Policy configuration merging method and device

Abstract

The present application provides a policy configuration merging method and device, the method comprising: obtaining a set of policies to be merged that a target object can inherit; merging the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtaining a target policy set; configuring the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: a strong policy and a weak policy; the priority of the strong policy that the target object can inherit is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that the target object can inherit is lower than the priority of the weak policy corresponding to the target object. The present application provides a policy configuration merging method and device, which are used to solve the problem that the security policies of a terminal may conflict.

Description

Technical Field

[0001] The present application relates to the field of terminal security technology, and in particular to a policy configuration merging method and device. Background Art

[0002] While users are enjoying the convenience and resource sharing brought by the Internet, they are also facing network threats, such as viruses, Trojans, ransomware, hackers, and even planned and large-scale attacks by institutional or professional teams. Therefore, network security is becoming more and more important, but network threats are also constantly changing, bringing great challenges to security. The terminals running in the enterprise intranet are the main breakthrough points for attacking the intranet. If the terminal is successfully infiltrated, the outer defense line is broken and the intranet is exposed.

[0003] In the related art, security policies can be configured for terminals to improve the security of the terminals. However, due to the complexity of the network structure, which includes multiple levels, and the security policies configured at different levels may also be different, the security policies finally received by the terminals may conflict. Summary of the invention

[0004] The purpose of the present application is to provide a policy configuration merging method and device for resolving the problem that the security policies of a terminal may conflict.

[0005] The present application provides a policy configuration merging method, including:

[0006] Obtain a set of policies to be merged that the target object can inherit; merge the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtain a target policy set; configure the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: strong policies and weak policies; the priority of the strong policy that the target object can inherit is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that the target object can inherit is lower than the priority of the weak policy corresponding to the target object.

[0007] Optionally, obtaining the set of policies to be merged that the target object can inherit includes: obtaining the target path of the target object in a grouping tree and the policies to be merged corresponding to each node on the target path; generating the set of policies to be merged based on the policies to be merged corresponding to each node; wherein the grouping tree is used to indicate the relationship between various levels of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; and according to the inheritance order of the policies, the node where the target object is located is located at the end point of the target path.

[0008] Optionally, the policies to be merged are merged according to the priorities of the policies included in the policy set to be merged, and a target policy set is obtained, including: initializing the target policy set; traversing each policy to be merged in turn according to the priorities of the policies to be merged included in the policy set to be merged from high to low, and configuring the corresponding policy in the target policy set according to the priority of each policy to be merged.

[0009] Optionally, the method traverses each policy to be merged in turn according to the priority of the policies to be merged contained in the policy set to be merged from high to low, and configures the corresponding policy in the target policy set according to the priority of each policy to be merged, including: when the target policy corresponding to the target policy to be merged in the target policy set is a null value, configuring the target policy according to the configuration content of the target policy to be merged; or, when the target policy is not a null value, ignoring the target policy to be merged; or, when the target policy does not include the policy corresponding to the target policy to be merged, ignoring the target policy to be merged; wherein the target policy to be merged is any policy among the policies to be merged.

[0010] Optionally, the target nodes on the target path include: ordinary groups and custom groups; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the ordinary group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the ordinary group; obtaining the target path of the target object in the grouping tree and the policies to be merged corresponding to each node on the target path, includes: adding the custom group as a child node of the target node to the target path; obtaining the policies to be merged corresponding to each node on the target path.

[0011] The present application also provides a policy configuration merging device, including:

[0012] An acquisition module is used to acquire a set of policies to be merged that can be inherited by a target object; a merging module is used to merge the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtain a target policy set; a configuration module is used to configure the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: strong policies and weak policies; the priority of the strong policy that can be inherited by the target object is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that can be inherited by the target object is lower than the priority of the weak policy corresponding to the target object.

[0013] Optionally, the device also includes: a generation module; the acquisition module is specifically used to acquire the target path of the target object in the grouping tree and the policies to be merged corresponding to each node on the target path; the generation module is used to generate the set of policies to be merged based on the policies to be merged corresponding to each node; wherein the grouping tree is used to indicate the relationship between each level of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; according to the order of inheritance of the policies, the node where the target object is located is located at the end point of the target path.

