Domain name matching method and device, prefix tree updating method and device

Abstract

The application discloses a domain name matching method and device, a prefix tree updating method and device, and mainly comprises the following technical scheme: determining the matching order of characters in a to-be-matched domain name; based on the hierarchical structure of a prefix tree, the characters in the to-be-matched domain name are matched layer by layer according to the matching order, the prefix tree is a tree provided with a wildcard node and used for matching domain names, and a character sequence corresponding to a node path of the wildcard node is a character sequence contained in a domain name meeting the security policy requirement; if the wildcard node is matched in the nodes participating in matching in the current layer, it is determined that the to-be-matched domain name is the domain name meeting the security policy requirement; if the wildcard node is not matched in the nodes participating in matching in the current layer, but a corresponding character node is matched, it is determined that the child nodes of the character node are the nodes participating in matching in the next layer, and matching is performed in the nodes participating in matching in the next layer according to the matching order.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a domain name matching method and apparatus, and a prefix tree updating method and apparatus. Background Technology

[0002] Network access control technology is a commonly used technique to ensure information security. It restricts a user's access to a specific resource. Domain name access control is a common implementation method within network access control technology.

[0003] In domain name access control, once a client initiates access to a resource, the domain name requested by the client needs to be matched against domain names in the domain name database to determine whether the client is allowed to access and use the resource. Currently, existing domain name matching typically uses an exact match method, which matches the client's domain name against each domain name in the database one by one. This domain name matching method not only incurs high computational overhead but also has low matching efficiency. Summary of the Invention

[0004] In view of this, the present invention proposes a domain name matching method and apparatus, and a prefix tree updating method and apparatus, the main purpose of which is to improve the efficiency of domain name matching while reducing the computational overhead of domain name matching.

[0005] To achieve the above objectives, the present invention mainly provides the following technical solutions:

[0006] In a first aspect, the present invention provides a domain name matching method, the method comprising:

[0007] Determine the matching order of characters in the domain name to be matched;

[0008] Based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the matching order. The prefix tree is a tree with wildcard nodes set and used to match domain names. The character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements.

[0009] If a wildcard node is matched among the nodes participating in the matching at the current level, then the domain name to be matched is determined to be a domain name that meets the security policy requirements;

[0010] If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then the child node of the character node is determined to be a node participating in the matching at the next level, and matching is performed among the nodes participating in the matching at the next level according to the matching order.

[0011] Secondly, the present invention provides a prefix tree update method, wherein the prefix tree is a tree with wildcard nodes for matching domain names, and the character sequence corresponding to the path of the node where the wildcard node is located is a character sequence contained in a domain name that meets security policy requirements. The method includes:

[0012] Based on the received wildcard node position update instruction, determine the wildcard node involved in the update instruction;

[0013] Based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction, a position update operation is performed on the wildcard node.

[0014] Thirdly, the present invention provides a domain name matching device, the device comprising:

[0015] The first determining unit is used to determine the matching order of characters in the domain name to be matched;

[0016] A matching unit is used to perform hierarchical matching of characters in the domain name to be matched according to the matching order based on the hierarchical structure of the prefix tree, wherein the prefix tree is a tree with wildcard nodes set and used for matching domain names, and the character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements.

[0017] The second determining unit is used to determine that the domain name to be matched is a domain name that meets the security policy requirements if a wildcard node is matched among the nodes participating in the matching in the current level.

[0018] The third determining unit is used to determine the child node of the character node as the node to be matched in the next level if no wildcard node is matched among the nodes participating in the matching in the current level, but a corresponding character node is matched, and to perform matching among the nodes participating in the matching in the next level according to the matching order.

[0019] Fourthly, the present invention provides a prefix tree update apparatus, wherein the prefix tree is a tree with wildcard nodes for matching domain names, and the character sequence corresponding to the path of the node where the wildcard node is located is a character sequence contained in a domain name that meets security policy requirements. The apparatus includes:

[0020] The fourth determining unit is used to determine the wildcard node involved in the update instruction based on the received wildcard node position update instruction;

[0021] The update unit is used to perform a position update operation on the wildcard node based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction.

[0022] Fifthly, the present invention provides a computer-readable storage medium comprising a stored program, wherein, when the program is executed, the device on which the storage medium is located executes the domain name matching method described in the first aspect, and / or executes the prefix tree update method described in the second aspect.

[0023] Sixthly, the present invention provides a storage management device, the storage management device comprising:

[0024] Memory, used to store programs;

[0025] A processor, coupled to the memory, is configured to run the program to perform the domain name matching method described in the first aspect, and / or to perform the prefix tree update method described in the second aspect.

[0026] By employing the above technical solutions, the domain name matching method and apparatus, and the prefix tree updating method and apparatus provided by this invention, use a prefix tree for domain name matching. The prefix tree used is a tree with wildcard nodes for matching domain names, and the character sequence corresponding to the path of the node containing the wildcard node is the character sequence contained in the domain name that meets the security policy requirements. When there is a domain name to be matched, the matching order of the characters in the domain name to be matched is first determined. Then, based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the determined matching order. If a wildcard node is matched among the nodes participating in the matching at the current level, the domain name to be matched is determined to meet the security policy requirements. If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, the child node of the character node is determined to be a node participating in the matching at the next level, and matching is performed among the nodes participating in the matching at the next level according to the matching order. As can be seen, the solution provided by this invention does not require matching the domain name to be matched against all domain names in the prefix tree one by one during domain name matching. Instead, it only needs to perform hierarchical matching based on the hierarchical structure of the prefix tree, following the matching order of characters in the domain name to be matched. During the hierarchical matching process, once a wildcard node is matched among the nodes participating in the matching at the current level, a match is achieved, and the domain name to be matched is determined to be a domain name that meets the security policy requirements. If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then when entering the next level of matching, matching is only performed on the child nodes of the character node matched at the current level. The matching is irrelevant to other nodes in the next level, resulting in lower complexity of the domain name matching algorithm. Therefore, the solution provided by this invention can improve the efficiency of domain name matching while reducing the computational overhead of domain name matching.

