Firewall Automatic Deployment Method, Device, and Server

Abstract

The present application provides a method, device and server for automatic deployment of a firewall. The method includes: the server obtains a firewall application. The firewall application includes the source server name, the destination server name, the protocol type, and the destination port information. The server obtains environmental information from a database. The server generates a firewall policy based on the firewall application and the environmental information. According to the firewall policy, the server automatically completes the activation of the firewall when the change execution time window is reached. The server verifies whether the firewall is successfully activated. When the server determines that the firewall is successfully activated, the server determines that the firewall has been deployed in the network of the production environment. The method of the present application improves the accuracy of firewall activation and improves the consistency of the firewall in the test environment and the production environment.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a method, device, and server for automatically deploying a firewall. Background Art

[0002] Firewalls are typically connected between private and public networks to control and protect them. Before a firewall is put into operation, it must first be verified in test and production environments before it can be activated and put into use in a network environment.

[0003] In the existing technology, project teams can submit firewall application forms through the continuous delivery system. This application form can then be transferred to the test environment and then the production environment through the continuous delivery system. Maintenance personnel in the test and production environments will verify the firewall and submit the application through the firewall application system. Network maintenance personnel will activate and use the firewall based on the application form.

[0004] In the above process, the verification and activation of the firewall need to go through multiple systems and multiple manual operation procedures. The accuracy of the operation and the comprehensiveness of the verification depend on the experience of the maintenance personnel, resulting in poor firewall verification effect. Summary of the Invention

[0005] The present application provides a firewall automatic deployment method, device and server to solve the problem that the verification and activation of the firewall requires multiple systems and multiple manual operation processes. Its operation accuracy and verification comprehensiveness rely on the experience of maintenance personnel, resulting in poor firewall verification effect.

[0006] In a first aspect, the present application provides a method for automatically deploying a firewall, comprising:

[0007] Obtain a firewall application, which includes the source server name, destination server name, protocol type, and destination port information;

[0008] Generate firewall policies based on firewall application and environment information, and automatically activate firewalls according to firewall policies;

[0009] Once the firewall is verified to be enabled successfully, deploy it to the production network.

[0010] The environment information includes the correspondence between the server IP address and the server name.

[0011] Optionally, generate a firewall policy based on the firewall application and environment information, including:

[0012] Determine the source server IP address based on the source server name and environment information, and determine the destination server IP address based on the destination server name and environment information;

[0013] Determine the regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the environment information;

[0014] Generate firewall policies based on regional policy relationships, protocol types, and destination port information.

[0015] Optionally, verify that the firewall is enabled successfully, including:

[0016] Determine whether there is a routing path between the source server IP address and the destination server IP address based on the route matching result between the source server IP address and the destination server IP address;

[0017] When a routing path exists, the interface comparison of the routing path is performed based on the destination port and protocol to determine whether the routing path meets the requirements of the destination port and protocol;

[0018] When the conditions are met, it is determined that the firewall is activated successfully.

[0019] Optionally, the environment information includes test environment information and production environment information. A firewall policy is generated based on the firewall application and the environment information, and the firewall is automatically activated according to the firewall policy, specifically including:

[0020] Generate a test environment firewall policy based on the firewall application and test environment information, and automatically activate the firewall in the test environment according to the test environment firewall policy;

[0021] Generate production environment firewall policy based on firewall application and production environment information, and automatically activate firewall in production environment according to production environment firewall policy.

[0022] Optionally, when the verification determines that the firewall activation fails, the method further includes:

[0023] Generate a firewall topology diagram based on environment information through firewall static route matching and interface comparison;

[0024] Regenerate the firewall policy based on the firewall application and firewall topology diagram. The firewall policy is used to add or modify the route between two servers.

[0025] Optionally, the method further includes:

[0026] Periodically maintain environmental information.

[0027] In a second aspect, the present application provides a firewall automatic deployment device, comprising:

[0028] The acquisition module is used to obtain the firewall application, which includes the source server name, destination server name, protocol type, and destination port information;

[0029] The processing module is used to generate a firewall policy based on the firewall application and environment information, and automatically activate the firewall according to the firewall policy; when the firewall activation is verified to be successful, the firewall is deployed to the production environment network;

[0030] The environment information includes the correspondence between the server IP address and the server name.

[0031] Optionally, the processing module is specifically configured to:

[0032] Determine the source server IP address based on the source server name and environment information, and determine the destination server IP address based on the destination server name and environment information;

[0033] Determine the regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the environment information;

[0034] Generate firewall policies based on regional policy relationships, protocol types, and destination port information.

[0035] Optionally, the processing module is specifically configured to:

[0036] Determine whether there is a routing path between the source server IP address and the destination server IP address based on the route matching result between the source server IP address and the destination server IP address;

[0037] When a routing path exists, the interface comparison of the routing path is performed based on the destination port and protocol to determine whether the routing path meets the requirements of the destination port and protocol;

[0038] When the conditions are met, it is determined that the firewall is activated successfully.

[0039] Optionally, the environment information includes test environment information and production environment information; the processing module is specifically configured to:

[0040] Generate a test environment firewall policy based on the firewall application and test environment information, and automatically activate the firewall in the test environment according to the test environment firewall policy;

[0041] Generate production environment firewall policy based on firewall application and production environment information, and automatically activate firewall in production environment according to production environment firewall policy.

[0042] Optionally, when the verification determines that the firewall opening fails, the processing module is further configured to:

[0043] Generate a firewall topology diagram based on environment information through firewall static route matching and interface comparison;

[0044] Regenerate the firewall policy based on the firewall application and firewall topology diagram. The firewall policy is used to add or modify the route between two servers.

