Security policy management method and device, electronic device, and storage medium

Abstract

The present invention provides a security policy management method and device, electronic device, and storage medium, the method comprising: constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices; selecting any management node among the multiple management nodes as a target management node, and viewing the corresponding content in the target management node during the process of the target management node managing the security policy configuration file. The solution provided by the present invention can uniformly manage the security policy configuration files corresponding to multiple network security devices, and realize the visualization of the security policy configuration files.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security policy management method and device, electronic equipment, and storage medium. Background Art

[0002] At present, the existing centralized security policy management or analysis system needs to adapt to devices of various manufacturers and models; however, due to the large number of manufacturers, models, and versions, it is difficult to pre-adapt all devices, and it is impossible to uniformly manage the security policies of multiple network security devices. In addition, the adaptation work requires the support of on-site equipment and data, and remote development has many inconveniences. Summary of the invention

[0003] In view of the above problems, the present invention proposes a security policy management method and device, electronic device, and storage medium to at least solve the technical problem in the related art that the security policies of various network security devices cannot be uniformly managed.

[0004] According to a first aspect of the present invention, there is provided a method for managing a security policy, comprising: constructing a plurality of management nodes for managing security policy configuration files corresponding to a plurality of network security devices; selecting any one of the plurality of management nodes as a target management node, and during the process of the target management node managing the security policy configuration file, checking the corresponding content in the target management node.

[0005] Optionally, after constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices, the method further includes: after detecting that a first management node among the multiple management nodes receives an initial security policy configuration file corresponding to any network security device among the multiple network security devices, reading a preset semantic template; based on the preset semantic template, performing semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes to generate a target security policy configuration file.

[0006] Optionally, the method also includes: if the preset semantic template changes, triggering the second management node to re-semantically convert the initial security policy configuration file based on the changed semantic template; verifying the security policy configuration file after the semantic conversion through a third management node among the multiple management nodes to generate a verification result.

[0007] Optionally, the method also includes: if it is detected that the corresponding content in the first management node contains entries that have not been semantically converted, adaptively modifying the preset semantic template based on the entries that have not been semantically converted; and re-semantically converting the content in the first management node through the second management node based on the modified semantic template.

[0008] Optionally, the method further includes: during the process of the target management node managing the security policy configuration file, if the corresponding content in the target management node is edited, then the corresponding content in the management node associated with the target management node is synchronously edited.

[0009] Optionally, viewing the corresponding content in the target management node includes: if specified content in the target management node is selected, generating a prompt message corresponding to the specified content through a fourth management node among the multiple management nodes; wherein the prompt message includes at least one of the following: keyword prompts, grammar prompts, and help information about the operation guide.

[0010] Optionally, viewing the corresponding content in the target management node includes: marking the designated content in the target management node and the content corresponding to the designated content in the management node associated with the target management node.

[0011] According to a second aspect of the present invention, there is provided a security policy management device, comprising: a construction module for constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices; a viewing module for selecting any one of the multiple management nodes as a target management node, and viewing the corresponding content in the target management node during the process of the target management node managing the security policy configuration file.

[0012] Optionally, the device also includes: a reading module, which is used to read a preset semantic template after the construction module constructs multiple management nodes for managing security policy configuration files corresponding to multiple network security devices, and after it is detected that a first management node among the multiple management nodes receives an initial security policy configuration file corresponding to any network security device among the multiple network security devices; and a first conversion module, which is used to perform semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes according to the preset semantic template to generate a target security policy configuration file.

[0013] Optionally, the device also includes: a second conversion module, which is used to trigger the second management node to re-semantically convert the initial security policy configuration file according to the changed semantic template when the preset semantic template changes; and a verification module, which is used to verify the security policy configuration file after the semantic conversion through a third management node among the multiple management nodes to generate a verification result.

[0014] Optionally, the device also includes: a modification module, which is used to adaptively modify the preset semantic template based on the entries that have not been semantically converted when it is detected that the corresponding content in the first management node contains entries that have not been semantically converted; and a third conversion module, which is used to re-semantically convert the content in the first management node through the second management node based on the modified semantic template.

[0015] Optionally, the device further comprises: a synchronization module for synchronously editing corresponding contents in a management node associated with the target management node when corresponding contents in the target management node are edited during the process of the target management node managing the security policy configuration file.