[0027] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart of a domain name matching method provided in one embodiment of the present invention is shown;

[0030] Figure 2 A schematic diagram of a prefix tree provided in one embodiment of the present invention is shown;

[0031] Figure 3 A schematic diagram of a prefix tree provided by another embodiment of the present invention is shown;

[0032] Figure 4 A flowchart of a prefix tree update method provided in one embodiment of the present invention is shown;

[0033] Figure 5 A schematic diagram of a prefix tree provided in yet another embodiment of the present invention is shown;

[0034] Figure 6 A schematic diagram of a prefix tree provided in yet another embodiment of the present invention is shown;

[0035] Figure 7 A schematic diagram of a prefix tree provided in yet another embodiment of the present invention is shown;

[0036] Figure 8 This diagram illustrates the structure of a domain name matching device according to an embodiment of the present invention.

[0037] Figure 9 A schematic diagram of a domain name matching device according to another embodiment of the present invention is shown;

[0038] Figure 10 A schematic diagram of a prefix tree update device according to an embodiment of the present invention is shown;

[0039] Figure 11 A schematic diagram of a prefix tree update device provided in another embodiment of the present invention is shown. Detailed Implementation

[0040] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0041] Domain name access control is a common implementation method in network access control technology. In domain name access control, once a client initiates access to a resource, the client's domain name needs to be matched against domain names in a domain name database to determine whether the client is allowed to access and use the resource. The domain name database mentioned here includes two types: First, a domain name database is a big data component database such as Elasticsearch or ClickHouse, which contains a large number of pre-defined domain names; second, a domain name database is a dataset split from a prefix tree, which includes domain names split from the prefix tree, where the prefix tree is a tree used to match domain names.

[0042] Currently, existing domain name matching typically uses exact matching, which means matching the client's domain name against each domain name in the database one by one. Because this method requires matching each domain name in the database individually, it not only incurs high computational overhead but also has low matching efficiency.

[0043] To address the shortcomings of existing domain name matching methods, this invention provides a domain name matching method and apparatus that improves domain name matching efficiency while reducing computational overhead.

[0044] The domain name matching method and apparatus provided in this invention are based on a prefix tree. The prefix tree involved in this invention is a tree with wildcard nodes used for matching domain names. All domain names involved in the prefix tree comply with security policy requirements. The security policy requirements are determined based on business needs, as illustrated in the following examples: Example 1: If the security policy requires access to resources, the prefix tree is equivalent to an access whitelist, and the domain names involved are all secure domain names that can be accessed. Example 2: If the security policy requires access to inaccessible resources, the prefix tree is equivalent to an access blacklist, and the domain names involved are all risky domain names that cannot be accessed. The character sequence corresponding to the node path where the wildcard node is located in the prefix tree is the character sequence contained in the domain name that complies with the security policy requirements. That is, when matching domain names based on the prefix tree, once a wildcard is matched on a node path, no further matching is needed; the domain name can be directly determined as complying with the security policy requirements. Regarding the prefix tree mentioned in this invention, this invention provides a prefix tree updating method and apparatus to update the wildcard node positions in the prefix tree based on the accumulation of domain name access control experience data, thereby improving the security protection effect of domain name access control.

[0045] The domain name matching method and apparatus, and the prefix tree update method and apparatus provided in the embodiments of the present invention will be described in detail below.

[0046] like Figure 1 As shown, this embodiment of the invention provides a domain name matching method, which mainly includes:

[0047] 101. Determine the matching order of characters in the domain name to be matched.

[0048] A domain name, also known as a network domain, is the name of a computer or group of computers on the Internet, consisting of a string of names separated by dots. It is used to locate the computer during data transmission (and sometimes also refers to its geographical location).

[0049] In practical applications, any domain name that initiates access to a resource can be defined as the domain to be matched. This embodiment does not limit the type of the domain to be matched; for example, it can be a main domain, a subdomain, or a subdomain of a subdomain.

[0050] After determining the domain name to be matched, it is necessary to determine the matching order of the characters in the domain name. Based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the matching order. The specific method to determine the matching order of the characters in the domain name to be matched is: determine the reverse order of the characters in the domain name to be matched as the matching order of the characters in the domain name to be matched.

[0051] The essence of the prefix tree used in this embodiment of the invention is to merge repeated prefixes by utilizing the common prefixes between domain names. That is, the domain names involved in the prefix tree exist in the prefix tree in reverse order, starting from the root node. When performing domain name matching based on the hierarchical structure of the prefix tree, matching is performed layer by layer downwards from the level of the root node. Therefore, when determining the matching order of characters in the domain name to be matched, the reverse order of the characters in the domain name to be matched is determined as the matching order of the characters in the domain name to be matched.

[0052] For example, if the domain name to be matched is cb.com, then the matching order of characters in the domain name to be matched is: moc.bc.

[0053] 102. Based on the hierarchical structure of the prefix tree, perform hierarchical matching of characters in the domain name to be matched according to the matching order, and execute step 103 or step 104 according to the matching result of the current level.

[0054] The prefix tree used in this embodiment of the invention is a tree with wildcard nodes for matching domain names. It is a multi-level tree structure, with each level consisting of at least one node. The position of the wildcard node in the prefix tree can be set according to specific security requirements, and it can exist as a child node of any node in the prefix tree. The character sequence corresponding to the path of the node containing the wildcard node is the character sequence contained in the domain name that meets the security policy requirements. It should be noted that the specific type of wildcard contained in the wildcard node can be set based on business requirements, and this embodiment does not impose specific limitations. For example, the wildcard is "*".

[0055] For example, such as Figure 2 As shown, Figure 2 The example demonstrates a prefix tree structure. The security policy corresponding to this prefix tree requires that the resource be inaccessible. The prefix tree is equivalent to an access blacklist, and the domains involved are all risky domains. Figure 2 The prefix tree shown has eight levels, where the first level contains only the root node, which does not contain any characters. Figure 2 Nodes containing "*" are wildcard nodes. For ease of explanation, character nodes containing characters will be abbreviated by the character they contain; for example, a character node containing the character 'm' will be abbreviated as the 'm' node. Figure 2 The prefix tree shown contains the following three node paths that contain wildcard nodes:

[0056] The first node path containing a wildcard node consists of the m node, o node, c node, "." node, ac node, and wildcard node in sequence, and its corresponding character sequence is "ac.com". In other words, domain names containing the character sequence "ac.com" are all risky domain names and cannot access resources.