[0014] Optionally, the device also includes: an initialization module; the initialization module is used to initialize the target policy set; the merging module is specifically used to traverse each policy to be merged in turn according to the priority of the policies to be merged contained in the policy set to be merged from high to low, and configure the corresponding policy in the target policy set according to the priority of each policy to be merged.

[0015] Optionally, the merging module is specifically used to configure the target policy according to the configuration content of the target policy to be merged when the target policy corresponding to the target policy to be merged in the target policy set is a null value; or, the merging module is specifically used to ignore the target policy to be merged when the target policy is not a null value; or, the merging module is specifically used to ignore the target policy to be merged when the target policy does not include a policy corresponding to the target policy to be merged; wherein, the target policy to be merged is any policy among the policies to be merged.

[0016] Optionally, the device also includes: an adjustment module; the target nodes on the target path include: ordinary groups and custom groups; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the ordinary group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the ordinary group; the adjustment is used to add the custom group as a child node of the target node to the target path; the acquisition module is specifically used to obtain the policy to be merged corresponding to each node on the target path.

[0017] The present application also provides a computer program product, including a computer program / instruction, which implements the steps of any of the above-mentioned policy configuration merging methods when executed by a processor.

[0018] The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned policy configuration merging methods are implemented.

[0019] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned policy configuration merging methods are implemented.

[0020] The policy configuration merging method and device provided by the present application, when configuring security policies for a terminal, first obtains the policy entities to be merged that can be inherited by the target object. Then, according to the priority of the policies contained in the policy entities to be merged, the policy entities to be merged are merged to obtain the target policy set entity. Finally, according to the policies contained in the target policy set entity, the target object is configured. This avoids the possibility of conflicts between security policy configurations at various levels when configuring security policies for the terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 This is one of the flow charts of the policy configuration merging method provided in this application;

[0023] Figure 2 This is the second flow chart of the policy configuration merging method provided by this application;

[0024] Figure 3 This is the third flow chart of the policy configuration merging method provided by this application;

[0025] Figure 4 It is a structural diagram of a policy configuration merging device provided by the present application;

[0026] Figure 5 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0029] In the related art, configuring security policies for terminals in the intranet environment to improve the security of the terminals has become an important means to protect the security of the intranet network. However, due to the complexity of the network structure, which includes multiple layers, and the security policies configured at different layers may also be different, the security policies finally received by the terminal may conflict.

[0030] After the policy is configured and issued on the server, it is difficult to predict what security policy the terminal will eventually receive due to the complexity of the network structure. This involves a group tree, which exists in a tree structure. A group tree has multiple group nodes connected in a hierarchical manner. Each node can be configured with a policy entity. A policy entity contains multiple policy configuration items, which can easily lead to configuration conflicts.

[0031] In a complex network environment, policy configuration conflicts are prone to occur. The embodiment of the present application provides a policy configuration merging method, which can merge configurations at various levels to avoid conflicts.

[0032] The following describes in detail the policy configuration merging method provided in the embodiment of the present application through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0033] like Figure 1 As shown, an embodiment of the present application provides a policy configuration merging method, which may include the following steps 101 to 103:

[0034] Step 101: Obtain a set of policies to be merged that the target object can inherit.

[0035] Exemplarily, the embodiments of the present application may be applied to a multi-terminal policy configuration scenario based on a server-client (Client-Server, C / S) architecture, and the target object may be a client in the C / S architecture.

[0036] For example, the server can set a separate security policy for the network device at the level where the target object is located, and similarly, can also set a separate security policy for the parent network device at the level where the target object is located. The target object will inherit the security policies of all upper-level networks.

[0037] Exemplarily, the server may set at least one policy entity for each level of network equipment. The policy configuration items contained in each policy entity are the same, and the policy configuration items contained in policy entities of different levels are also the same. The difference is that the configurations of the policy configuration items of different policy entities may be different.

[0038] It should be noted that the above-mentioned policy entity contains basic information (including business type, strength type, ranking, name, etc.). Ranking and strength are two data, but they have a certain correlation. The priority of a strong policy must be higher than that of a weak policy, but the priority between two strong policies needs to be compared and determined by ranking; as well as a collection of policy configuration items. A policy entity can contain at least one policy configuration item.

