Address storage method of access control policy, electronic device, and storage medium

Abstract

The application provides an address storage method of an access control policy, an electronic device and a storage medium. The method comprises the following steps: acquiring address object information referenced by an access control policy; analyzing the address object information to determine to-be-detected node address information; traversing address information of existing nodes in a linearization linked list to determine whether the to-be-detected node address information and the address information of the existing nodes are redundant; and determining, according to a judgment result, whether to add the to-be-detected node address information to the linearization linked list. Thus, there is no redundant node address information in the linearization linked list, the policy storage space is optimized, repeated data detection can be avoided during policy conflict detection, and the policy conflict detection rate can be accelerated.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an address storage method for access control policies, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Currently, firewalls are mostly used to control various network communications in order to ensure information security during network communication.

[0003] With increasing informatization and the application of intelligent learning technologies for access control policies, firewalls often configure access control policies containing multiple hosts, subnets, and range addresses simultaneously, increasing the difficulty of managing and maintaining these policies. Traditional full-address node storage only applies to non-redundant host addresses, subnet addresses, and range addresses. If redundant addresses exist, duplicate data will be detected during policy conflict detection, and the memory footprint of access control policies will increase. Summary of the Invention

[0004] This application provides an address storage method for access control policies to reduce redundant address nodes and reduce storage space.

[0005] This application provides a method for storing the address of access control policies, including:

[0006] Retrieve information about the address objects referenced by the access control policy;

[0007] The address object information is parsed to determine the address information of the node to be detected;

[0008] Traverse the address information of existing nodes in the linearized linked list and determine whether there is redundancy between the address information of the node to be detected and the address information of existing nodes;

[0009] Based on the judgment result, determine whether to add the address information of the node to be detected to the linearized linked list.

[0010] The method provided in the above embodiments of this application traverses the address information of existing nodes in the linearized linked list and determines whether there is redundancy between the address information of the node to be detected and the address information of existing nodes; based on the determination result, it determines whether to add the address information of the node to be detected to the linearized linked list. Thus, there is no redundant node address information in the linearized linked list, which optimizes the policy storage space and avoids duplicate data detection during policy conflict detection, thereby speeding up the policy conflict detection rate.

[0011] In one embodiment, parsing the address object information to determine the address information of the node to be detected includes:

[0012] The address type of the address object information is determined based on the identification information carried by the address object information;

[0013] Based on the address type of the address object information, generate the address information of the node to be detected.

[0014] In the above embodiments, address types are distinguished based on identification information to generate address information of the node to be detected, thereby distinguishing different address objects and improving the accuracy of the address information of the node to be detected.

[0015] In one embodiment, generating the address information of the node to be detected based on the address type of the address object information includes:

[0016] If the address type of the address object information is a host address object, the host address carried by the address object information is stored in the node to obtain the address information of the node to be detected;

[0017] If the address type of the address object information is a subnet address object, the subnet start address and subnet end address carried by the address object information are stored in the node to obtain the address information of the node to be detected;

[0018] If the address type of the address object information is a range address object, the start address and end address of the range carried by the address object information are stored in the node to obtain the address information of the node to be detected.

[0019] In the above embodiments, different methods are used to generate the corresponding node address information to be detected for host address objects, subnet address objects, and range address objects, which can improve the accuracy of the node address information to be detected.

[0020] In one embodiment, after parsing the address object information, the method further includes:

[0021] Based on the protocol family type of the parsed address object information, add the corresponding protocol family identifier to the address object information.

[0022] The above embodiments can support both IPv4 and IPv6 protocol types by adding a protocol family identifier. Since the data format, length and comparison method of IPv4 and IPv6 addresses are different, the processing logic can be selected based on the protocol family identifier during access control.

[0023] In one embodiment, determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result includes:

[0024] If the address information of the node to be detected is the same as the address information of an existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

[0025] In the above embodiments, not adding the same address information to the linearized linked list can avoid redundancy in the linearized linked list, optimize the policy storage space, and avoid duplicate data detection during policy conflict detection, thereby speeding up the policy conflict detection rate.

[0026] In one embodiment, determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result includes:

[0027] If the boundary address of the node address information to be detected contains the boundary address of an existing node, then the boundary address of the existing node in the linearized linked list is replaced with the boundary address of the node address information to be detected.

[0028] In the above embodiments, replacing the boundary address of an existing node with a boundary address of a larger range can realize the update of the linearized linked list, avoid redundancy, and optimize storage space.