[0057] The second node path containing a wildcard node consists of the nodes m, o, c, ".", a, k, and wildcard node in sequence, and its corresponding character sequence is "ka.com". In other words, domains containing the character sequence "ka.com" are all risky domains and cannot access resources.

[0058] The third node path containing a wildcard node consists of an n node, a c node, a "." node, a d node, a t character, and a wildcard node, with the corresponding character sequence being "td.cn". In other words, domains containing the character sequence "td.cn" are all risky domains and their resources are inaccessible.

[0059] In this embodiment of the invention, domain name matching is performed based on the hierarchical structure of the prefix tree. The starting level for hierarchical matching depends on the root node of the prefix tree. Therefore, before hierarchical matching, the following steps need to be performed: determine whether the root node of the prefix tree is a character node; if so, determine the level where the root node is located as the target level; if not, determine the level where the child nodes of the root node are located as the target level.

[0060] If it is determined that the root node of the prefix tree is not a character node, it means that the root node is only used to connect multiple subtrees and cannot match the character that is the first character in the matching order of the domain name to be matched. Therefore, the level of the child node of the root node is determined as the target level. For example, such as Figure 2 As shown, the root node does not contain characters and is not a character node. Therefore, the second level where the root node's child nodes "m node and n node" are located is determined as the target level, so that the characters in the domain name to be matched are matched level by level in the matching order starting from the second level.

[0061] When it is determined that the root node of the prefix tree is a character node, it means that the character in the root node can match the first character in the matching order of the domain name to be matched. Therefore, the level where the root node is located is determined as the target level, that is, the first level of the prefix tree is determined as the target level. For example, such as Figure 3 As shown, Figure 3 The root node in the code is the "m node". The character 'm' contained in the code can be matched with the first character in the matching order of the domain name to be matched. Therefore, the level where the root node is located is determined as the target level, so that the characters in the domain name to be matched are matched level by level according to the matching order, starting from the first level where the root node is located.

[0062] After determining the target level of the prefix tree, starting from the target level, the characters in the domain name to be matched are matched level by level according to the matching order. For the current level being matched, the following steps are performed:

[0063] 102A. Determine the nodes participating in the matching within the current level.

[0064] The determination of the nodes participating in matching within the current level depends on the current level's position within that level, and there are two possible scenarios:

[0065] First, if the current level is the target level, then all nodes in the current level are determined to be nodes participating in the matching within the current level.

[0066] Secondly, if the current level is not the target level, then the child nodes of the character nodes matched in the previous matching process are identified as nodes participating in the matching within the current level. In a level where the current level is not the target level, only the child nodes of the character nodes matched in the previous matching process are identified as nodes participating in the matching within the current level. This method of identifying nodes participating in the matching within the current level can narrow down the range of nodes involved in the matching, improving the efficiency of domain name matching.

[0067] 102B. Determine whether there is a wildcard node among the nodes participating in the matching; if so, proceed to step 102C; if not, proceed to step 102D.

[0068] The purpose of determining whether wildcard nodes exist among the nodes participating in the matching process is to improve domain name matching efficiency and end the matching process of the domain name to be matched as quickly as possible. The process of determining whether wildcard nodes exist among the nodes participating in the matching process is as follows: determine whether the nodes participating in the matching process contain wildcards; if wildcards are found among the nodes participating in the matching process, then wildcard nodes are determined to exist, and step 102C is executed; if wildcards are not found among the nodes participating in the matching process, then wildcard nodes are determined to not exist, and it is necessary to further determine whether the corresponding character nodes are matched among the nodes participating in the matching process, so step 102D is executed.

[0069] 102C. Determine that the domain name to be matched is a domain name that meets the security policy requirements.

[0070] When it is determined that there is a wildcard node among the nodes participating in the matching, it is not necessary to match the characters contained in the nodes participating in the matching with the characters in the domain name to be matched. At this time, it can be determined that the domain name to be matched contains the character sequence corresponding to the node path where the wildcard node is located, and the domain name to be matched is a domain name that meets the security policy requirements.

[0071] 102D. Determine the character that each node participating in the matching needs to match according to the matching order, and determine whether the corresponding character node is matched based on the matching result of each parameter matching node and the character that needs to be matched. When the corresponding character node is matched, determine the child node of the character node as the node participating in the matching in the next level.

[0072] If it is determined that there are no wildcard nodes among the nodes participating in the matching, it means that it is still uncertain whether the domain name to be matched is a domain name that meets the security policy requirements. Therefore, it is necessary to match the characters contained in the nodes participating in the matching with the characters in the domain name to be matched.

[0073] The specific process of matching the characters contained in the nodes to be matched with the characters in the domain name to be matched includes the following steps one through four:

[0074] Step 1: Determine the characters that each node participating in the matching needs to match according to the matching order.

[0075] Specifically, for each node participating in the matching, the following steps are performed: determine the number of characters contained in the node participating in the matching, and select the characters to be matched from the domain names to be matched according to the matching order based on the determined number of characters.

[0076] To ensure the accuracy of domain name matching, when matching the characters contained in the participating nodes with the characters in the domain name to be matched, the following two points need to be observed: First, ensure the consistency of the number of characters contained in the participating nodes and the characters to be matched. To ensure consistency in the number of characters, the characters to be matched by the participating nodes need to be selected from the characters to be matched based on the number of characters contained in the participating nodes. Second, ensure the consistency of the character order of the characters contained in the participating nodes and the characters to be matched. To ensure consistency in the number of characters, the characters to be matched by the participating nodes need to be selected from the domain name to be matched according to the matching order.

[0077] For example, such as Figure 2 As shown, the domain name to be matched is "bac.com". The nodes participating in the matching at the current level are "ac node" and "a node". For the "ac node": the number of characters in the "ac node" is determined to be 2. Since the "." in the domain name "bac.com" has already been matched at the previous level, the character to be matched for the "ac node" is selected from the domain name "bac.com" according to the character count "2" and the matching order, which is "ac". For the "a node": the number of characters in the "a node" is determined to be 1. Since the "." in the domain name "bac.com" has already been matched at the previous level, the character to be matched for the "a node" is selected from the domain name "bac.com" according to the character count "1" and the matching order, which is "c".