[0039] The above policy configuration items can be<key,value> It exists in the form of key-value pairs. Policy configuration items are defined by policy schema. Policy configuration items distinguish between user policies and terminal policies, or a certain configuration item can be used for both terminal policies and user policies. It should be noted that if a target account is logged in to the target terminal, then according to the principle that the priority of user policy is greater than the priority of terminal policy, the security policy of the target terminal logged in with the target account is the security policy of the target account.

[0040] The above policy schema is used to constrain and standardize the format and data type of policy configuration items. The schema describes the business, data type, merging method, and available types of configuration items to which a policy configuration item belongs.

[0041] Step 102: Merge the policies to be merged according to the priorities of the policies to be merged included in the policy set to be merged, and obtain a target policy set.

[0042] Among them, the set of policies to be merged includes: strong policies and weak policies; the priority of the strong policy that the target object can inherit is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that the target object can inherit is lower than the priority of the weak policy corresponding to the target object.

[0043] For example, since different policy entities have different priorities, the priorities of the same policy contained in the policy entity are also different. After obtaining all policy entities that the target object can inherit, different configurations of the same policy can be prioritized according to the priorities of different policy entities, and the configuration with the highest priority is used as the configuration of the policy of the target object.

[0044] For example, the configuration of policy 1 assigned by the server to the network device at the level of the target object is configuration 1, the configuration of policy 1 assigned by the server to the parent network device of the target object is configuration 2, and the configuration of policy 1 assigned by the server to the grandparent network device of the target object is configuration 3. Then, the above configurations 1, 2, and 3 will all be used as candidate configurations for policy 1 of the target object. Since the priority of configuration 3 is higher than that of configuration 2, and the priority of configuration 2 is higher than that of configuration 1, the configuration of policy 1 of the target object is finally configuration 3.

[0045] Exemplarily, when the server allocates multiple policy entities to each level of network devices, the policy entities can be divided into strong policy entities and weak policy entities. The policies included in the strong policy entities are strong policies; and the policies included in the weak policy entities are weak policies.

[0046] Exemplarily, by setting strong and weak priorities for different policy entities at the same level, different policy entities can act on the same object together without causing configuration conflicts.

[0047] For strong and weak policies set at the same level, the priority of the strong policy is higher than that of the weak policy. For strong and weak policies set at different levels, the priority of the upper strong policy is higher than that of the lower strong policy, and the priority of the upper weak policy is lower than that of the lower weak policy. The policy entities with strong and weak attributes act on the same object together, which not only makes it easier for administrators to switch between different policies, but also prevents policy conflicts.

[0048] Step 103: Configure the target object according to the policies included in the target policy set.

[0049] Exemplarily, after all the acquired policies to be merged are prioritized, the configuration with the highest priority of each policy is used as the configuration of the policy corresponding to the target object.

[0050] In this way, when configuring the security policy for the target object, first obtain the policy entity to be merged that the target object can inherit. Then, merge the policy entity to be merged according to the priority of the policy contained in the policy entity to be merged, and obtain the target policy set entity. Finally, configure the target object according to the policy contained in the target policy set entity. This avoids the possibility of conflict between the security policy configurations at various levels when configuring the security policy for the terminal.

[0051] Optionally, in an embodiment of the present application, a grouping tree may be constructed based on the above network architecture, and security policies corresponding to all nodes on the path where the target object is located may be obtained through the grouping tree.

[0052] Exemplarily, the above step 101 may include the following steps 101a1 and 101a2:

[0053] Step 101a: Obtain a target path of the target object in the grouping tree and a strategy to be merged corresponding to each node on the target path.

[0054] Step 101a2: Generate the set of strategies to be merged based on the strategies to be merged corresponding to each node.

[0055] Among them, the grouping tree is used to indicate the relationship between various levels of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; according to the order of inheritance of the policies, the node where the target object is located is located at the end point of the target path.

[0056] It should be noted that for any policy item, in the above policy set to be merged, there are the same number of policies as the number of nodes in the above target path (excluding the root node). For example, the above target path includes 3 nodes in addition to the root node. For policy 1, in the above policy set to be merged, there are three configurations of policy 1 corresponding to the policy 1.