[0045] Optionally, the processing module is further configured to:

[0046] Periodically maintain environmental information.

[0047] In a third aspect, the present application provides a server comprising: a memory and a processor; the memory is used to store a computer program; the processor is used to execute the firewall automatic deployment method in the first aspect and any possible design of the first aspect according to the computer program stored in the memory.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When at least one processor of a server executes the computer program, the server executes the firewall automatic deployment method in the first aspect and any possible design of the first aspect.

[0049] In a fifth aspect, the present application provides a computer program product, which includes a computer program. When at least one processor of a server executes the computer program, the server executes the firewall automatic deployment method in the first aspect and any possible design of the first aspect.

[0050] The automatic firewall deployment method, device and server provided in the present application obtain a firewall application, which includes the source server name, destination server name, protocol type, and destination port information; obtain environmental information from a database; generate a firewall policy based on the firewall application and the environmental information; automatically complete the activation of the firewall according to the firewall policy when the change execution time window is reached; verify whether the firewall is successfully activated; when the server determines that the firewall is successfully activated, determine that the firewall has completed the deployment of the network in the production environment, thereby improving the accuracy of firewall activation, effectively avoiding the problem of the activated firewall having a range that is too small or too large, improving the consistency of the firewall in the test environment and the production environment, avoiding possible omissions in the handover from the test environment to the production environment, and improving the effectiveness of the firewall test in the test environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0052] Figure 1 A schematic diagram of the structure of a firewall automatic deployment system provided in one embodiment of the present application;

[0053] Figure 2 This is a flowchart of an automatic firewall deployment system according to an embodiment of the present application;

[0054] Figure 3 A flowchart of a method for automatic firewall deployment provided in one embodiment of the present application;

[0055] Figure 4 This is a flowchart of an execution of a firewall activation module provided in one embodiment of the present application;

[0056] Figure 5 A flowchart of a method for automatic firewall deployment provided in one embodiment of the present application;

[0057] Figure 6 A schematic diagram of the structure of a firewall automatic deployment device provided in one embodiment of the present application;

[0058] Figure 7 A schematic diagram of the hardware structure of a server provided in one embodiment of the present application. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0060] In the specification and claims of this application, as well as in the accompanying drawings, the terms "first," "second," "third," "fourth," and the like are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that such terms are interchangeable where appropriate. For example, first information could be referred to as second information, and similarly, second information could be referred to as first information without departing from the scope of this disclosure.

[0061] The word "if" as used herein may be interpreted as "when" or "when" or "in response to determining," depending on the context.

[0062] Furthermore, as used herein, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context indicates otherwise.

[0063] It should be further understood that the terms “comprises” and “includes” indicate the existence of features, steps, operations, elements, components, items, types, and / or groups, but do not preclude the existence, occurrence, or addition of one or more other features, steps, operations, elements, components, items, types, and / or groups.

[0064] The terms "or" and "and / or" as used herein are to be interpreted as inclusive, or mean any one or any combination. Thus, "A, B, or C" or "A, B, and / or C" means "any one of the following: A; B; C; A and B; A and C; B and C; A, B, and C." An exception to this definition occurs only when a combination of elements, functions, steps, or operations are inherently mutually exclusive in some manner.

[0065] Firewalls are typically connected between private and public networks to control and protect them. Alternatively, firewalls can integrate various security management and screening software and hardware devices to help computer networks establish a relatively isolated protective barrier between their internal and external networks, thereby protecting user data and information security. Before a firewall is put into operation, it is typically verified in test and production environments before it can be activated and put into use in a network environment. The test environment refers to the computer hardware, software, network equipment, and historical data required to complete software testing. The production environment refers to the computer hardware, software, network equipment, and data required to officially provide services to the outside world.

[0066] In the prior art, there are two main methods for activating firewalls in test and production environments. First, the project team submits a firewall application form to the environmental maintenance personnel for the test and production environments. The firewall application form can include information such as the source server name, source server address, destination server name, destination server address, protocol type, and destination port. After receiving the firewall application form, the environmental maintenance personnel for the test and production environments can manually activate the network firewall after self-evaluation. Second, the project team can submit the firewall application form through the continuous delivery system. The firewall application form can be transferred to the test and production environments through the continuous delivery system. After receiving the firewall application form, the environmental maintenance personnel for the test and production environments will verify the firewall and submit the firewall application through the firewall application system. The firewall application can be transferred through the firewall application system to the network management department, where the network environment maintenance personnel can manually activate the firewall.

[0067] The above-mentioned firewall activation method reveals that, in the prior art, each firewall application requires first submitting a firewall application form within the continuous delivery system. However, since these firewall application forms are typically not recorded in the system, this can easily lead to increased management costs and confusion. Furthermore, in the prior art, the process from project team application to firewall activation must pass through multiple systems, including the continuous delivery system, firewall application system, and change management system. Furthermore, each system requires steps such as permission approval and operation plan development, resulting in a complex process, long cycle times, and low efficiency. Furthermore, firewall activation is currently primarily performed manually, which can lead to errors even with the slightest negligence, making it easy to accidentally delete or modify the firewall. This manual operation method presents a higher operational risk than automated activation methods. Furthermore, excessive manual involvement can easily lead to irregular firewall application process management, omissions in firewall activation content, and excessively wide firewall activation scopes, resulting in low firewall activation accuracy. In particular, for firewall applications being handed over from a test environment to a production environment, the prior art also suffers from an inability to verify the completeness of the firewall application. In summary, the verification and activation of a firewall requires multiple systems and multiple manual operation processes. The accuracy of the operation and the comprehensiveness of the verification depend on the experience of the maintenance personnel, resulting in poor firewall verification results.