[0078] Step two: Determine whether the corresponding character node is matched based on the matching result of the node matched for each parameter and the character to be matched.

[0079] Specifically, if the target node exists among the nodes participating in the matching, then the target node is determined to be the matched character node, and step three is executed. If the target node does not exist among the nodes participating in the matching, then it is determined that no matching character node was found, and step four is executed. The target node mentioned here is defined as one whose characters are identical to the characters it needs to match, and the order of these characters is the same as the order of the characters it needs to match. It should be noted that the determination that the characters in the target node are identical to the characters it needs to match is case-insensitive; that is, as long as the characters in the target node are the same as the characters it needs to match, it is considered that the characters are identical.

[0080] Step 3: When a corresponding character node is matched, determine the child nodes of the character node as the nodes that participate in the matching at the next level.

[0081] When a corresponding character node is matched, it means that all the character sequences that have been matched in the domain name to be matched have been successfully matched. Therefore, in order to continue to determine whether the domain name to be matched is a domain name that meets the security policy requirements, it is necessary to continue to determine the child nodes of the character node as nodes participating in the matching in the next level, so that the matching can be carried out in the nodes participating in the matching in the next level according to the matching order of the characters in the domain name to be matched.

[0082] Step four: If no matching character node is found, determine that the domain name to be matched is a domain name that does not meet the security policy requirements.

[0083] If no matching character node is found, it means that none of the nodes involved in the matching match the characters they need to match, indicating that the domain name to be matched does not exist in the prefix tree. Therefore, the domain name to be matched is determined to be a domain name that does not meet the security policy requirements.

[0084] 103. If a wildcard node is matched among the nodes participating in the matching at the current level, then the domain name to be matched is determined to be a domain name that meets the security policy requirements.

[0085] If a wildcard node is found among the nodes participating in the matching at the current level, it is not necessary to match the characters contained in the nodes participating in the matching with the characters in the domain name to be matched. At this time, it can be determined that the domain name to be matched contains the character sequence corresponding to the node path where the wildcard node is located. Therefore, the domain name to be matched is directly determined to be a domain name that meets the security policy requirements.

[0086] 104. If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then the child node of the character node is determined to be a node participating in the matching at the next level, and matching is performed among the nodes participating in the matching at the next level according to the matching order.

[0087] If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, it means that all the character sequences currently being matched in the domain name to be matched have been successfully matched. Therefore, in order to continue to determine whether the domain name to be matched is a domain name that meets the security policy requirements, it is necessary to continue to determine the child nodes of the character node as nodes participating in the matching at the next level, so that matching can be carried out in the nodes participating in the matching at the next level according to the matching order of the characters in the domain name to be matched.

[0088] Furthermore, if no wildcard node or corresponding character node is matched among the nodes participating in the matching at the current level, it means that the node matched by each parameter does not match the character that it needs to match. This indicates that the domain name to be matched does not exist in the prefix tree, and therefore the domain name to be matched is determined to be a domain name that does not meet the security policy requirements.

[0089] The domain name matching method provided in this embodiment of the invention uses a prefix tree for domain name matching. The prefix tree is a tree with wildcard nodes used for matching domain names. The character sequence corresponding to the path of the wildcard node is the character sequence contained in the domain name that meets the security policy requirements. When there is a domain name to be matched, the matching order of the characters in the domain name to be matched is first determined. Then, based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the determined matching order. If a wildcard node is matched in the nodes participating in the matching at the current level, the domain name to be matched is determined to meet the security policy requirements. If no wildcard node is matched in the nodes participating in the matching at the current level, but a corresponding character node is matched, the child node of the character node is determined to be the node participating in the matching at the next level, and matching is performed in the nodes participating in the matching at the next level according to the matching order. As can be seen, the solution provided in this embodiment of the invention does not require matching the domain name to be matched against all domain names in the prefix tree one by one when performing domain name matching. Instead, it only needs to perform hierarchical matching based on the hierarchical structure of the prefix tree, following the matching order of characters in the domain name to be matched. During the hierarchical matching process, once a wildcard node is matched among the nodes participating in the matching at the current level, a match is achieved, and the domain name to be matched is determined to be a domain name that meets the security policy requirements. If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then when entering the next level of matching, matching is only performed on the child nodes of the character node matched at the current level. The matching is irrelevant to other nodes in the next level, and the complexity of the domain name matching algorithm is low. Therefore, the solution provided in this embodiment of the invention can improve the efficiency of domain name matching while reducing the computational overhead of domain name matching.

[0090] Furthermore, the following uses the domain name to be matched as "bac.com" and... Figure 2Taking the prefix tree shown as an example, the domain name matching method provided in this embodiment of the invention will be explained in detail:

[0091] The matching order of characters in the domain name "bac.com" is determined to be "moc.cab". Figure 2 The root node in the prefix tree does not contain any characters and is not a character node. Therefore, the second level containing the root node's child nodes "m node and n node" is determined as the target level. Starting from the second level, the characters in the domain name to be matched are matched level by level in the matching order. The specific steps of level-by-level matching are as follows:

[0092] The first step is to identify the "m node" and "n node" within the second level as nodes participating in the matching. Then, it is determined whether a wildcard node exists among the nodes participating in the matching within the second level. After checking, no wildcard node exists, but an "m node" matching the character "m" in the domain name to be matched is found. Therefore, the child node "o node" of the character node "m node" is determined as a node participating in the matching within the next level.

[0093] The second step is to identify the "o node" within the third level as a node participating in the matching. This involves determining if a wildcard node exists among the nodes participating in the matching within the third level. The determination reveals that no wildcard node exists, but an "o node" matching the character "o" in the domain name to be matched was found. Therefore, the child node "c node" of the character node "o node" is determined as a node participating in the matching within the next level.

[0094] The fourth step is to identify the "c node" within the fourth level as a node participating in the matching. This involves determining if a wildcard node exists among the nodes participating in the matching at the fourth level. The determination shows that no wildcard node exists, but a "c node" matching the character "c" in the domain name to be matched was found. Therefore, the child node "." of the character node "c node" is determined as a node participating in the matching at the next level.