[0057] Exemplarily, when the target object is a network device of any child node in the grouping tree, the target path of the target object in the grouping tree can be obtained through the grouping tree, that is, all upper nodes associated with the target object and the corresponding security policies.

[0058] Exemplarily, based on the above description of strong and weak policies, in the grouping tree, the priority of the strong policy of the parent node is higher than that of the child node; the priority of the weak policy of the parent node is lower than that of the child node.

[0059] For example, Figure 2As shown in the figure, it is a group tree obtained based on the network architecture, where the Root node is the server, group P1 includes three terminals, namely C1, C2, and C3; group P2 includes three terminals, namely C4, C5, and C6. The server can configure different security policies for group P1 and group P2, and the security policy configured for group P1 can be inherited by C1, C2, and C3. Through this group tree, it is easy to obtain the path of terminal C3 in the group tree ( Figure 2 The thick line part in the middle) and obtain the security policy corresponding to each node.

[0060] In this way, the grouping tree constructed based on the network architecture can not only quickly determine all the upper-level nodes that have an association relationship with the target object, but also quickly obtain the security policy corresponding to each upper-level node.

[0061] Furthermore, in an embodiment of the present application, before merging the above-obtained policies to be merged, a policy entity needs to be initialized, and then the above-obtained policies to be merged are configured for corresponding policies in the policy entity according to the priority.

[0062] Exemplarily, the above step 102 may include the following steps 102a1 and 102a2:

[0063] Step 102a1: Initialize the target policy set.

[0064] Step 102a2: traverse each policy to be merged in turn according to the priority of the policies to be merged contained in the policy set to be merged from high to low, and configure the corresponding policy in the target policy set according to the priority of each policy to be merged.

[0065] Exemplarily, after initializing the target policy set, for any target policy in the target policy set, all the policies to be merged corresponding to the target policy in the above-mentioned policy set to be merged can be prioritized, and the configuration content of the policy to be merged with the highest priority can be used as the configuration of the target policy.

[0066] Furthermore, the above step 102a2 may include the following steps 102a21, 102a22 or 102a23:

[0067] Step 102a21: When the target policy corresponding to the target policy to be merged in the target policy set is a null value, configure the target policy according to the configuration content of the target policy to be merged.

[0068] Step 102a22: When the target policy is not a null value, ignore the target policy to be merged.

[0069] Step 102a23: When the target policy does not include a policy corresponding to the target policy to be merged, ignore the target policy to be merged.

[0070] The target strategy to be merged is any strategy among the strategies to be merged.

[0071] It is understandable that the policies corresponding to different nodes do not configure all configuration items. Therefore, it is necessary to traverse the policies corresponding to all nodes. If a configuration item is not configured in the policies corresponding to all nodes, the configuration item will eventually be null. If a configuration item has been configured in a policy with a high priority, the subsequent configuration of the configuration item can be ignored.

[0072] For example, take the map type container dst as the container for storing policy configuration items and traverse the policies to be merged sorted by priority: (1) Traverse all policy configuration items contained in the current policy entity of the target object<k,v> , repeat the steps mentioned below; (2) If the value of v is empty, skip this k and go to the next k; (3) Check whether this k is in the schema of the business being merged by the current strategy. If this k does not exist in the schema, it means that this k is illegal, skip it and go to the next k; (4) Check whether this k exists in dst. If not,<k,v> Add it directly to dst; (5) If the same k already exists in dst, temporarily called dk, and the corresponding value is called dv, when it is found after checking that the v corresponding to the k is inconsistent with the dv type, skip it and go to the next k. (Because once the type of the policy configuration item is determined, it is not allowed to be changed later, so the illegal k is directly discarded after it appears); (6) Now, the situation is that there is a dk in dst that is the same as the current k. Next, check the data type of the k that has been determined in the schema definition. If the data type is not a container type (that is, List or Map type), skip it directly to the next k. (Because the non-container type means that there can only be one value for the k, and the data traversed now has been sorted from high to low according to priority in the previous step, and the previous priority is higher, so if the same k appears later, skip it directly) If it is a container type, continue to the next step; (7) Get the definition of the merge method of the k in the schema. If it is an overwrite type, skip it and go to the next k; if it is an append type, append the v corresponding to the k to the value corresponding to the k in dst. After traversing all policy entities, the obtained dst will contain all the required<k,v> The key-value pair is the final result of the policy merge. At this point, the policy merge is complete, and the policy that the terminal finally receives is the value in dst.