[0068] To address the above issues, the present application proposes an automated firewall deployment method that overcomes the shortcomings of existing firewall application technologies and features a simple process, standardized management, high efficiency, and high accuracy. The automated firewall deployment method of the present application specifically includes three steps: firewall application, automatic activation, and verification. In the present application, a server can obtain a firewall application. This firewall application can be submitted by the project team in the form of a work order. After undergoing multiple levels of review and verification by operations and maintenance personnel in the test environment, the firewall application can be transferred to operations and maintenance personnel in the production environment. During this process, the server can periodically maintain environmental information. This environmental information can include the correspondence between server IP addresses and server names. This periodic maintenance of environmental information minimizes the need for maintenance personnel to focus on the IP addresses of individual servers in the cluster. Maintenance personnel only need to focus on the names of the individual servers in the cluster. The server can automatically generate a firewall policy based on the firewall application and environmental information. After reviewing the firewall policy, the server can also automatically activate the firewall. The server can then verify that the firewall has been successfully activated based on the firewall policy. Through the above method, the present application reduces the risks associated with manual intervention in the firewall deployment process. Furthermore, by automating the firewall deployment process, the present application improves the efficiency and accuracy of firewall deployment.

[0069] This application uses an automated firewall deployment system to implement firewall application, automatic activation, and verification in test and production environments. The automated firewall deployment system can define a name for a group of servers based on server type or characteristics for both test and production environments. The automated firewall deployment system can maintain the correspondence between the IP addresses and server names of each server in the group, based on actual circumstances. When submitting a firewall application, the project team can select the server type and port type for the source and destination servers in the corresponding selection interface. The project team can submit the firewall application in the automated firewall deployment system. After review by the project team leader, the application can be transferred to the test environment maintenance leader. After approval by the test environment maintenance leader, the application can be transferred to the test environment maintenance leader. The test environment maintenance leader is required to review the firewall policy. When the system change window arrives, the automated firewall deployment system can automatically activate the test environment firewall. After verification by the test environment maintenance leader, the application can be transferred to the production environment maintenance leader. After approval by the production environment maintenance leader, the application can be transferred to the production environment maintenance leader. The production environment maintenance leader then reviews the firewall policy. When the system change time arrives, the firewall automatic deployment system automatically opens the production environment firewall.

[0070] The automatic firewall deployment system of this application is a comprehensive system. It implements an automatic firewall deployment method. Furthermore, this method facilitates firewall application and activation, simplifying the firewall application process and shortening the firewall review cycle. This method maintains the association between server IP addresses and server names in environmental information, facilitating the server's generation of firewall policies based on this environmental information and firewall applications. This application also uses the automatic firewall deployment system to maintain firewall activation, ensuring more accurate firewall activation and effectively avoiding issues with excessive or inaccurate firewall scopes. Furthermore, project teams can submit firewall applications to a test environment within the automatic firewall deployment system's display interface. After verification in the test environment, the automatic firewall deployment system can transfer the application to the production environment. The automatic firewall deployment method also verifies firewall accuracy, preventing the possibility of missing firewalls in the production environment. The firewall application provided in this application can also be generated and submitted by importing an attachment, simplifying the firewall application submission process. The automatic firewall deployment system of this application also includes an audit module and an automatic firewall activation module. The use of this review module enables more standardized management of the firewall application process, avoiding the risk of unapproved firewall applications being submitted directly. The automatic firewall activation module can automatically activate the firewall based on the firewall policy generated by the firewall application form, reducing the risks and workload associated with manual operation and improving work efficiency. Furthermore, this application provides a firewall policy audit function to further reduce the risk of firewall activation.

[0071] The following specific embodiments are used to describe the technical solution of the present application in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0072] Figure 1 FIG. 1 shows a schematic diagram of a firewall automatic deployment system provided by an embodiment of the present application. Figure 1 As shown, the firewall automatic deployment system can at least include a test environment information maintenance module, a test environment submission module, a test environment review module, a test environment activation module, a test environment firewall verification module, a production environment information maintenance module, a production environment review module, a production environment activation module, a production environment firewall verification module and a basic data module.

[0073] Among them, the test environment information maintenance module is maintained by the test environment maintenance personnel. The test environment information maintenance module includes the server name where the test environment server IP address is located. The maintenance can include storing the correspondence between the server IP address and the server name in the database. Because in the prior art, when opening a firewall, developers are usually required to clearly specify the server IP address. The test environment maintenance module allows developers to not pay attention to the specific server IP address, but only need to pay attention to the server name. The use of this predictive environment maintenance module can reduce errors in the firewall application process and improve the efficiency of firewall application. In addition, the maintenance of the association between the server IP address and the server name in the test environment maintenance module can also improve the efficiency of the flow of firewall application work orders in the test environment and the production environment.

[0074] Among them, the test environment firewall submission module is used to generate and submit the firewall application after receiving the firewall application data submitted by the project team. After the firewall automatic deployment system receives the firewall application submitted by the test environment firewall submission module, it can use the work order corresponding to the firewall application to circulate in the subsequent process. In this application, the applicant only needs to pay attention to the source server name, destination server name, protocol type, and destination port information in the test environment firewall submission module, and does not need to pay attention to the server IP address. The server can also import basic data while importing attachments. The basic data may include information such as storage data tables, address area relationship tables, area policy relationship tables, firewall device information tables, and firewall port service tables. After using the test environment information maintenance module to maintain the test environment information, the test environment firewall submission module only needs to obtain a small amount of firewall application data to complete the generation of the firewall application, reducing the data content that the project team needs to fill in when applying for the firewall, and improving the work efficiency of the project team in submitting firewall applications.