[0095] The fifth step is to identify the "." nodes within the fifth level as nodes participating in the matching. This involves determining if any wildcard nodes exist among the nodes participating in the matching within the fifth level. The determination shows that no wildcard nodes exist, but a "." node matching the character "." in the domain name to be matched was found. Therefore, the child nodes "ac node" and "a node" of the character node "." are determined as nodes participating in the matching within the next level.

[0096] Step 6: Identify the "ac node and a node" within the sixth level as nodes participating in the matching. Determine if a wildcard node exists among the nodes participating in the matching within the sixth level. The determination shows no wildcard node exists, but an "ac node" matching the character "ac" in the domain name to be matched was found. Therefore, the child nodes "b node" and "wildcard node" of the character node "ac node" are determined as nodes participating in the matching within the next level.

[0097] Step 7: Identify the "b nodes and wildcard nodes" within the seventh level as nodes participating in the matching. Determine if a wildcard node exists among the nodes participating in the matching within the seventh level. After verification, a wildcard node is found among the nodes participating in the matching within the seventh level. Therefore, it can be determined that the domain name to be matched, "bac.com," contains the character sequence "ac.com" corresponding to the path of the node containing the wildcard node. Thus, the domain name to be matched, "bac.com," is directly determined to be a domain that meets the security policy requirements.

[0098] like Figure 4 As shown, this embodiment of the invention provides a prefix tree update method. The prefix tree involved in the prefix tree update method is a tree with wildcard nodes set and used for matching domain names. The character sequence corresponding to the node path where the wildcard node is located is a character sequence contained in the domain name that meets the security policy requirements. The method mainly includes:

[0099] 201. Based on the received wildcard node position update instruction, determine the wildcard node involved in the update instruction.

[0100] Wildcard node position update commands can be issued in the following two scenarios:

[0101] Scenario 1: As experience data on domain access control accumulates, it is discovered that the position of some wildcard nodes in the prefix tree has an adverse effect on the security protection effect. In this case, a wildcard node position update command can be issued to the wildcard nodes that have an adverse effect on the security protection effect, so that the position of these wildcard nodes can be updated based on the wildcard node position update command.

[0102] For example, as experience data on domain access control accumulates, it is discovered that... Figure 2 In the prefix tree shown, the wildcard node with node t as its parent node results in a significant computational investment for domain name matching. Research found that updating the parent node of this wildcard node to node d does not reduce the security protection effect and saves computational investment in domain name matching. Therefore, a wildcard node position update instruction is issued for the wildcard node with node t as its parent node.

[0103] For example, as experience data on domain access control accumulates, it is discovered that... Figure 2In the prefix tree shown, the wildcard node with node 't' as its parent node causes some domains that do not meet security policy requirements to be misclassified as compliant, posing a threat to resource security. To improve security, the research found that updating the wildcard node with node 't' as its parent node to node 'f' and issuing a wildcard node position update command to it is necessary.

[0104] The issued wildcard node location update instruction carries the original location information and new parent node information of the wildcard node. The original location information can be either the original parent node information or the wildcard node's ID. Based on the different contents of the original location information, the methods for determining the wildcard nodes involved in the update instruction include the following two: First, the location update instruction carries the original parent node information of the wildcard node, and the wildcard node whose location needs to be updated is determined based on the original parent node information. Here, the original parent node information specifies the position of the original parent node in the prefix tree. Second, the location update instruction carries the wildcard node's ID, and the wildcard node whose location needs to be updated is determined based on the ID. Here, all wildcard nodes in the prefix tree have a unique ID.

[0105] In scenario two, when the application scenario of domain name access control changes and it is necessary to add wildcard nodes that meet the requirements of the application scenario to the prefix tree, a wildcard node position update instruction can be issued to update the wildcard nodes in the prefix tree based on the wildcard node position update instruction.

[0106] For example, the process of upgrading the security protection of resources should not allow any access, at which point it is possible to... Figure 2 A wildcard node is added to the root node shown. Therefore, a wildcard node position update instruction is issued to add a wildcard node to the root node according to the wildcard node position update instruction.

[0107] The wildcard node position update instruction issued carries the new parent node information of the wildcard node, confirming that the wildcard node involved in the update instruction is a newly constructed wildcard node.

[0108] 202. Based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction, perform a position update operation on the wildcard node.

[0109] The specific process of performing a location update operation on wildcard nodes is related to the scenario in which the wildcard node location update instruction is issued as described in step 201 above. Therefore, the process of performing a location update operation on wildcard nodes includes the following two types:

[0110] The first type, corresponding to scenario one described in step 201, involves performing a position update operation on the wildcard node based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction.

[0111] The hierarchical relationship between the original and new parent nodes of the wildcard node is determined based on the original and new parent node information. If the new parent node is at a lower level than the original parent node, it means that the connection between the wildcard node and the original parent node will affect domain name matching. Therefore, the wildcard node needs to be deleted from the original parent node's child nodes and added as a child node of the new parent node. If the new parent node is at a higher level than the original parent node, the wildcard node is added as a child node of the new parent node. Whether to delete the wildcard node from the original parent node's child nodes depends on specific business requirements.

[0112] For example, such as Figure 2 As shown, the wildcard node involved in the update instruction is determined to be "the wildcard node whose parent is node t". Based on the original parent node information of the wildcard node, "node t" is determined to be the original parent node, and based on the new parent node information of the wildcard node, "node f" is determined to be the new parent node. It is determined that the original parent node "node t" is the parent node of the new parent node "node f", meaning that the level of the new parent node "node f" is below the level of the original parent node "node t". To avoid the connection relationship between the wildcard node and the original parent node affecting domain name matching, therefore... Figure 5 As shown, the wildcard node is removed from the child nodes of the original parent node "t node", and the wildcard node is added as the child node "f node" of the new parent node.

[0113] For example, such as Figure 2 As shown, the wildcard node involved in the update instruction is determined to be "the wildcard node whose parent is node t". Based on the original parent node information of the wildcard node, "node t" is determined to be the original parent node, and based on the new parent node information of the wildcard node, "node d" is determined to be the new parent node. It is determined that the original parent node "node t" is the parent node of the new parent node "node d", meaning that the level of the new parent node "node d" is above the level of the original parent node "node t". For example... Figure 6 As shown, the wildcard node is deleted from the child node of the original parent node "t node", and the wildcard node is added as the child node "d node" of the new parent node.