[0016] Optionally, the viewing module includes: a generation module, which is used to generate a prompt message corresponding to the specified content through a fourth management node among the multiple management nodes when the specified content in the target management node is selected; wherein the prompt message includes at least one of the following: keyword prompts, grammar prompts, and help information about the operation guide.

[0017] Optionally, the viewing module includes: a marking module, configured to mark the designated content in the target management node and the content corresponding to the designated content in the management node associated with the target management node.

[0018] According to a third aspect of the present invention, there is further provided an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0019] According to a fourth aspect of the present invention, there is further provided a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned device embodiments when running.

[0020] The technical solution provided by the present invention constructs multiple management nodes for managing security policy configuration files corresponding to multiple network security devices to centrally manage the security policies of various network security devices. In the process of each management node executing the management of the security policy, the corresponding content in the management node is viewed. There is no need to connect various network security devices on site, and the security policy of any network security device can be visualized and adapted online, which is convenient for user operation and solves the technical problem in the related art that the security policies of various network security devices cannot be uniformly managed.

[0021] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below.

[0022] Based on the following detailed description of specific embodiments of the present invention in conjunction with the accompanying drawings, those skilled in the art will become more aware of the above and other objects, advantages and features of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0024] Figure 1 is a flow chart of a security policy management method provided according to an embodiment of the present invention;

[0025] Figure 2 is a structural block diagram of a security policy management device provided according to an embodiment of the present invention;

[0026] Figure 3 It is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such usage is interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the term "including" and its variants are to be interpreted as open-ended terms meaning "including but not limited to".

[0029] In order to solve the technical problems existing in the related art, a security policy management method is provided in this embodiment. The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0030] Figure 1 is a flow chart of a security policy management method provided according to an embodiment of the present invention, such as Figure 1 As shown, the process includes the following steps:

[0031] Step S102, constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices;

[0032] In this embodiment, the network security device may be a switch, a security router, a firewall, etc., which is not limited here.

[0033] Among them, security policies are security policies corresponding to various network security devices, such as firewall security policies. Firewall security policies are a basic security control mechanism that checks whether data flows can pass through firewalls according to certain rules. The essence of regulation is packet filtering. Through firewall security policies, the authority of intranet access to the external network can be controlled, and the access rights between subnets with different security levels in the intranet can be controlled. At the same time, access to the device itself can also be controlled, for example, which IP addresses can be restricted to log in to the device through Telnet and Web, and the mutual access between the network management server, NTP server, etc. and the device can be controlled.

[0034] Step S104: selecting any management node from the multiple management nodes as a target management node, and checking corresponding content in the target management node during the process of the target management node managing the security policy configuration file.

[0035] In a possible implementation of the present case, a visualization platform is constructed by Walle, which includes multiple management nodes for managing security policy configuration files of various network security devices. For example, the management nodes include a node for receiving an initial security policy configuration file, a node for semantically converting the initial security policy configuration file, a node for verifying the converted security policy configuration file, etc. The management nodes for receiving, the management nodes for conversion, the management nodes for verification, etc. are integrated on a platform interface, and multiple management nodes, such as the management node for uploading the original message (i.e., the initial security policy configuration file), the management node for translating the template, and the management node for verifying are integrated on a platform interface. The management nodes, translation results, error checking, prompt information, keyword highlighting, and operation guide (help information) of the board (i.e., the preset semantic template) are placed in one interface. Through this platform, unified management of security policy configuration files of various network devices can be achieved; further, on this platform, the corresponding content in any management node can be viewed, for example, the entries in the initial security policy configuration file can be viewed, thereby realizing the display of more management node projects as much as possible through an integrated platform; no on-site adaptation is required, real-time feedback is provided, the difficulty of adaptation is reduced, and business personnel can participate in the adaptation; deployed in a production environment, the data is true and complete, and real-time translation and real-time feedback are provided.

[0036] The security policy management method provided in the embodiment of the present invention constructs multiple management nodes for managing security policy configuration files corresponding to multiple network security devices to centrally manage the security policies of various network security devices. In the process of each management node executing the management of the security policy, the corresponding content in the management node is viewed. There is no need to connect various network security devices on site, and the security policy of any network security device can be visualized and adapted online, which is convenient for user operation and solves the technical problem in the related technology that the security policies of various network security devices cannot be uniformly managed.