[0075] Among them, the test environment firewall review module is used to transfer the task node to the project team leader after the project team submits the firewall application. The project team leader can review the firewall application through the interactive interface of the test environment firewall review module. When the project team leader completes the review, the test environment firewall review module can transfer the work order of the firewall application to the test environment maintenance personnel leader. When the test environment maintenance personnel leader can approve the firewall application through the interactive interface of the test environment firewall review module. The test environment firewall review module can transfer the work order of the firewall application to the test environment maintenance personnel after the firewall application is approved. In the test environment firewall review module, risks are mainly controlled through manual review. Since firewalls involve system security and the degree of danger of opening firewalls between different servers is different, in order to further improve security, this application adds manual review on the basis of completing automatic verification to improve security.

[0076] The test environment firewall activation module is used to enable testers to review the automatically generated firewall policy. Furthermore, the test environment firewall activation module automatically activates the firewall according to the firewall policy when the change execution window arrives. After the firewall is activated, the test environment can conduct normal business testing. This business testing primarily verifies whether the activation of the firewall will adversely affect business operations. Once business operations are confirmed to be normal, the work order for the firewall application can be transferred to the production environment through the test environment firewall activation module.

[0077] Among them, the execution of the test environment firewall verification module can be completed during the test environment activation module. When the test environment activation module completes the automatic activation of the firewall, the test environment firewall verification module is automatically executed. When the test environment firewall verification module is executed, it can be executed in parallel with the business test in the test environment firewall activation module. Alternatively, the business test in the test environment firewall activation module can be executed after the verification of the test environment firewall verification module is completed. The test environment firewall verification module can call the method provided by the system to verify whether the firewall is activated. The test environment firewall verification module can include firewall verification command encapsulation for servers with different operating systems. For example: for Windows and Linux operating systems, the ping command or telnet command can be called to verify whether the ports between servers are connected. The test environment firewall verification module can realize automatic verification of the verification module.

[0078] The production environment information maintenance module is maintained by the production environment maintenance personnel. The production environment information maintenance module includes the server name where the production environment server IP address is located. The maintenance may include storing the corresponding relationship between the server IP address and the server name in a database.

[0079] It should be noted that the production system of this application first needs to be fully verified in the test environment during the online process, and only then will it be deployed in the production environment. However, in the prior art, the testing of firewalls in the test environment mainly relies on the memory of the test maintenance personnel, and irregular operations are prone to occur. These irregular operations can easily lead to the situation where the test results of the firewall in the test environment are inconsistent with the results of use in the production environment, resulting in various untested hidden risks after deployment in the production environment. This application can achieve full verification of the firewall in the test environment through the test environment firewall activation module and the test environment firewall verification module. In addition, the manual operation in this application only involves the audit in the test environment firewall audit module, and does not involve testing and verification content, thereby ensuring the synchronization of the test environment and the production environment, standardizing the verification steps of the firewall, and reducing various hidden risks.

[0080] The production environment firewall review module is used to route firewall application work orders to the production environment operations and maintenance personnel. The production environment operations and maintenance personnel can review the firewall application through the test environment firewall review module's interactive interface. Once the production environment operations and maintenance personnel complete their review, the firewall application work order can be routed to the production environment operations and maintenance personnel.

[0081] The production environment firewall activation module is used to enable production environment operations and maintenance personnel to review the automatically generated firewall policy. Furthermore, the module can automatically activate the firewall according to the firewall policy when the change execution window arrives.

[0082] The production environment firewall verification module is used to verify the successful activation of the firewall after it is automatically activated. During this verification process, production environment operations and maintenance personnel can log in to the firewall automatic deployment system. Within the interactive interface of the firewall automatic deployment system, production environment operations and maintenance personnel can select the source server name, protocol type, and destination port information, as well as the destination server name, protocol type, and destination port information. Based on this information, the production environment firewall verification module can invoke system-provided methods to verify the activation of the production environment firewall.

[0083] In addition, the server may also include a basic data module. This basic data module may include three databases: a server node name correspondence database, a firewall application database, and a firewall routing database. The server node name correspondence database stores detailed information on the correspondence between firewall server names and server IP addresses. The firewall application database stores detailed information on firewall applications. The firewall routing database stores detailed information on firewall routes.

[0084] Figure 2 FIG1 shows an execution flow chart of the above-mentioned automatic firewall deployment system. Figure 2 As shown, after obtaining test environment information, the test environment maintenance module can store the test environment information in a server name correspondence library to maintain the server name correspondence library. After obtaining firewall application data, the test environment firewall submission module can store the firewall application data in a firewall application database. The test environment firewall submission module can also obtain environment information from the test environment maintenance module. The test environment firewall submission module can generate a firewall application based on the firewall application data and the environment data. The automatic firewall deployment system can transfer the firewall application to the test environment firewall review module. In the test environment firewall application module, the automatic firewall deployment system can extend the firewall policy based on the firewall application. The test environment firewall review module can also review the firewall application and firewall policy. If the review is passed, the automatic firewall deployment system can transfer the firewall application and the firewall policy to the test environment firewall activation module. The test environment firewall activation module can activate the firewall according to the firewall policy when the change execution time window is reached.

[0085] After the firewall in the test environment is activated, the firewall automatic deployment system can also use the test environment firewall verification module to verify whether the firewall is successfully activated. The firewall automatic deployment system can also perform business tests on the firewall to determine whether the firewall has any abnormalities.

