the matching method is the same as the matching method for a single digit, and will not be described here.

[0079] This method does not require a complete IP address and can obtain a matching result by quickly matching access control policies and performing fuzzy matching on three different address objects: host address, subnet address, and range address.

[0080] The present application also provides a website query device, such as Figure 3 FIG. 1 is a structural block diagram of a URL query device, wherein the device comprises:

[0081] The parsing module 100 is used to receive and parse the IP address bytes to be queried to obtain the parsing result;

[0082] The matching module 200 is used to match the parsing result with the policy IP address in the access control policy list and return the matching result. The policy IP address includes a host address policy, a subnet address policy and a range address policy.

[0083] Among them, Figure 4 As shown, it is a structural block diagram of another URL query device, and the parsing module 100 includes:

[0084] The length acquisition module 101 is used to obtain the byte length of the IP address;

[0085] The matching mode acquisition module 102 divides the bytes of the IP address according to the separator of the IP address to determine the matching mode of each byte according to the position of the separator and the byte length. For details, see the above table and will not be repeated here.

[0086] The specific matching of the matching module 200 will not be described in detail here.

[0087] An embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the computer device to execute the above-mentioned URL query method.

[0088] An embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the above-mentioned website query method is executed.

[0089] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0090] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0091] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0092] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0093] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0094] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for querying a website, characterized in that: The method comprises: Receive and parse the IP address bytes to be queried to obtain a matching method; According to the matching method, matching is performed with the policy IP address in the access control policy list, and a matching result is returned, wherein the policy IP address includes a host address policy, a subnet address policy, and a range address policy; according to the matching method, matching is performed with the policy IP address in the access control policy list, including: If the IP address bytes are a host address object, then use the string to search; If the IP address byte is a subnet address object, convert it into a range address policy and match the IP address byte according to the range address object; If the IP address byte is a range address object, it is matched according to the matching method of each byte, and the matching method of each byte includes exact match, front match, back match and random position match; wherein, the exact match means that the byte corresponds one-to-one with the byte in the policy IP address, the front match means that the byte corresponds to the front byte in the policy IP address, the back match means that the byte corresponds to the back byte in the policy IP address, and the random position match means that the byte corresponds to the byte at any position in the policy IP address.

2. The website query method according to claim 1, characterized in that: The receiving and parsing of the IP address bytes to be queried to obtain a matching method includes: Obtain the byte length of the IP address; The bytes of the IP address are segmented according to the separator of the IP address, so as to determine the matching mode of each byte according to the position of the separator and the byte length.

3. The website query method according to claim 2, characterized in that: The step of segmenting the bytes of the IP address according to the separator of the IP address to determine the matching mode of each byte according to the position of the separator and the byte length includes: If there are separators on both the left and right sides of the byte, the byte is matched exactly; If there is a separator on the left side of the byte, the byte is matched at the front; If there is a separator on the right side of the byte, the byte is matched at the rear; If there are no delimiters on the left and right sides of the byte, the byte is matched at any position.

4. The website query method according to claim 1, characterized in that: The matching is performed according to the matching mode of each byte, including: When the number of bits of the IP address byte is 3 or the matching mode is an exact match, it is determined whether the IP address byte is within the range address, and if so, the match is successful.

5. The website query method according to claim 1, characterized in that: The matching is performed according to the matching mode of each byte, including: When the IP address consists of a single digit and the matching mode is rear matching, if the difference of the range address is greater than 10, the match is successful; Otherwise, if the unit digit value of the smaller value in the range address is less than or equal to the unit digit value of the larger value, it is determined whether the IP address is between the range addresses, and if so, the match is successful; If the units digit value of the smaller value in the range address is greater than the units digit value of the larger value, determine whether the IP address satisfies the units digit value greater than the smaller value or less than the units digit value of the larger value. If so, the match is successful.

6. The website query method according to claim 1, characterized in that: The matching is performed according to the matching mode of each byte, including: When the IP address consists of a single digit and the matching mode is front matching, if the IP address is between the hundreds digit of the smaller value and the hundreds digit of the larger value in the range address, the match is successful; Otherwise, if the IP address is between the smaller value of the tens digit and the larger value of the hundreds digit and tens digit of the range address, the match is successful; Otherwise, if the IP address is greater than or equal to the smaller value of the range address or the larger value of the range address, the match is successful.

7. A website query device, characterized in that: The device comprises: The parsing module is used to receive and parse the IP address bytes to be queried to obtain the parsing result; A matching module is used to match the parsing result with the policy IP address in the access control policy list and return the matching result, wherein the policy IP address includes a host address policy, a subnet address policy and a range address policy; the matching module is specifically used to: If the IP address bytes are a host address object, then use the string to search; If the IP address byte is a subnet address object, convert it into a range address policy and match the IP address byte according to the range address object; If the IP address byte is a range address object, it is matched according to the matching method of each byte, and the matching method of each byte includes exact match, front match, back match and random position match; wherein, the exact match means that the byte corresponds one-to-one with the byte in the policy IP address, the front match means that the byte corresponds to the front byte in the policy IP address, the back match means that the byte corresponds to the back byte in the policy IP address, and the random position match means that the byte corresponds to the byte at any position in the policy IP address.

8. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the computer device to execute the URL query method according to any one of claims 1 to 6.

9. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the website query method according to any one of claims 1 to 6 is executed.

Images