[0037] A possible implementation method is provided in an embodiment of the present invention, which, after the above-mentioned step S102, also includes: after detecting that a first management node among multiple management nodes receives an initial security policy configuration file corresponding to any network security device among multiple network security devices, reading a preset semantic template; based on the preset semantic template, performing semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes to generate a target security policy configuration file.

[0038] Taking the visualization platform built by Walle as an example, after detecting that a user has uploaded a security policy configuration file corresponding to a certain network security device, the platform reads the preset semantic template and uses the preset semantic template to perform semantic conversion on the security policy configuration file uploaded by the user, thereby converting it into a standard configuration file. This simplifies the adaptation work of business personnel or operation and maintenance personnel involved in security policy adaptation, reduces adaptation costs, and improves adaptation efficiency. Due to the use of a unified semantic template, the adaptation template style is unified, and the differences caused by different personnel participating in the adaptation process are relatively small.

[0039] In an optional instance of the present embodiment, each syntax in the initial security policy configuration file is analyzed, and the syntax of the analyzed initial security policy configuration file is matched with the syntax in the preset semantic template; if they are the same, there is no need to perform semantic conversion on the initial security policy configuration file; otherwise, the initial security policy configuration file is semantically converted; if part of the syntax in the initial security policy configuration file is different from the preset semantic template, semantic conversion is performed on part of the grammatical structure.

[0040] In an optional embodiment of the present case, if the preset semantic template changes, the second management node is triggered to re-semantically convert the initial security policy configuration file based on the changed semantic template; the security policy configuration file after the semantic conversion is verified by the third management node among the multiple management nodes to generate a verification result.

[0041] Taking the visualization platform built by Walle as an example, if the syntax in the preset semantic template changes, the management node on the visualization platform used to convert the initial security policy configuration file will be triggered, and the initial security policy configuration file will be semantically converted again according to the changed semantic template; further, the management node used for verification will be triggered to verify the conversion result. After the configuration is completed, it will be verified immediately and the verification result will be displayed to the user so that the user can make correct judgments and operations based on the verification results.

[0042] Optionally, highlighting or other marking operations are performed on the content items converted using the changed semantic template to facilitate user viewing.

[0043] In another example, a newly added or modified grammar is input into a preset semantic template, which triggers the generation of a prompt message of the newly added or modified grammar and sends it to the user for the user to view.

[0044] According to the above embodiment, if it is detected that the corresponding content in the first management node contains entries that have not been semantically converted, the preset semantic template is adaptively modified based on the entries that have not been semantically converted; based on the modified semantic template, the content in the first management node is semantically converted again through the second management node.

[0045] In an optional example of the present case, the target security policy configuration file is detected through the management node for semantic conversion. If there are 10 entries in the initial security policy configuration file, but the target security policy configuration file has only performed semantic conversion on 5 of the entries, and the remaining 5 entries in the initial security policy configuration file have not been semantically converted, then it is confirmed that the syntax template corresponding to the remaining 5 entries has not been converted in the preset semantic template, and the initial security policy configuration file is semantically converted again by adding new syntax to the preset semantic template and using the content in the input semantic template.

[0046] Through the above-mentioned embodiments, different management nodes can be mutually verified and associated with each other, and the correctness of the semantic template can be guaranteed from multiple dimensions, thereby improving the accuracy of adaptation.

[0047] In a possible implementation of the present case, during the process of the target management node managing the security policy configuration file, if the corresponding content in the target management node is edited, the corresponding content in the management node associated with the target management node is edited synchronously.

[0048] For example, modifying the initial security policy configuration file in the first management node will trigger the management node for verification and the management node for translation, and synchronize the corresponding content in the translation management node and the verification management node; optionally, the updated content in the verification management node and the conversion management node can also be highlighted or marked in other ways. Thus, when a management node is modified or clicked, the relevant management nodes will give feedback at the same time, so that users can give feedback in time according to the feedback results; it is convenient to troubleshoot and modify problems, and they take effect in real time.