[0073] Optionally, in an embodiment of the present application, the administrator may separately divide several network devices in a target group and set security policies for them separately. Since the separately divided network devices still belong to the network devices in the above target group in the above grouping tree, for such cases, they can be logically divided into sub-levels of the target group.

[0074] Exemplarily, the target nodes on the above-mentioned target path include: ordinary groups and custom groups; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the ordinary group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the ordinary group.

[0075] Exemplarily, the above step 101a1 may include the following steps 101a11 and 101a12:

[0076] Step 102a11: Add the custom group as a child node of the target node to the target path.

[0077] Step 102a12: Obtain the strategy to be merged corresponding to each node on the target path.

[0078] Exemplarily, after regenerating the grouping tree with the custom grouping as the child node of the target node, the strategy to be merged corresponding to each node on the target path is obtained. After that, the obtained strategies to be merged are prioritized and after merging, a target strategy set is obtained.

[0079] For example, combining Figure 2 ,like Figure 3 As shown, if the terminal C3 in the group P1 is divided into the custom group P3, at this time, since the terminal C3 still belongs to the device in the group P1 in the group tree, the policy corresponding to each node on the path obtained according to the path of C3 in the group tree cannot obtain the policy configured by the server for the group P3. At this time, it is necessary to add the group P3 as a child node of the group P1 to the group tree and perform subsequent operations.

[0080] It should be noted that a terminal can and must belong to only one common group, but can belong to multiple filters (custom groups). There can be multiple terminals in a group. A group represents a range. Configuring a policy on a group means that all terminals in this range will be affected accordingly.

[0081] A custom group also represents a range. You can configure policies on the custom group, and the endpoints in the range will be affected. Unlike common groups, endpoints can belong to multiple filter groups at the same time, and when a custom group conflicts with a common group, the custom group has a higher priority.

[0082] The significance of custom groups. For example, there is a company A, which consists of the administrative department B1, the technical department B2, and the marketing department B3. A is equivalent to the root group, and B1, B2, and B3 are common groups. The server can only issue policies to A, then all terminals of company A will be affected, or it can only issue policies to B1, and accordingly, only the terminals of the administrative department will be affected.

[0083] If policies are only issued to some terminals in the administration department, but not all terminals, it is impossible to create a new group to include these terminals. A terminal can only belong to one common group and these terminals belong to the administration department, not other departments. A new group cannot be created on the terminal group tree of Company A, which is unreasonable in terms of the company structure. On this basis, filters, namely custom groups, are introduced. Custom group S1 can be added under B1 to filter out some terminals and issue policies to them.

[0084] Specifically, combined Figure 3 , for the specific method of obtaining the custom group P3, the basic information (meta) of all groups associated with the terminal C3 can be obtained, including: ordinary groups and custom groups. After that, to construct the child node where the terminal is located, the node identity identification number (Identity document, ID) id1 of the first node in the above target path can be traversed, and the node ID can be compared with the parent node ID in the basic information of C3 above to obtain the basic information of the parent node ID id1, and the basic information is recorded in the filter child node combination of the ordinary group with ID id1, thereby obtaining a new grouping tree.

[0085] The policy configuration merging method provided by the embodiment of the present application is that after the server issues the security policy, the terminal obtains the target path based on the grouping tree of the network in which it is located, and obtains the security policy corresponding to each node on the target path. Afterwards, the obtained security policies are sorted according to the priority and merged into a target policy set. Finally, the policies in the target policy set are used as the security policies of the target object. The configuration policy merging method in the present application can basically avoid the occurrence of policy conflicts.

[0086] It should be noted that the policy configuration merging method provided in the embodiment of the present application can be executed by a policy configuration merging device, or a control module in the policy configuration merging device for executing the policy configuration merging method. In the embodiment of the present application, the policy configuration merging device provided in the embodiment of the present application is described by taking the policy configuration merging method executed by the policy configuration merging device as an example.