[0086] The automatic firewall deployment system can store the acquired production environment information into the server name correspondence library through the production environment maintenance module, thereby maintaining the server name correspondence library. After completing the test in the test environment, the automatic firewall deployment system can transfer the firewall application to the production environment firewall review module. The production environment firewall review module can review the firewall application and the firewall policy determined based on the firewall application and the environment information. When the review is passed, the automatic firewall deployment system can also transfer the firewall application and the fire protection policy to the production environment firewall activation module. The production environment firewall activation module can activate the firewall according to the firewall policy when the change execution time window is reached. The automatic firewall deployment system can also add the firewall information to the firewall routing database.

[0087] In the present application, the firewall automatic deployment system is usually deployed in the server cluster, and there is usually a server in the server cluster as the main node of the server cluster or the node storing the firewall automatic deployment system. Therefore, the server corresponding to the main node or the node storing the firewall automatic deployment system is used as the execution subject to execute the firewall automatic deployment method of the following embodiment. Specifically, the execution subject may include the hardware device of the server, or the software application of the firewall automatic deployment system, or the computer-readable storage medium on which the firewall automatic deployment system is installed, or the code of the software application of the firewall automatic deployment system. It should be noted that the environmental information mentioned in this embodiment includes the correspondence between the server IP address and the server name. In the environmental information, the server corresponding to the server IP address and the server name can be any server node in the server cluster.

[0088] Figure 3 A flowchart of a method for automatically deploying a firewall provided by an embodiment of the present application is shown. Figure 1 and Figure 2 Based on the embodiment shown, Figure 3 As shown, with the server as the execution subject, the method of this embodiment may include the following steps:

[0089] S101. Obtain a firewall application, which includes a source server name, a destination server name, a protocol type, and a destination port information.

[0090] In this embodiment, the server can obtain a firewall application. The firewall application can be generated by a test environment firewall submission module in the firewall automatic deployment system deployed on the server. The server can obtain the firewall application data uploaded by the staff through the interactive interface of the test environment firewall submission module in the firewall automatic deployment system. In the interactive interface, the staff can directly fill in information such as the source server name, destination server name, protocol type, destination port, etc. in the interactive page. Alternatively, the server can obtain an imported attachment through the interactive interface of the test environment firewall submission module in the firewall automatic deployment system. The server can automatically parse the information in the attachment and obtain the firewall application data from the attachment. The attachment also needs to include information such as the source server name, destination server name, protocol type, destination port information, etc.

[0091] After the server obtains the firewall application data, the server can store the firewall application data in Figure 1 The firewall application database of the basic data module shown is in the figure. The firewall application database can be a shared database in the firewall automatic deployment system. Any module in the firewall automatic deployment system can read and write data in the firewall application database. The staff member can be the application staff of the project team. The server can generate a firewall application based on the firewall application data.

[0092] S102: Generate a firewall policy based on the firewall application and the environment information, and automatically activate the firewall according to the firewall policy, wherein the environment information includes the correspondence between the server IP address and the server name.

[0093] In this embodiment, the server can obtain environmental information from the database. The environmental information can be stored in Figure 1 The technical data shown in the module database.

[0094] The environmental information may specifically include the correspondence between the server IP address and the server name. Since the environment of this application mainly includes a test environment and a production environment, the relationship library may include the correspondence between the server IP address of the test environment and the server name of the test environment, as well as the correspondence between the server IP address of the production environment and the server name of the production environment. The server can determine its corresponding server IP address from the environmental information based on the source server name and the destination server name in the firewall application. The server automatically associates the source server name with the server IP address. The server can also automatically associate the destination server name with the server IP address.

[0095] This environment information can also include firewall routing data. The server can generate a firewall policy based on the firewall application and this environment information. This firewall policy includes instructions for constructing a route from the source server to the destination server. Based on this firewall policy, the server can automatically activate the firewall when the change execution window is reached.

[0096] In one example, the process of generating a firewall policy may specifically include the following steps:

[0097] Step 1: The server can determine the source server IP address based on the source server name and the corresponding relationship between the server name and the server IP address in the environment information. The server can also determine the destination server IP address based on the destination server name and the corresponding relationship between the server name and the server IP address in the environment information.

[0098] Step 2: The server may determine a regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the firewall routing data in the environment information. The regional policy relationship may include a routing path determined between the source server IP address and the destination server IP address.

[0099] Step 3: The server can generate a firewall policy based on the regional policy relationship, protocol type, and destination port information. The firewall policy is used to instruct the server to perform the addition or deletion operations required to build the routing path between the source server IP address and the destination server IP address.

[0100] In one example, the environment of this application may specifically include a test environment and a production environment. Therefore, the environment information may specifically include test environment information and production environment information. For these two types of information, this step can be specifically divided into the following two steps:

[0101] Step 1: The server generates a test environment firewall policy based on the firewall application and test environment information, and automatically opens the firewall in the test environment according to the test environment firewall policy.

[0102] Step 2: The server generates a production environment firewall policy based on the firewall application and production environment information, and automatically activates the firewall in the production environment according to the production environment firewall policy.

[0103] The above two steps can correspond to the test environment firewall activation module and the production environment firewall activation module respectively. In these two steps, the specific steps of generating firewall policies and automatically activating the firewall can be as shown in the previous example. The difference between the two steps is mainly due to different environmental information.

[0104] S103: When verification confirms that the firewall is successfully activated, the firewall is deployed to the network of the production environment.

[0105] In this embodiment, before executing this step, the server may verify whether the firewall has been successfully activated. When the server determines that the firewall has been successfully activated, the server may determine that the firewall has been deployed in the network of the production environment. After the firewall is deployed in the production environment, the server may perform trial production according to a preset production process.