[0049] In a possible implementation of the present case, if the specified content in the target management node is selected, a prompt message corresponding to the specified content is generated by a fourth management node among the multiple management nodes; wherein the prompt message includes at least one of the following: a keyword prompt, a grammar prompt, and help information about the operation guide. In this embodiment, selecting a keyword or grammar will trigger the management node to generate a prompt message, and the operation guide will display relevant help information.

[0050] Preferably, viewing the corresponding content in the target management node includes: marking the designated content in the target management node and the content corresponding to the designated content in the management node associated with the target management node. For example, the remaining entries in the initial security policy configuration file that have not been semantically converted are highlighted; modifying the initial security policy configuration file will trigger verification and translation (i.e., the above-mentioned semantic conversion), and the translation result will highlight the corresponding entry; clicking on the content in the initial security policy configuration file will highlight the corresponding entry as a result of the translation; clicking on the translation result entry will highlight the corresponding original message (initial security policy configuration file).

[0051] According to the steps of the above-mentioned embodiment, the present invention constructs an integrated visual adaptation framework, which places the original message, translation template, translation result, error check, prompt information, keyword highlighting, and operation guide in one interface; each module is interrelated and verified with each other, and prompts and feedback are given in real time, so that users can make correct judgments and operations based on the feedback; it is impossible to adapt online on site, and the security policy data is complete and takes effect in real time; there is no need to face the problem of lack of real data, and after the configuration is completed, it is verified immediately and put into production; the difficulty of adaptation is simplified, the efficiency and quality of adaptation are improved, and non-developers can also participate in the equipment adaptation work; in addition, due to the use of a unified preset semantic template, the style is consistent, the adaptation quality is improved, and the maintenance difficulty is reduced; it is convenient to check and modify problems, and they take effect in real time.

[0052] Based on the security policy management method provided in each of the above embodiments, based on the same inventive concept, a security policy management device is also provided in this embodiment, which is used to implement the above embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0053] Figure 2 is a structural block diagram of a security policy management device provided according to an embodiment of the present invention, such as Figure 2 As shown, the device includes: a construction module 20, which is used to construct multiple management nodes for managing security policy configuration files corresponding to multiple network security devices; a viewing module 22, which is connected to the above-mentioned construction module 20, and is used to select any management node among the multiple management nodes as the target management node, and view the corresponding content in the target management node during the process of the target management node managing the security policy configuration file.

[0054] Optionally, the above-mentioned device also includes: a reading module, which is used to read a preset semantic template after the construction module constructs multiple management nodes for managing security policy configuration files corresponding to multiple network security devices, and after it is detected that a first management node among the multiple management nodes receives an initial security policy configuration file corresponding to any network security device among the multiple network security devices; a first conversion module, which is used to perform semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes according to the preset semantic template to generate a target security policy configuration file.

[0055] Optionally, the above-mentioned device also includes: a second conversion module, which is used to trigger the second management node to re-semantically convert the initial security policy configuration file according to the changed semantic template when the preset semantic template changes; and a verification module, which is used to verify the security policy configuration file after the semantic conversion through a third management node among multiple management nodes to generate a verification result.

[0056] Optionally, the above-mentioned device also includes: a modification module, which is used to adaptively modify the preset semantic template according to the entries that have not been semantically converted when it is detected that the corresponding content in the first management node contains entries that have not been semantically converted; and a third conversion module, which is used to re-semantically convert the content in the first management node through the second management node according to the modified semantic template.

[0057] Optionally, the above-mentioned device also includes: a synchronization module, which is used to synchronously edit the corresponding content in the management node associated with the target management node when the corresponding content in the target management node is edited during the process of the target management node managing the security policy configuration file.

[0058] Optionally, the viewing module includes: a generation module, which is used to generate a prompt message corresponding to the specified content through a fourth management node among multiple management nodes when the specified content in the target management node is selected; wherein the prompt message includes at least one of the following: keyword prompts, grammar prompts, and help information about the operation guide.

[0059] Optionally, the viewing module includes: a marking module, configured to mark the designated content in the target management node and the content corresponding to the designated content in the management nodes associated with the target management node.

[0060] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0061] An embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0062] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0063] S1, constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices;

[0064] S2, selecting any management node among the multiple management nodes as a target management node, and checking corresponding content in the target management node during the process of the target management node managing the security policy configuration file.