[0087] It should be noted that, in the embodiments of the present application, the above-mentioned various methods shown in the drawings. The policy configuration merging method is illustrated by combining an accompanying drawing in the embodiments of the present application as an example. In specific implementation, the policy configuration merging method shown in the above-mentioned various method drawings can also be implemented in combination with any other drawings that can be combined as shown in the above-mentioned embodiments, which will not be repeated here.

[0088] The policy configuration merging device provided in the present application is described below, and the policy configuration merging method described below and above can be referenced to each other.

[0089] Figure 4 A schematic diagram of the structure of a policy configuration merging device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, it specifically includes: an acquisition module 401, used for acquiring a set of policies to be merged that can be inherited by the target object; a merging module 402, used for merging the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtaining a target policy set; a configuration module 403, used for configuring the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: a strong policy and a weak policy; the priority of the strong policy that can be inherited by the target object is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that can be inherited by the target object is lower than the priority of the weak policy corresponding to the target object.

[0090] Optionally, the device also includes: a generation module; the acquisition module 401 is specifically used to obtain the target path of the target object in the grouping tree and the policies to be merged corresponding to each node on the target path; the generation module is used to generate the set of policies to be merged based on the policies to be merged corresponding to each node; wherein the grouping tree is used to indicate the relationship between each level of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; according to the order of inheritance of the policies, the node where the target object is located is located at the end point of the target path.

[0091] Optionally, the device also includes: an initialization module; the initialization module is used to initialize the target policy set; the merging module 402 is specifically used to traverse each policy to be merged in turn according to the priority of the policies to be merged contained in the policy set to be merged from high to low, and configure the corresponding policy in the target policy set according to the priority of each policy to be merged.

[0092] Optionally, the merging module 402 is specifically used to configure the target policy according to the configuration content of the target policy to be merged when the target policy corresponding to the target policy to be merged in the target policy set is a null value; or, the merging module 402 is specifically used to ignore the target policy to be merged when the target policy is not a null value; or, the merging module 402 is specifically used to ignore the target policy to be merged when the target policy does not include a policy corresponding to the target policy to be merged; wherein the target policy to be merged is any policy among the policies to be merged.

[0093] Optionally, the device also includes: an adjustment module; the target nodes on the target path include: ordinary groups and custom groups; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the ordinary group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the ordinary group; the adjustment is used to add the custom group as a child node of the target node to the target path; the acquisition module 401 is specifically used to obtain the policy to be merged corresponding to each node on the target path.

[0094] The policy configuration merging device provided by the present application, when the server sends down the security policy, the terminal obtains the target path based on the grouping tree of the network in which it is located, and obtains the security policy corresponding to each node on the target path. After that, the obtained security policies are sorted according to the priority and merged into a target policy set. Finally, the policy in the target policy set is used as the security policy of the target object. The configuration policy merging method in the present application can basically avoid the occurrence of policy conflicts.

[0095] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the policy configuration merging method, which includes: obtaining a set of policies to be merged that can be inherited by the target object; merging the policies to be merged according to the priorities of the policies to be merged included in the set of policies to be merged, and obtaining a target policy set; configuring the target object according to the policies included in the target policy set; wherein the set of policies to be merged includes: a strong policy and a weak policy; the priority of the strong policy that can be inherited by the target object is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that can be inherited by the target object is lower than the priority of the weak policy corresponding to the target object.

[0096] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0097] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the policy configuration merging method provided by the above-mentioned methods, and the method includes: obtaining a set of policies to be merged that can be inherited by the target object; merging the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtaining a target policy set; configuring the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: a strong policy and a weak policy; the priority of the strong policy that can be inherited by the target object is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that can be inherited by the target object is lower than the priority of the weak policy corresponding to the target object.

[0098] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned policy configuration merging methods, the method comprising: obtaining a set of policies to be merged that can be inherited by the target object; merging the policies to be merged according to the priorities of the policies to be merged contained in the set of policies to be merged, and obtaining a target policy set; configuring the target object according to the policies contained in the target policy set; wherein the set of policies to be merged includes: a strong policy and a weak policy; the priority of the strong policy that can be inherited by the target object is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that can be inherited by the target object is lower than the priority of the weak policy corresponding to the target object.