[0114] The second method, corresponding to scenario two described in step 201, involves performing a position update operation on the wildcard node based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction.

[0115] The wildcard node position update instruction only carries the new parent node information of the wildcard node, and does not have the original positioning information. Therefore, the original parent node information of the wildcard node is determined to be null. The new parent node of the wildcard node is determined directly based on the new parent node information, and the wildcard node is added as a child node of the new parent node.

[0116] For example, such as Figure 7 As shown, the wildcard node involved in the update instruction is determined to be "the wildcard node newly added to the root node", and the wildcard node is added as a child node of the new parent node "wildcard node".

[0117] The prefix tree update method provided in this embodiment of the invention involves a prefix tree that includes wildcard nodes for matching domain names. The character sequence corresponding to the path of the wildcard node is a character sequence contained in a domain name that meets security policy requirements. Upon receiving a wildcard node position update instruction, the wildcard node involved in the update instruction is determined based on the received instruction. Then, based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried in the update instruction, the position of the wildcard node is updated. Therefore, in the solution provided by this embodiment of the invention, the position of the wildcard node can be updated based on the wildcard node position update instruction. Thus, as domain name access control experience data accumulates, wildcard nodes in the prefix tree that adversely affect the security protection effect can be updated in a timely manner, thereby improving the security protection effect of domain name access control.

[0118] Furthermore, based on the above-described domain name matching method embodiments, another embodiment of the present invention also provides a domain name matching device, such as... Figure 8 As shown, the device includes:

[0119] The first determining unit 31 is used to determine the matching order of characters in the domain name to be matched;

[0120] The matching unit 32 is used to perform hierarchical matching of characters in the domain name to be matched according to the matching order based on the hierarchical structure of the prefix tree, wherein the prefix tree is a tree with wildcard nodes set and used for matching domain names, and the character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements.

[0121] The second determining unit 33 is used to determine that the domain name to be matched is a domain name that meets the security policy requirements if a wildcard node is matched among the nodes participating in the matching in the current level.

[0122] The third determining unit 34 is used to determine the child node of the character node as the node to be matched in the next level if no wildcard node is matched among the nodes participating in the matching in the current level, but a corresponding character node is matched, and to perform matching among the nodes participating in the matching in the next level according to the matching order.

[0123] The domain name matching device provided in this embodiment of the invention uses a prefix tree for domain name matching. The prefix tree is a tree with wildcard nodes used for matching domain names. The character sequence corresponding to the path of the wildcard node is the character sequence contained in the domain name that meets the security policy requirements. When there is a domain name to be matched, the matching order of the characters in the domain name to be matched is first determined. Then, based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the determined matching order. If a wildcard node is matched in the nodes participating in the matching at the current level, the domain name to be matched is determined to meet the security policy requirements. If no wildcard node is matched in the nodes participating in the matching at the current level, but a corresponding character node is matched, the child node of the character node is determined to be a node participating in the matching at the next level, and matching is performed in the nodes participating in the matching at the next level according to the matching order. As can be seen, the solution provided in this embodiment of the invention does not require matching the domain name to be matched against all domain names in the prefix tree one by one when performing domain name matching. Instead, it only needs to perform hierarchical matching based on the hierarchical structure of the prefix tree, following the matching order of characters in the domain name to be matched. During the hierarchical matching process, once a wildcard node is matched among the nodes participating in the matching at the current level, a match is achieved, and the domain name to be matched is determined to be a domain name that meets the security policy requirements. If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then when entering the next level of matching, matching is only performed on the child nodes of the character node matched at the current level. The matching is irrelevant to other nodes in the next level, and the complexity of the domain name matching algorithm is low. Therefore, the solution provided in this embodiment of the invention can improve the efficiency of domain name matching while reducing the computational overhead of domain name matching.

[0124] Optional, such as Figure 9 As shown, the matching unit 32 includes:

[0125] The first determining module 321 is used to determine the nodes participating in the matching within the current level;

[0126] The judgment module 322 is used to determine whether there is a wildcard node among the nodes participating in the matching; if it exists, the second determination unit 33 is triggered to determine that the domain name to be matched is a domain name that meets the security policy requirements; if it does not exist, the second determination module 323 is triggered.

[0127] The second determining module 323 is used to determine the character that each node participating in the matching needs to match according to the matching order when triggered by the judging module 322, and to determine whether the corresponding character node is matched based on the matching result of each parameter-matched node and the character that needs to be matched; when the corresponding character node is matched, the third determining unit 34 is triggered to determine that the child node of the character node is the node participating in the matching in the next level.

[0128] The first determining module 321, the judging module 322, and the second determining module 323 are configured to start from the target level of the prefix tree, perform hierarchical matching of the characters in the domain name to be matched according to the matching order, and perform an operation on the current level that is matched.

[0129] Optional, such as Figure 9 As shown, the first determining module 321 is specifically used to determine that if the current level is the target level, all nodes in the current level are nodes participating in the matching; if the current level is not the target level, the child nodes of the character nodes matched in the previous matching process are nodes participating in the matching in the current level.

[0130] Optional, such as Figure 9 As shown, the matching unit 32 further includes:

[0131] The third determining module 324 is used to determine whether the root node of the prefix tree is a character node before performing hierarchical matching of characters in the domain name to be matched according to the matching order, starting from the target level of the prefix tree; if so, the level where the root node is located is determined as the target level; if not, the level where the child node of the root node is located is determined as the target level.

[0132] Optional, such as Figure 9 As shown, the second determining module 323 is specifically used to determine the number of characters contained in each participating node, and select the characters to be matched from the domain name to be matched based on the number of characters and the matching order.

[0133] Optional, such as Figure 9 As shown, the second determining module 323 is specifically used to determine the target node as the corresponding matched character node if there is a target node among the nodes participating in the matching, wherein the characters contained in the target node are the same as the characters that need to be matched, and the arrangement order of the characters contained in the target node is the same as the arrangement order of the characters that need to be matched.