[0065] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0066] Based on the above Figure 1 The method shown and Figure 2 In order to achieve the above-mentioned purpose, the embodiment of the present invention also provides an electronic device, such as Figure 3 As shown, the system includes a memory 32 and a processor 31, wherein the memory 32 and the processor 31 are both arranged on a bus 33. The memory 32 stores a computer program, and the processor 31 executes the computer program to realize Figure 1 The management method of security policy shown.

[0067] Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a memory (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various implementation scenarios of the present invention.

[0068] Optionally, the device may also be connected to a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Bluetooth interface, a WI-FI interface), etc.

[0069] Those skilled in the art will appreciate that the structure of an electronic device provided in this embodiment does not limit the physical device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0070] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0071] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security policy management method, characterized in that: The method is used in a visualization platform, comprising: Constructing multiple management nodes for managing security policy configuration files corresponding to multiple network security devices in the visualization platform, wherein the multiple management nodes are integrated on a platform interface, so as to realize unified management of security policy configuration files of multiple network devices through the visualization platform; Selecting any one of the multiple management nodes as a target management node, and viewing corresponding content in the target management node during the process in which the target management node manages the security policy configuration file; The multiple management nodes include: A first management node for receiving an initial security policy configuration file; A second management node for performing semantic conversion on the initial security policy configuration file; A third management node for verifying the converted security policy configuration file; a fourth management node for generating a prompt message corresponding to a specified content, wherein the specified content is the corresponding content selected in the target management node; After constructing a plurality of management nodes for managing security policy configuration files corresponding to a plurality of network security devices, the method further includes: After detecting that a first management node among the plurality of management nodes receives an initial security policy configuration file corresponding to any network security device among the plurality of network security devices, reading a unified preset semantic template; The preset semantic template is used to perform semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes to convert the configuration file into a standard configuration file, thereby generating a target security policy configuration file.

2. The method according to claim 1, characterized in that The method further comprises: If the preset semantic template is changed, triggering the second management node to re-semantically convert the initial security policy configuration file according to the changed semantic template; The security policy configuration file after the semantic conversion is verified by a third management node among the multiple management nodes to generate a verification result.

3. The method according to claim 1, characterized in that The method further comprises: If it is detected that the corresponding content in the first management node contains entries that have not been semantically converted, adaptively modifying the preset semantic template according to the entries that have not been semantically converted; According to the modified semantic template, the second management node re-semantically converts the content in the first management node.

4. The method according to claim 1, characterized in that The method further comprises: In the process of the target management node managing the security policy configuration file, if the corresponding content in the target management node is edited, the corresponding content in the management node associated with the target management node is edited synchronously.

5. The method according to claim 1, characterized in that The checking of the corresponding content in the target management node includes: If the specified content in the target management node is selected, a prompt message corresponding to the specified content is generated through a fourth management node among the multiple management nodes; The prompt message includes at least one of the following: keyword prompt, grammar prompt, and help information about the operation guide.

6. The method according to any one of claims 1 to 5, characterized in that The checking of the corresponding content in the target management node includes: The designated content in the target management node and the content corresponding to the designated content in the management node associated with the target management node are marked.

7. A security policy management device, characterized in that: include: A construction module is used to construct multiple management nodes for managing security policy configuration files corresponding to multiple network security devices in a visualization platform, wherein the multiple management nodes are integrated on a platform interface to achieve unified management of security policy configuration files of multiple network devices through the visualization platform; A viewing module, used for selecting any management node among the multiple management nodes as a target management node, and viewing corresponding content in the target management node during the process in which the target management node manages the security policy configuration file; The multiple management nodes include: A first management node for receiving an initial security policy configuration file; A second management node for performing semantic conversion on the initial security policy configuration file; A third management node for verifying the converted security policy configuration file; a fourth management node for generating a prompt message corresponding to a specified content, wherein the specified content is the corresponding content selected in the target management node; A reading module is used to, after a construction module constructs multiple management nodes for managing security policy configuration files corresponding to multiple network security devices, read a unified preset semantic template when it is detected that a first management node among the multiple management nodes receives an initial security policy configuration file corresponding to any network security device among the multiple network security devices, and use the preset semantic template to perform semantic conversion on the initial security policy configuration file through a second management node among the multiple management nodes to convert it into a standard configuration file, thereby generating a target security policy configuration file.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images