[0106] In one example, the specific process of the server verifying whether the firewall is successfully opened may include the following steps:

[0107] Step 1: The server can determine the source server IP address and the destination server IP address corresponding to the firewall application. The server can determine whether there is a routing path between the source server IP address and the destination server IP address based on the route matching between the source server IP address and the destination server IP address.

[0108] Step 2: When a routing path exists, the server can perform an interface comparison based on the destination port and protocol to determine whether the routing path between the source server IP address and the destination server IP address meets the requirements of the destination port and protocol.

[0109] Step 3: When the conditions are met, the server can determine that the firewall is successfully activated.

[0110] In one example, when verification determines that the firewall has failed to be enabled, the server may perform the following steps:

[0111] Step 4: The server can determine the routing information and interfaces of each server in the server cluster based on the environmental information. The server can construct the firewall topology diagram through static route matching and interface comparison. Since this application includes two server groups, the test environment and the production environment, the server needs to execute the test environment firewall verification module and the production environment firewall verification module to generate the firewall topology diagram based on their corresponding environmental information.

[0112] Step 5: The server can determine the corresponding source server IP address and destination server IP address based on the firewall application. The server can determine whether there is a connected routing path between the source server IP address and the destination server IP address based on the firewall topology diagram generated in step 4. If a connected routing path exists, the server can successfully activate the firewall. Otherwise, the server can regenerate the firewall policy based on the source server IP address, the destination server IP address, and the firewall topology diagram. This firewall policy is used to add or modify the route between the two servers so that the source server IP address and the destination server IP address can create a new connected routing path.

[0113] In one example, Figure 4 As shown in the figure, the server can also complete the activation and verification of the firewall according to the four steps of topology calculation, policy generation, policy review, and policy execution. The specific process includes:

[0114] Step 1: The server calculates the routing path between the source server IP address and the destination server IP address through topology calculation. The server first generates a topology diagram using routing calculation methods. This topology diagram records which firewalls are crossed between the source server IP address and the destination server IP address requested by the firewall. The server can store the corresponding detailed information in the firewall routing data. The topology calculation process specifically includes the following three steps:

[0115] Step 11: The server checks the firewall static routes to determine whether there is a matching route between the two server nodes in the cluster. If there is a matching route between the two server nodes, the server can continue to compare the interfaces of the two server nodes. Otherwise, if there is no matching route between the two server nodes, the server continues to query the firewall between other server nodes.

[0116] Step 12: If the interfaces between the two server nodes corresponding to the matched routes are the same, the server can add the firewalls corresponding to the two server nodes to the topology diagram. Otherwise, the server can compare other interfaces between the two server nodes.

[0117] Step 13: When all firewalls between two server nodes have been traversed, the server can input the two server nodes into the firewall topology map and construct a topological relationship between the two server nodes. The server can return to step 11 and perform the next cycle.

[0118] Step 2: In the policy generation step, the server can generate a corresponding firewall policy based on the newly submitted firewall application. During the policy generation process, the server can query the four elements of the user's firewall application, namely the source server name, destination server name, destination port, and protocol, on the firewall topology map in sequence. If there is a path in the firewall topology map that satisfies the existing firewall, it means that the firewall between the source server and the destination server of the firewall application is connected, and no policy needs to be added. Otherwise, if there is no path in the firewall topology map that satisfies the existing firewall, the server needs to generate a corresponding firewall policy. The firewall policy includes an action to generate a routing path. The action may include adding or modifying routes or interfaces between server nodes. Specifically, the server can generate corresponding action instructions according to the command format of the corresponding firewall. The set of action instructions constitutes the firewall policy.

[0119] Step 3: After generating the firewall policy, the server can send it to the corresponding environment maintenance personnel, who will manually review the firewall policy. After the review is completed, the server can mark the firewall application work order as approved.

[0120] Step 4: When the change execution window is reached, the server can automatically execute the firewall opening operation according to the firewall policy.

[0121] The automatic firewall deployment method provided in this application allows a server to obtain a firewall application. The firewall application includes the source server name, destination server name, protocol type, and destination port information. The server can obtain environmental information from a database. Based on the firewall application and this environmental information, the server can generate a firewall policy. Based on the firewall policy, the server automatically activates the firewall when the change execution time window is reached. The server can verify whether the firewall has been successfully activated. When the server determines that the firewall has been successfully activated, the server can determine that the firewall has been deployed in the production environment network. In this application, the automatic generation of the firewall policy and the automatic activation of the firewall improve the accuracy of firewall activation, effectively avoiding the problem of the activated firewall having too small or too large a range. This improved accuracy can improve the consistency of the firewall in the test environment and the production environment, thereby avoiding possible omissions in the handover from the test environment to the production environment and improving the effectiveness of the firewall testing in the test environment.

[0122] Figure 5 A flowchart of a method for automatically deploying a firewall provided by an embodiment of the present application is shown. Figures 1 to 4 Based on the embodiment shown, Figure 5 As shown, with the server as the execution subject, the method of this embodiment may include the following steps:

[0123] S201. Periodically maintain environmental information.

[0124] In this embodiment, the server can periodically maintain the environmental information of the cluster. The environmental information may include two parts: test environment information and production environment information. Among them, the test environment information mainly includes the corresponding relationship between the server IP address and server name of each test server in the cluster of the test environment. The production environment information mainly includes the corresponding relationship between the server IP address and server name of each production server in the cluster of the production environment. The server can periodically obtain the server IP address and server name of each server in the test environment and production environment. The server can add newly added server IP addresses and server names to the environmental information. The server can also delete deleted server IP addresses and server names from the environmental information. The server can also modify the corresponding relationship between the server IP addresses and server names that have been changed by the invention.