[0029] In one embodiment, determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result includes:

[0030] If the address information of the node to be detected is completely contained by the address information of the existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

[0031] In the above embodiments, for the address information of the node to be detected that is completely contained by the address information of the existing node, the node to be detected is released, and the linearized linked list remains unchanged, which can avoid redundancy and optimize storage space.

[0032] In one embodiment, determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result includes:

[0033] If the address information of the node to be detected does not overlap with the address information of the existing node, the address information of the node to be detected is added to the linearized linked list.

[0034] In the above embodiments, when there is no redundancy between the address information of the node to be detected and the address information of existing nodes, the address information of the node to be detected is added to the linearized linked list, which can realize the updating of the linearized linked list, avoid redundancy, and optimize storage space.

[0035] This application also provides an electronic device, the electronic device comprising:

[0036] processor;

[0037] Memory used to store processor-executable instructions;

[0038] The processor is configured to execute the address storage method of the access control policy described above.

[0039] This application also provides a computer-readable storage medium storing a computer program that can be executed by a processor to implement the address storage method of the access control policy described above.

[0040] The electronic device and storage medium provided in the above embodiments of this application determine whether there is redundancy between the address information of the node to be detected and the address information of the existing nodes by traversing the address information of the existing nodes in the linearized linked list; based on the determination result, it is determined whether to add the address information of the node to be detected to the linearized linked list. Thus, there is no redundant node address information in the linearized linked list, which optimizes the policy storage space and avoids duplicate data detection during policy conflict detection, thereby speeding up the policy conflict detection rate. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.

[0042] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0043] Figure 2 This is a flowchart illustrating an address storage method for an access control policy provided in an embodiment of this application;

[0044] Figure 3 yes Figure 2 Detailed flowchart of step S220 in the corresponding embodiment;

[0045] Figure 4 This is a block diagram illustrating an address storage device for an access control policy according to an embodiment of this application. Detailed Implementation

[0046] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0047] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0048] Figure 1This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device 100 can be used to execute the address storage method for access control policies provided in an embodiment of this application. Figure 1 As shown, the electronic device 100 includes: one or more processors 102 and one or more memories 104 storing processor-executable instructions. The processors 102 are configured to execute the address storage method for the access control policy provided in the following embodiments of this application.

[0049] The processor 102 may be a gateway, a smart terminal, or a device that includes a central processing unit (CPU), a graphics processing unit (GPU), or other forms of processing units with data processing capabilities and / or instruction execution capabilities. It can process data from other components in the electronic device 100 and control other components in the electronic device 100 to perform desired functions.

[0050] The memory 104 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 102 may execute the program instructions to implement the address storage method of the access control policy described below. Various application programs and various data may also be stored in the computer-readable storage medium, such as various data used and / or generated by the application programs.

[0051] In one embodiment, Figure 1 The electronic device 100 may also include an input device 106, an output device 108, and a data acquisition device 110, which are interconnected via a bus system 112 and / or other forms of connection mechanisms (not shown). It should be noted that... Figure 1 The components and structure of the electronic device 100 shown are merely exemplary and not limiting; the electronic device 100 may also have other components and structures as needed.

[0052] The input device 106 may be a device used by a user to input commands, and may include one or more of a keyboard, mouse, microphone, and touchscreen. The output device 108 may output various information (e.g., images or sounds) to the outside (e.g., a user), and may include one or more of a display, speaker, etc. The data acquisition device 110 may acquire images of objects and store the acquired images in the memory 104 for use by other components. For example, the data acquisition device 110 may be a camera.

[0053] In one embodiment, the devices in the example electronic device 100 for implementing the address storage method of the access control policy of the present application embodiment can be integrated or distributed. For example, the processor 102, memory 104, input device 106 and output device 108 can be integrated into one unit, while the data acquisition device 110 can be separated.

[0054] In one embodiment, the example electronic device 100 for implementing the address storage method of the access control policy of the present application embodiment can be implemented as a smart terminal such as a smartphone, tablet computer, server, desktop computer, vehicle device, etc.

[0055] Figure 2 This is a flowchart illustrating an address storage method for access control policies provided in an embodiment of this application. Figure 2 As shown, the method includes the following steps S210-S240.

[0056] Step S210: Obtain the address object information referenced by the access control policy.

[0057] Access control policies, also known as security policies, are strategies for controlling network communication. The address object information referenced by access control policies can include one or more types, such as host address objects, subnet address objects, and range address objects.

[0058] Access control policies can reference multiple host address objects, each of which can include one or more host addresses, with no specific relationship between them. There is only one subnet address object, such as 1.1.1.0 / 24, which represents host addresses 1.1.1.0 to 1.1.1.255, containing 256 host addresses. There is only one range address object, such as 1.1.0.0-1.1.2.2, which represents host addresses 1.1.0.0 to 1.1.2.2, containing 515 host addresses.