[0099] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0100] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A policy configuration merging method, characterized in that: include: Get the set of strategies to be merged that the target object can inherit; According to the priorities of the policies to be merged included in the policy set to be merged, the policies to be merged are merged to obtain a target policy set; Configure the target object according to the policies included in the target policy set; The set of policies to be merged includes: strong policies and weak policies; for strong policies and weak policies set at the same level, the priority of the strong policy is higher than that of the weak policy; for strong policies and weak policies set at different levels; the priority of the strong policy that the target object can inherit is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that the target object can inherit is lower than the priority of the weak policy corresponding to the target object; The step of obtaining the set of strategies to be merged that the target object can inherit includes: Obtaining a target path of the target object in the grouping tree and a strategy to be merged corresponding to each node on the target path; Based on the to-be-merged strategies corresponding to each node, generating the to-be-merged strategy set; The grouping tree is used to indicate the relationship between the various levels of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; according to the inheritance order of the policies, the node where the target object is located is located at the end of the target path; The target nodes on the target path include: a common group and a custom group; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the common group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the common group; The obtaining of the target path of the target object in the grouping tree and the to-be-merged strategy corresponding to each node on the target path includes: Adding the custom group as a child node of the target node to the target path; Obtain the strategy to be merged corresponding to each node on the target path; Among them, a terminal belongs to a common group and belongs to at least one custom group; and there is at least one terminal on a group.

2. The method according to claim 1, characterized in that The merging the policies to be merged according to the priorities of the policies to be merged included in the policy set to be merged, and obtaining a target policy set, includes: Initialize the target strategy set; According to the priorities of the policies to be merged contained in the policy set to be merged from high to low, each policy to be merged is traversed in turn, and the corresponding policy in the target policy set is configured according to the priority of each policy to be merged.

3. The method according to claim 2, characterized in that The step of traversing each policy to be merged in turn according to the priorities of the policies to be merged contained in the policy set to be merged from high to low, and configuring the corresponding policy in the target policy set according to the priority of each policy to be merged, includes: When the target policy corresponding to the target policy to be merged in the target policy set is a null value, configuring the target policy according to the configuration content of the target policy to be merged; or, When the target policy is not a null value, the target policy to be merged is ignored; or, If the target policy does not include a policy corresponding to the target policy to be merged, ignoring the target policy to be merged; The target strategy to be merged is any strategy among the strategies to be merged.

4. A policy configuration merging device, characterized in that: The device comprises: An acquisition module is used to obtain a set of strategies to be merged that can be inherited by the target object; A merging module, used for merging the policies to be merged according to the priorities of the policies to be merged included in the policy set to be merged, and obtaining a target policy set; A configuration module, configured to configure the target object according to the policies included in the target policy set; The set of policies to be merged includes: strong policies and weak policies; for strong policies and weak policies set at the same level, the priority of the strong policy is higher than that of the weak policy; for strong policies and weak policies set at different levels; the priority of the strong policy that the target object can inherit is higher than the priority of the strong policy corresponding to the target object; the priority of the weak policy that the target object can inherit is lower than the priority of the weak policy corresponding to the target object; The device also includes: a generating module; The acquisition module is specifically used to acquire the target path of the target object in the grouping tree and the strategy to be merged corresponding to each node on the target path; The generating module is used to generate the set of strategies to be merged based on the strategies to be merged corresponding to each node; The grouping tree is used to indicate the relationship between the various levels of the network to which the target object belongs; the priority of the strong policy of the parent node in the grouping tree is higher than the priority of the strong policy of the child node; the priority of the weak policy of the parent node in the grouping tree is lower than the priority of the weak policy of the child node; according to the inheritance order of the policies, the node where the target object is located is located at the end of the target path; The target nodes on the target path include: a common group and a custom group; the priority of the strong policy of the custom group is higher than the priority of the strong policy of the common group; the priority of the weak policy of the custom group is higher than the priority of the weak policy of the common group; The acquisition module is specifically configured to add the custom group as a child node of the target node to the target path; The acquisition module is further used to acquire the to-be-merged strategy corresponding to each node on the target path; Among them, a terminal belongs to a common group and belongs to at least one custom group; and there is at least one terminal on a group.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the policy configuration merging method according to any one of claims 1 to 3 are implemented.

6. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the policy configuration merging method described in any one of claims 1 to 3 are implemented.

Images