[0134] Optional, such as Figure 9 As shown, the device further includes:

[0135] The fifth determining unit 35 is used to determine that the domain name to be matched is a domain name that does not meet the security policy requirements if no wildcard node is matched among the nodes participating in the matching in the current level, and no corresponding character node is matched either.

[0136] Optional, such as Figure 9 As shown, the first determining unit 31 is specifically used to determine the reverse order of the characters in the domain name to be matched as the matching order of the characters in the domain name to be matched.

[0137] For a detailed explanation of the methods used in the operation of each functional module in the domain name matching device provided in this embodiment of the invention, please refer to the corresponding method details in the aforementioned domain name matching method embodiments, which will not be repeated here.

[0138] Furthermore, based on the above-described embodiments of the prefix tree update method, another embodiment of the present invention also provides a prefix tree update apparatus, such as... Figure 10 As shown, the prefix tree is a tree with wildcard nodes used for matching domain names, and the character sequence corresponding to the path of the node where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements. The device includes:

[0139] The fourth determining unit 41 is used to determine the wildcard node involved in the update instruction based on the received wildcard node position update instruction;

[0140] The update unit 42 is used to perform a position update operation on the wildcard node based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction.

[0141] The prefix tree update apparatus and method provided in this embodiment of the invention involve a prefix tree that is a tree with wildcard nodes used for matching domain names. The character sequence corresponding to the path of the node containing the wildcard node is a character sequence contained in the domain name that meets the security policy requirements. When a wildcard node position update instruction is received, the wildcard node involved in the update instruction is determined according to the received wildcard node position update instruction. Based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried in the update instruction, the position update operation of the wildcard node is performed. It can be seen that in the solution provided in this embodiment of the invention, the position of the wildcard node can be updated based on the wildcard node position update instruction. Therefore, as domain name access control experience data accumulates, wildcard nodes in the prefix tree that have an adverse effect on the security protection effect can be updated in a timely manner, thereby improving the security protection effect of domain name access control.

[0142] Optional, such as Figure 11 As shown, the update unit 42 includes:

[0143] The fourth determining module 421 is used to determine the hierarchical relationship between the original parent node and the new parent node of the wildcard node based on the original parent node information and the new parent node information;

[0144] The update module 422 is used to delete the wildcard node from the child node of the original parent node and add the wildcard node as a child node of the new parent node if the level of the new parent node is below the level of the original parent node.

[0145] For a detailed explanation of the methods used in the operation of each functional module in the prefix tree update device provided in this embodiment of the invention, please refer to the corresponding method details in the aforementioned prefix tree update method embodiment, which will not be repeated here.

[0146] Furthermore, according to the above embodiments, another embodiment of the present invention also provides a computer-readable storage medium, the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the aforementioned domain name matching method, and / or execute the aforementioned prefix tree update method.

[0147] Furthermore, according to the above embodiments, another embodiment of the present invention also provides a storage management device, the storage management device comprising:

[0148] Memory, used to store programs;

[0149] A processor, coupled to the memory, is used to run the program to perform the aforementioned domain name matching method and / or, to perform the aforementioned prefix tree update method.

[0150] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0151] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0152] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0153] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0154] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0155] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0156] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the method, apparatus, and framework for operating the deep neural network model according to embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0157] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

Claims

1. A domain name matching method, characterized in that, The method is based on a prefix tree, where the positions of wildcard nodes are set according to security requirements, and these positions can be updated based on wildcard node position update commands. The wildcard node position update command is issued when the position of a wildcard node in the prefix tree negatively impacts security protection. The wildcard node position update command is also issued when the application scenario of domain name access control changes and it is necessary to add wildcard nodes to the prefix tree that meet the requirements of the application scenario. The method includes: Determine the matching order of characters in the domain name to be matched, which includes: determining the reverse order of characters in the domain name to be matched as the matching order of characters in the domain name to be matched; Based on the hierarchical structure of the prefix tree, characters in the domain name to be matched are matched level by level according to the matching order. The prefix tree is a tree with wildcard nodes used for matching domain names. The character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements. The prefix tree uses the common prefix between domain names to merge duplicate prefixes together, and the domain names involved in the prefix tree exist in the prefix tree in reverse order starting from the root node of the prefix tree. If a wildcard node is matched among the nodes participating in the matching at the current level, then the domain name to be matched is determined to be a domain name that meets the security policy requirements; If no wildcard node is matched among the nodes participating in the matching at the current level, but a corresponding character node is matched, then the child node of the character node is determined to be a node participating in the matching at the next level, and matching is performed among the nodes participating in the matching at the next level according to the matching order. Based on the hierarchical structure of the prefix tree, the characters in the domain name to be matched are matched level by level according to the matching order, including: starting from the target level of the prefix tree, the characters in the domain name to be matched are matched level by level according to the matching order. For the current level being matched, the following steps are performed: determining the nodes participating in the matching within the current level; determining whether there are wildcard nodes among the nodes participating in the matching; if there are, determining that the domain name to be matched is a domain name that meets the security policy requirements; if there are not, determining the characters that each node participating in the matching needs to match according to the matching order, and determining whether a corresponding character node is matched based on the matching result of each parameter-matched node and the character it needs to match; when a corresponding character node is matched, determining that the child node of the character node is a node participating in the matching within the next level. Determining the nodes participating in the matching within the current level includes: if the current level is the target level, then all nodes within the current level are determined to be nodes participating in the matching; if the current level is not the target level, then the child nodes of the character nodes matched in the previous matching process are determined to be nodes participating in the matching within the current level.

2. The method according to claim 1, characterized in that, Before performing hierarchical matching of characters in the domain name to be matched according to the matching order, starting from the target level of the prefix tree, the method further includes: Determine whether the root node of the prefix tree is a character node; If so, the level where the root node is located is determined as the target level; If not, the level at which the child nodes of the root node are located is determined as the target level.

3. The method according to claim 1, characterized in that, The characters that each node participating in the matching needs to match are determined according to the matching order, including: For each node participating in the matching, determine the number of characters contained in the node participating in the matching, and select the characters to be matched from the domain name to be matched based on the number of characters and in the matching order.