[0059] Step S220: Parse the address object information to determine the address information of the node to be detected.

[0060] Parsing the address object information yields its address type and protocol family type. The address information of the node to be detected refers to the address information obtained from the address object information. In one embodiment, a corresponding protocol family identifier can be added to the address object information based on the protocol family type obtained from the parsing.

[0061] Protocol family types can include IPv4 and IPv6. Therefore, when the protocol family type of an address object is IPv4, the protocol family identifier can be added as IPv4. Similarly, when the protocol family type of an address object is IPv6, the protocol family identifier can be added as IPv6.

[0062] The method provided in this application embodiment can support both IPv4 and IPv6 protocol types simultaneously. Since the data format, length, and comparison method of IPv4 and IPv6 addresses are different, the processing logic can be selected based on the protocol family identifier during the access control process.

[0063] In one embodiment, such as Figure 3 The above step S220 specifically includes the following steps S221-S222.

[0064] Step S221: Determine the address type of the address object information based on the identification information carried by the address object information.

[0065] Address types can include host address objects, subnet address objects, and range address objects. The information used to distinguish between different address types is [details omitted].

[0066] It should be noted that when adding address objects, the format of the address object is used to distinguish between host, subnet, and range, and a mark is made in the address object information. When access control policies reference it, the mark can be used to directly determine the address type. The format of host address objects is the exact host address, such as 1.1.1.1, 2.2.2.2; the format of subnet address objects is the subnet address, such as 1.1.1.0 / 24 (equivalent to IP: 1.1.1.0 mask: 255.255.255.0), 1.1.0.0 / 16 (equivalent to IP: 1.1.0.0 mask: 255.255.0.0); the format of range address objects is a range, such as 1.1.1.1-1.1.1.255, 2.2.2.2-5.5.5.5.

[0067] The above-mentioned markings can be used as identification information in the embodiments of this application. For example, marking A represents a host address object, marking B represents a subnet address object, and marking C represents a range address object.

[0068] Step S222: Generate the address information of the node to be detected based on the address type of the address object information.

[0069] In one embodiment, if the address type of the address object information is a host address object, the host address carried by the address object information is stored in the node to obtain the address information of the node to be detected.

[0070] It should be noted that the address information of the node to be detected includes the start address and the end address. Since the host address object is an exact host address, such as 1.1.1.1, the start address and end address of the address information of the node to be detected in the host address object are the same, such as 1.1.1.1.

[0071] In one embodiment, if the address type of the address object information is a subnet address object, the subnet start address and subnet end address carried by the address object information are stored in the node to obtain the address information of the node to be detected.

[0072] In other words, the node address information to be detected for the subnet address object includes the subnet start address and the subnet end address. For example, if the subnet address object is 1.1.1.0 / 24, the subnet start address is 1.1.1.0, and the subnet end address is 1.1.1.255.

[0073] In one embodiment, if the address type of the address object information is a range address object, the range start address and range end address carried by the address object information are stored in the node to obtain the address information of the node to be detected.

[0074] In other words, the address information of the node to be detected in the range address object includes the range start address and the range end address. For example, the range start address is 1.1.1.1 and the range end address is 2.2.2.2.

[0075] Step S230: Traverse the address information of existing nodes in the linearized linked list and determine whether there is redundancy between the address information of the node to be detected and the address information of existing nodes.

[0076] Linearized linked lists are used to store node address information that is not redundant. Existing node address information refers to the node address information already stored in the linearized linked list. There are four possible redundancy scenarios between the address information of the node to be detected and the address information of existing nodes. Different processing methods are used for different redundancy scenarios, as shown in Table 1 below.

[0077] Table 1. Handling methods for different redundancy scenarios

[0078]

[0079]

[0080] Step S240: Based on the judgment result, determine whether to add the address information of the node to be detected to the linearized linked list.

[0081] The judgment result can include the judgment results of the four redundancy cases mentioned above. The processing methods for different redundancy cases are described in detail below.

[0082] Case 1: If the address information of the node to be detected is the same as the address information of an existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

[0083] For example, suppose the address information of the node to be detected is 1.1.1.1-1.1.1.10, and the address information of the existing nodes in the linearized linked list is 1.1.1.1-1.1.1.10. Since the two are exactly the same, the address information of the node to be detected can be deleted, and the linearized linked list remains unchanged.

[0084] Case 2: If the boundary address of the node address information to be detected contains the boundary address of an existing node, replace the boundary address of the existing node in the linearized linked list with the boundary address of the node address information to be detected.