[0125] The cycle can be determined according to actual needs, for example, once a day, once a week, etc.

[0126] S202: Obtain a firewall application, which includes a source server name, a destination server name, a protocol type, and a destination port information.

[0127] S203: Generate a firewall policy based on the firewall application and environment information, and automatically activate the firewall according to the firewall policy.

[0128] S204: When verification confirms that the firewall is successfully activated, the firewall is deployed to the network of the production environment.

[0129] Among them, steps S202 to S204 are Figure 2 The implementation of steps S101 to S103 in the embodiment is similar and will not be repeated here in this embodiment.

[0130] The automatic firewall deployment method provided in this application allows the server to periodically maintain environmental information. The server can obtain a firewall application. The server can generate a firewall policy based on the firewall application and the environmental information. Based on the firewall policy, the server can automatically complete the activation of the firewall when the change execution time window is reached. The server can verify whether the firewall has been successfully activated. When the server determines that the firewall has been successfully activated, the server can determine that the firewall has been deployed in the network of the production environment. In this application, by periodically maintaining environmental information, the correspondence between the server IP address and the server name in the environmental information remains valid. The server can more conveniently obtain the server IP address corresponding to the server name based on the environmental information, without the need for the staff to provide the connection relationship between the server IP address and the IP addresses of each server in the cluster. This can reduce the type of data input by the staff, thereby improving work efficiency and user experience. At the same time, the use of this environmental information can also greatly improve the accuracy of the server in determining the server IP address based on the server name, and increase the speed at which the server generates firewall policies based on the source server IP address and the target server IP address.

[0131] Figure 6 FIG. 1 shows a schematic diagram of a firewall automatic deployment device provided by an embodiment of the present application. Figure 6 As shown, the automatic firewall deployment device 10 of this embodiment is used to implement the operations corresponding to the server in any of the above method embodiments. The automatic firewall deployment device 10 of this embodiment includes:

[0132] The acquisition module 11 is used to acquire a firewall application, which includes a source server name, a destination server name, a protocol type, and a destination port information.

[0133] The processing module 12 is used to generate a firewall policy based on the firewall application and the environment information, and automatically activate the firewall according to the firewall policy. When the firewall activation is successfully verified, the firewall is deployed to the network of the production environment.

[0134] The environment information includes the correspondence between the server IP address and the server name.

[0135] Optionally, the processing module 12 is specifically configured to:

[0136] Determine the source server IP address based on the source server name and environment information, and determine the destination server IP address based on the destination server name and environment information;

[0137] Determine the regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the environment information;

[0138] Generate firewall policies based on regional policy relationships, protocol types, and destination port information.

[0139] Optionally, the processing module 12 is specifically configured to:

[0140] Determine whether there is a routing path between the source server IP address and the destination server IP address based on the route matching result between the source server IP address and the destination server IP address;

[0141] When a routing path exists, the interface comparison of the routing path is performed based on the destination port and protocol to determine whether the routing path meets the requirements of the destination port and protocol;

[0142] When the conditions are met, it is determined that the firewall is activated successfully.

[0143] Optionally, the environment information includes test environment information and production environment information. The processing module 12 is specifically configured to:

[0144] Generate a test environment firewall policy based on the firewall application and test environment information, and automatically enable the firewall in the test environment based on the test environment firewall policy.

[0145] Generate production environment firewall policy based on firewall application and production environment information, and automatically activate firewall in production environment according to production environment firewall policy.

[0146] Optionally, when the verification determines that the firewall opening fails, the processing module 12 is further configured to:

[0147] Generate a firewall topology diagram based on environment information through firewall static route matching and interface comparison;

[0148] Regenerate the firewall policy based on the firewall application and firewall topology diagram. The firewall policy is used to add or modify the route between two servers.

[0149] Optionally, the processing module 12 is further configured to:

[0150] Periodically maintain environmental information.

[0151] The firewall automatic deployment device 10 provided in the embodiment of the present application can execute the above method embodiment. Its specific implementation principles and technical effects can be found in the above method embodiment, and this embodiment will not be repeated here.

[0152] Figure 7 FIG1 shows a hardware structure diagram of a server provided in an embodiment of the present application. Figure 7As shown, the server 20 is used to implement the operations corresponding to the server in any of the above method embodiments. The server 20 of this embodiment may include: a memory 21 and a processor 22.

[0153] Memory 21 is used to store computer programs. Memory 21 may include high-speed random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. It may also be a USB flash drive, a mobile hard drive, a read-only memory, a magnetic disk, or an optical disk.

[0154] Processor 22 is configured to execute the computer program stored in the memory to implement the automatic firewall deployment method in the above-described embodiment. For details, please refer to the relevant description in the above-described method embodiment. Processor 22 may be a central processing unit (CPU), or other general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0155] Optionally, the memory 21 may be independent or integrated with the processor 22 .

[0156] When the memory 21 is a device independent of the processor 22, the server 20 may further include a bus 23. The bus 23 is used to connect the memory 21 and the processor 22. The bus 23 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of presentation, the buses in the drawings of this application are not limited to only one bus or one type of bus.

[0157] The server provided in this embodiment can be used to execute the above-mentioned firewall automatic deployment method. Its implementation method and technical effects are similar and will not be described in detail in this embodiment.

[0158] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the methods provided in the various embodiments described above.

[0159] Among them, the computer-readable storage medium can be a computer storage medium or a communication medium. The communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The computer storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, a computer-readable storage medium is coupled to a processor so that the processor can read information from the computer-readable storage medium and write information to the computer-readable storage medium. Of course, the computer-readable storage medium can also be an integral part of the processor. The processor and the computer-readable storage medium can be located in an application-specific integrated circuit (ASIC). In addition, the ASIC can be located in a user device. Of course, the processor and the computer-readable storage medium can also exist in a communication device as discrete components.