4. The method according to claim 1, characterized in that, The determination of whether a matching character node is found is based on the matching result between the node matched for each parameter and the character to be matched, including: If a target node exists among the nodes participating in the matching, then the target node is determined to be the corresponding matched character node, wherein the characters contained in the target node are the same as the characters that need to be matched, and the order of the characters contained in the target node is the same as the order of the characters that need to be matched.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: If no wildcard node or corresponding character node is matched among the nodes participating in the matching at the current level, then the domain name to be matched is determined to be a domain name that does not meet the security policy requirements.

6. The method according to any one of claims 1-4, characterized in that, Determine the matching order of characters in the domain name to be matched, including: The reverse order of the characters in the domain name to be matched is determined as the matching order of the characters in the domain name to be matched.

7. A prefix tree update method, characterized in that, The prefix tree is a tree with wildcard nodes set up for matching domain names. The character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements. The position of the wildcard node in the prefix tree is set according to the security protection requirements, and the position of the wildcard node can be updated based on the wildcard node position update instruction. The wildcard node is used to end the matching process for the domain name to be matched, and the method includes: Based on the received wildcard node position update instruction, determine the wildcard node involved in the update instruction; Based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried in the update instruction, a position update operation is performed on the wildcard node. This operation includes: if the wildcard node position update instruction is issued when the position of a wildcard node in the prefix tree negatively impacts the security protection effect, then the wildcard node is determined based on the original parent node information and the new parent node information. The hierarchical relationship between the original parent node and the new parent node; if the level of the new parent node is below the level of the original parent node, then the wildcard node is deleted from the child node of the original parent node, and the wildcard node is added as a child node of the new parent node; if the wildcard node position update instruction is issued when the application scenario of domain name access control changes and it is necessary to add a wildcard node that meets the application scenario requirements to the prefix tree, the wildcard node position update instruction only carries the new parent node information of the wildcard node, the new parent node of the wildcard node is determined based on the new parent node information, and the wildcard node is added as a child node of the new parent node.

8. A domain name matching device, characterized in that, The device is based on a prefix tree, where the positions of wildcard nodes are set according to security requirements, and these positions can be updated based on wildcard node position update commands. The wildcard node position update command is issued when the position of a wildcard node in the prefix tree negatively impacts security protection. The wildcard node position update command is also issued when the application scenario of domain name access control changes and it is necessary to add wildcard nodes to the prefix tree that meet the requirements of the application scenario. The device includes: The first determining unit is used to determine the matching order of characters in the domain name to be matched, wherein determining the matching order of characters in the domain name to be matched includes: determining the reverse order of characters in the domain name to be matched as the matching order of characters in the domain name to be matched; A matching unit is used to perform hierarchical matching of characters in the domain name to be matched according to the matching order based on the hierarchical structure of the prefix tree. The prefix tree is a tree with wildcard nodes for matching domain names, and the character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements. The prefix tree uses common prefixes between domain names to merge duplicate prefixes together, and the domain names involved in the prefix tree exist in the prefix tree in reverse order starting from the root node of the prefix tree. The second determining unit is used to determine that the domain name to be matched is a domain name that meets the security policy requirements if a wildcard node is matched among the nodes participating in the matching in the current level. The third determining unit is used to determine the child node of the character node as the node to be matched in the next level if no wildcard node is matched among the nodes participating in the matching in the current level, but a corresponding character node is matched, and to perform matching among the nodes participating in the matching in the next level according to the matching order. The matching unit includes: a first determining module, used to determine the nodes participating in the matching within the current level; a judging module, used to judge whether there is a wildcard node among the nodes participating in the matching; if there is, a second determining module is triggered to determine that the domain name to be matched is a domain name that meets the security policy requirements; if there is no wildcard node, a second determining module is triggered; the second determining module is used, under the trigger of the judging module, to determine the character that needs to be matched for each node participating in the matching according to the matching order, and to determine whether a corresponding character node is matched based on the matching result of each parameter-matched node and the character that needs to be matched, and when a corresponding character node is matched, to determine that the child node of the character node is a node participating in the matching within the next level; wherein, the first determining module, the judging module, and the second determining module are configured to start from the target level of the prefix tree, perform hierarchical matching of the characters in the domain name to be matched according to the matching order, and perform operations on the current level that is matched; The first determining module is specifically used to determine that if the current level is the target level, all nodes in the current level are nodes participating in the matching; if the current level is not the target level, the child nodes of the character nodes matched in the previous matching process are nodes participating in the matching in the current level.

9. A prefix tree update device, characterized in that, The prefix tree is a tree with wildcard nodes set up for matching domain names. The character sequence corresponding to the node path where the wildcard node is located is the character sequence contained in the domain name that meets the security policy requirements. The position of the wildcard node in the prefix tree is set according to the security protection requirements, and the position of the wildcard node can be updated based on the wildcard node position update instruction. The wildcard node is used to end the matching process for the domain name to be matched; the device includes: The fourth determining unit is used to determine the wildcard node involved in the update instruction based on the received wildcard node position update instruction; The update unit is used to perform a position update operation on the wildcard node based on the original parent node information of the wildcard node and the new parent node information of the wildcard node carried by the update instruction; The update unit is specifically configured to: if the wildcard node position update instruction is issued when the position of a wildcard node in the prefix tree negatively impacts the security protection effect, the wildcard node is determined based on the original parent node information and the new parent node information to establish the hierarchical relationship between the original parent node and the new parent node; if the new parent node is located at a level below the original parent node, the wildcard node is deleted from the child node of the original parent node and added as a child node of the new parent node; if the wildcard node position update instruction is issued when the application scenario of domain name access control changes and a wildcard node matching the application scenario needs to be added to the prefix tree, the wildcard node position update instruction only carries the new parent node information of the wildcard node, the new parent node is determined based on the new parent node information, and the wildcard node is added as a child node of the new parent node.

10. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the domain name matching method according to any one of claims 1 to 6, and / or execute the prefix tree update method according to claim 7.

11. A storage management device, characterized in that, The storage management device includes: Memory, used to store programs; A processor, coupled to the memory, is configured to run the program to perform the domain name matching method of any one of claims 1 to 6, and / or to perform the prefix tree update method of claim 7.

Images