[0085] The boundary address includes the left boundary (i.e., the starting address) and the right boundary (the ending address). The boundary address of the node address information to be detected includes the boundary address of the existing node, where the left boundary of the node address information to be detected is less than the left boundary of the existing node, and the right boundary of the node address information to be detected is greater than the right boundary of the existing node.

[0086] Specifically: a. If the left boundary of the address information of the node to be detected is less than the left boundary of an existing node, then the left boundary of the existing node is replaced with the left boundary of the node to be detected, and the node to be detected is released. For example: the address information of the node to be detected is 1.1.1.1-1.1.1.10, the address information of the existing node is 1.1.1.5-1.1.1.10, and 1.1.1.1 is less than 1.1.1.5, then 1.1.1.1 replaces 1.1.1.5 with 1.1.1.1, and the node address information after the linearized linked list is updated is 1.1.1.1-1.1.1.10.

[0087] b. If the right boundary of the address information of the node to be detected is greater than the right boundary of an existing node, then replace the right boundary of the existing node with the right boundary of the address information of the node to be detected, and release the address information of the node to be detected. For example: if the address information of the node to be detected is 1.1.1.1-1.1.1.10, and the address information of the existing node is 1.1.1.1-1.1.1.5, and 1.1.1.10 is greater than 1.1.1.5, then replace 1.1.1.5 with 1.1.1.10, and the node address information after the linearized linked list is updated is 1.1.1.1-1.1.1.10.

[0088] Conversely, if the left boundary of the address information of the node to be detected is greater than the left boundary of the existing node, the left boundary of the existing node remains unchanged, and the address information of the node to be detected is released. For example, if the address information of the node to be detected is 1.1.1.5-1.1.1.10, and the address information of the existing node is 1.1.1.1-1.1.1.10, then the stored node address information will still be 1.1.1.1-1.1.1.10.

[0089] If the right boundary of the address information of the node to be detected is less than the right boundary of an existing node, then the right boundary of the existing node remains unchanged, and the address information of the node to be detected is released. For example, if the address information of the node to be detected is 1.1.1.1-1.1.1.5, and the address information of the existing node is 1.1.1.1-1.1.1.10, then the stored node address information will still be 1.1.1.1-1.1.1.10.

[0090] Scenario 3: If the address information of the node to be detected completely includes the address information of the existing nodes, then update the existing node information with the address information of the node to be detected and release the address information of the node to be detected. For example: if the address information of the node to be detected is 1.1.1.1-1.1.1.10, and the address information of the existing nodes is 1.1.1.5-1.1.1.9, then the updated node address information of the linearized linked list is 1.1.1.1-1.1.1.10.

[0091] Conversely, if the address information of the node to be detected is completely contained within the address information of the existing nodes, the address information of the node to be detected is released, and the linearized linked list remains unchanged. For example, if the address information of the node to be detected is 1.1.1.5-1.1.1.9, and the address information of the existing nodes is 1.1.1.1-1.1.1.10, and the address information of the node to be detected is completely within the range of the address information of the existing nodes, then the stored node address information remains 1.1.1.1-1.1.1.10, that is, the node address information of the linearized linked list is not updated.

[0092] Case 4: If the address information of the node to be detected does not overlap with the address information of the existing node, the address information of the node to be detected is added to the linearized linked list.

[0093] "No overlap" means that the address range from the start address to the end address of the node to be detected does not intersect with the address range of existing nodes.

[0094] For example, if the address information of the node to be detected is 1.1.1.1-1.1.1.5, and the address information of the existing nodes is 1.1.1.10-1.1.1.15 and 2.2.2.1-3.3.3.3, then the address information of the node to be detected, 1.1.1.1-1.1.1.5, can be added to the linearized linked list. After adding it, the node address information of the linearized linked list includes 1.1.1.1-1.1.1.5, 1.1.1.10-1.1.1.1.15, and 2.2.2.1-3.3.3.3.

[0095] The technical solution provided in the above embodiments of this application traverses the address information of existing nodes in the linearized linked list and determines whether there is redundancy between the address information of the node to be detected and the address information of existing nodes; based on the determination result, it determines whether to add the address information of the node to be detected to the linearized linked list. Thus, there is no redundant node address information in the linearized linked list, which optimizes the policy storage space and avoids duplicate data detection during policy conflict detection, thereby speeding up the policy conflict detection rate.

[0096] The following are embodiments of the apparatus of this application, which can be used to execute the address storage method embodiment of the access control policy described above in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the address storage method embodiment of the access control policy of this application.