[0160] Specifically, the computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0161] The present application also provides a computer program product, comprising a computer program stored in a computer-readable storage medium. At least one processor of a device can read the computer program from the computer-readable storage medium, and at least one processor executes the computer program so that the device implements the methods provided in the various embodiments described above.

[0162] An embodiment of the present application also provides a chip, which includes a memory and a processor, the memory is used to store computer programs, and the processor is used to call and run the computer programs from the memory, so that a device equipped with the chip executes the methods in various possible implementation modes as described above.

[0163] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0164] The modules may be physically separate, for example, installed in different locations on a single device, or installed on different devices, or distributed across multiple network units, or distributed across multiple processors. The modules may also be integrated, for example, installed in the same device, or integrated into a set of codes. The modules may exist in the form of hardware, or in the form of software, or may be implemented in the form of software plus hardware. The present application may select some or all of the modules according to actual needs to achieve the purpose of the present embodiment.

[0165] When each module is implemented as an integrated module in the form of a software function module, it can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform some steps of the methods of each embodiment of the present application.

[0166] It should be understood that, although the various steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they may be performed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but may be performed at different times, and their execution order is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of sub-steps or stages of other steps.

[0167] Finally, it should be noted that the above embodiments are intended only to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the aforementioned embodiments, those skilled in the art will appreciate that they may modify the technical solutions described in the aforementioned embodiments or replace some or all of the technical features therein with equivalents. However, such modifications or replacements do not deviate from the essence of the corresponding technical solutions within the scope of the various embodiments of this application.

Claims

1. A method for automatic deployment of a firewall, characterized in that: The method comprises: Obtaining a firewall application, wherein the firewall application includes a source server name, a destination server name, a protocol type, and a destination port information; wherein the firewall application data is uploaded by a user; Determine the source server IP address based on the source server name and the environment information, and determine the destination server IP address based on the destination server name and the environment information; Determining a regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the environment information; wherein the regional policy relationship is a routing path determined between the source server IP address and the destination server IP address; Generate a firewall policy according to the regional policy relationship, the protocol type, and the destination port information; When verification confirms that the firewall is successfully opened, deploying the firewall to the network of the production environment; The environment information includes the correspondence between the server IP address and the server name and the routing data of the firewall; When verification determines that the firewall fails to be opened, the method further includes: Determine the routing information and interfaces of each server based on the environmental information, and generate a firewall topology diagram through firewall static routing matching and interface comparison; Regenerate a firewall policy based on the firewall application and the firewall topology diagram, wherein the firewall policy is used to add or modify a route between two servers; Periodically obtain the server IP address and server name of each server in the test environment and the production environment; add the newly added server IP address and server name to the environment information; delete the deleted server IP address and server name from the environment information; modify the correspondence between the changed server IP address and server name.

2. The method according to claim 1, characterized in that The verification confirming that the firewall is successfully opened specifically includes: Determine whether there is a routing path between the source server IP address and the destination server IP address based on a routing match result between the source server IP address and the destination server IP address; When the routing path exists, performing interface comparison on the routing path according to the destination port and the protocol to determine whether the routing path meets the requirements of the destination port and the protocol; When the conditions are met, it is determined that the firewall is opened successfully.

3. The method according to any one of claims 1 to 2, characterized in that The environmental information includes test environment information and production environment information; generating a firewall policy based on the firewall application and the environmental information, and automatically opening the firewall according to the firewall policy, specifically includes: Generate a test environment firewall policy based on the firewall application and the test environment information, and automatically activate the firewall in the test environment according to the test environment firewall policy; A production environment firewall policy is generated based on the firewall application and the production environment information, and the firewall is automatically opened in the production environment according to the production environment firewall policy.

4. A firewall automatic deployment device, characterized in that: The device comprises: An acquisition module is used to acquire a firewall application, wherein the firewall application includes a source server name, a destination server name, a protocol type, and a destination port information; wherein the firewall application data is uploaded by a user; a processing module configured to determine a source server IP address based on the source server name and the environment information, and determine a destination server IP address based on the destination server name and the environment information; determine a regional policy relationship between the source server IP address and the destination server IP address based on the source server IP address, the destination server IP address, and the environment information; wherein the regional policy relationship is a routing path determined between the source server IP address and the destination server IP address; generate a firewall policy based on the regional policy relationship, the protocol type, and the destination port information; and when verification determines that the firewall is successfully activated, deploy the firewall to a network in a production environment; The environment information includes the correspondence between the server IP address and the server name; The processing module is further configured to determine the routing information and interfaces of each server based on the environmental information, generate a firewall topology diagram through firewall static routing matching and interface comparison, and regenerate a firewall policy based on the firewall application and the firewall topology diagram, wherein the firewall policy is used to add or modify a route between two servers; The processing module is also used to periodically obtain the server IP address and server name of each server in the test environment and the production environment; add the newly added server IP address and server name to the environmental information; delete the deleted server IP address and server name from the environmental information; and modify the correspondence between the changed server IP address and server name.

5. A server, characterized in that: The server includes: a memory and a processor; the memory is used to store a computer program; the processor is used to implement the firewall automatic deployment method according to any one of claims 1 to 3 according to the computer program stored in the memory.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, is used to implement the firewall automatic deployment method according to any one of claims 1 to 3.

7. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the firewall automatic deployment method according to any one of claims 1 to 3 is implemented.

Images