[0097] Figure 4 This is a block diagram illustrating an address storage device for an access control policy according to an embodiment of this application. Figure 4 The device includes: an address acquisition module 410, an address parsing module 420, a redundancy judgment module 430, and an address storage module 440.

[0098] Address acquisition module 410 is used to acquire address object information referenced by access control policies;

[0099] Address resolution module 420 is used to parse the address object information to determine the address information of the node to be detected;

[0100] The redundancy judgment module 430 is used to traverse the address information of existing nodes in the linearized linked list and determine whether there is redundancy between the address information of the node to be detected and the address information of existing nodes.

[0101] Address storage module 440 is used to determine whether to add the address information of the node to be detected to the linearized linked list based on the judgment result.

[0102] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the address storage method of the above-mentioned access control policy, and will not be repeated here.

[0103] In one embodiment, the address resolution module 420 specifically includes:

[0104] A type determination unit is used to determine the address type of the address object information based on the identification information carried by the address object information.

[0105] The node generation unit is used to generate the address information of the node to be detected based on the address type of the address object information.

[0106] In one embodiment, the node generation unit described above is specifically used for:

[0107] If the address type of the address object information is a host address object, the host address carried by the address object information is stored in the node to obtain the address information of the node to be detected;

[0108] If the address type of the address object information is a subnet address object, the subnet start address and subnet end address carried by the address object information are stored in the node to obtain the address information of the node to be detected;

[0109] If the address type of the address object information is a range address object, the start address and end address of the range carried by the address object information are stored in the node to obtain the address information of the node to be detected.

[0110] In one embodiment, the above apparatus further includes: a protocol family identifier module, used to add a corresponding protocol family identifier to the address object information according to the protocol family type of the parsed address object information after parsing the address object information.

[0111] In one embodiment, the address storage module 440 is specifically used to: if the address information of the node to be detected is the same as the address information of an existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

[0112] In one embodiment, the address storage module 440 is specifically used to: if the boundary address of the node address information to be detected contains the boundary address of an existing node, replace the boundary address of the existing node in the linearized linked list with the boundary address of the node address information to be detected.

[0113] In one embodiment, the address storage module 440 is specifically used to: if the address information of the node to be detected is completely contained by the address information of the existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

[0114] In one embodiment, the address storage module 440 is specifically used to: add the address information of the node to be detected to the linearized linked list if the address information of the node to be detected does not overlap with the address information of the existing node.

[0115] The apparatuses and methods disclosed in the several embodiments provided in this application can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] If a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

Claims

1. A method for storing the address of an access control policy, characterized in that, include: Retrieve information about the address objects referenced by the access control policy; The address object information is parsed to determine the address information of the node to be detected; Traverse the address information of existing nodes in the linearized linked list and determine whether there is redundancy between the address information of the node to be detected and the address information of existing nodes; Based on the judgment result, determine whether to add the address information of the node to be detected to the linearized linked list; The step of determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result includes: If the address information of the node to be detected is the same as the address information of an existing node, release the address information of the node to be detected and keep the linearized linked list unchanged; If the boundary address of the node address information to be detected contains the boundary address of an existing node, replace the boundary address of the existing node in the linearized linked list with the boundary address of the node address information to be detected. If the address information of the node to be detected is completely contained by the address information of the existing node, release the address information of the node to be detected and keep the linearized linked list unchanged.

2. The method according to claim 1, characterized in that, The step of parsing the address object information to determine the address information of the node to be detected includes: The address type of the address object information is determined based on the identification information carried by the address object information; Based on the address type of the address object information, generate the address information of the node to be detected.

3. The method according to claim 2, characterized in that, The step of generating the address information of the node to be detected based on the address type of the address object information includes: If the address type of the address object information is a host address object, the host address carried by the address object information is stored in the node to obtain the address information of the node to be detected; If the address type of the address object information is a subnet address object, the subnet start address and subnet end address carried by the address object information are stored in the node to obtain the address information of the node to be detected; If the address type of the address object information is a range address object, the start address and end address of the range carried by the address object information are stored in the node to obtain the address information of the node to be detected.

4. The method according to claim 1, characterized in that, After parsing the address object information, the method further includes: Based on the protocol family type of the parsed address object information, add the corresponding protocol family identifier to the address object information.

5. The method according to claim 1, characterized in that, The step of determining whether to add the address information of the node to be detected to the linearized linked list based on the judgment result further includes: If the address information of the node to be detected does not overlap with the address information of the existing node, the address information of the node to be detected is added to the linearized linked list.

6. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; The processor is configured to execute the address storage method of the access control policy according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to implement the address storage method of the access control policy according to any one of claims 1-5.

Images