A firewall automatic operation and maintenance method, system, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a method, system, electronic device and storage medium for automatic operation and maintenance of a firewall. The method includes: obtaining pre-configured firewall demand information and firewall configuration information corresponding to each firewall in a target network topology, generating a first firewall configuration file corresponding to the target network topology according to the firewall configuration information, and decomposing the firewall demand information to the firewalls in the network path corresponding to the target network topology according to the first firewall configuration file. In the embodiment of the present invention, the first firewall configuration file corresponding to the target network topology is generated through the firewall configuration information, and the firewall demand information is automatically decomposed to the firewalls in the network path corresponding to the target network topology according to the first firewall configuration file, thereby ensuring that the workload of the operation and maintenance personnel is reduced, and providing the firewall to the user in the form of a service.

Description

Technical Field

[0001] The present invention relates to the field of automated operation and maintenance technology, and in particular to a firewall automated operation and maintenance method, system, electronic equipment and storage medium. Background Art

[0002] Firewalls are an important part of modern network security technology, which can filter information and ensure the security of information. Data centers carry the core business of enterprises and store massive amounts of business data. They are key resources for the normal production and operation of enterprises. Therefore, the network security of data centers is particularly important. In order to improve the security protection capabilities of data centers, data center networks are generally divided into different areas according to the functions and data sensitivity. Hardware firewalls are deployed between areas as a security barrier to resist network attacks, effectively reducing security risks such as data leakage, malicious attacks and illegal authorization.

[0003] In the existing technology, as the IT architecture of enterprises becomes increasingly large, the network areas of data centers are also increasing, and the work of firewall operation and maintenance is increasing. In complex network scenarios, manual operation and maintenance of firewalls can no longer meet the current work of data center operation and maintenance. Faced with the dilemma of firewall operation and maintenance, the operation and maintenance of data center firewalls has evolved from manual operation and maintenance to automated operation and maintenance, which has greatly alleviated the workload of operation and maintenance personnel. Most firewall automated operation and maintenance are scripted and fragmented. These operation and maintenance scripts do not reduce the workload of operation and maintenance personnel, and the code quality cannot be guaranteed, and cannot be provided to users in the form of services. Summary of the invention

[0004] In view of this, the present invention provides a firewall automatic operation and maintenance method, system, electronic device and storage medium, which realizes providing the firewall to users in the form of service while ensuring that the workload of operation and maintenance personnel is reduced.

[0005] According to one aspect of the present invention, an embodiment of the present invention provides a firewall automatic operation and maintenance method, the method comprising:

[0006] Obtaining pre-configured firewall requirement information and firewall configuration information corresponding to each firewall in the target network topology;

[0007] Generate a first firewall configuration file corresponding to the target network topology according to the firewall configuration information;

[0008] The firewall requirement information is decomposed into firewalls in a network path corresponding to the target network topology according to the first firewall configuration file.

[0009] According to another aspect of the present invention, an embodiment of the present invention further provides a firewall automatic operation and maintenance system, the system comprising:

[0010] The path analysis module is used to decompose the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the firewall requirement information and the firewall configuration information corresponding to each firewall in the target network topology;

[0011] The policy adaptation module is used to convert each firewall policy corresponding to the firewall requirement information into a corresponding second firewall configuration file;

[0012] The configuration parsing module is used to perform reverse parsing on the second firewall configuration file to obtain corresponding newly added fields, and add the newly added fields to the corresponding policy standard table.

[0013] According to another aspect of the present invention, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the firewall automatic operation and maintenance method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the firewall automatic operation and maintenance method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention generates a first firewall configuration file corresponding to the target network topology through firewall configuration information, and automatically decomposes the firewall demand information to the firewall in the network path corresponding to the target network topology according to the first firewall configuration file. On the basis of ensuring that the workload of operation and maintenance personnel is reduced, the firewall is provided to users in the form of a service.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flowchart of a firewall automatic operation and maintenance method provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of converting user requirements into configuration files that can be recognized by each firewall respectively, provided in one embodiment of the present invention;

[0023] Figure 3 A flowchart of another firewall automatic operation and maintenance method provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of a structure of a flow description format using a network topology description provided by an embodiment of the present invention;

[0025] Figure 5 A structural block diagram of a firewall automatic operation and maintenance system provided by an embodiment of the present invention;

[0026] Figure 6 A structural block diagram of another firewall automatic operation and maintenance system provided by an embodiment of the present invention;

[0027] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the term "first" etc. in the specification and claims of the present invention and the above-mentioned drawings is used to distinguish similar objects, and is not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] In one embodiment, Figure 1 A flowchart of a firewall automatic operation and maintenance method provided for an embodiment of the present invention. This embodiment can be applied to the situation of automatic operation and maintenance of firewalls in complex network scenarios. The method can be executed by a firewall automatic operation and maintenance system. The firewall automatic operation and maintenance system can be implemented in the form of hardware and / or software. The firewall automatic operation and maintenance system can be configured in an electronic device.

[0031] like Figure 1 As shown, the specific steps include:

[0032] S110: Obtain pre-configured firewall requirement information and firewall configuration information corresponding to each firewall in the target network topology.

[0033] The firewall requirement information may be understood as firewall requirements that are set as needed and may be manually configured.

[0034] In this embodiment, the firewall requirement information may include but is not limited to the source address segment, the destination address segment, the protocol and the port. For example, the firewall requirement information is 10.1.1.2->10.1.2.1TCP / 80, where 10.1.1.2 represents the source address segment, 10.1.2.1 represents the destination address segment, the Transmission Control Protocol (TCP), and the port is 80.

[0035] In this embodiment, the firewall configuration information includes at least: source security domain, target security domain, source address segment and target address segment. It should be noted that the source security domain can describe the starting network area of ​​the wall-penetrating traffic; the target security domain can describe the target network area of ​​the wall-penetrating traffic; the source address segment describes the address segment range of the starting network area of ​​the wall-penetrating traffic; the target address segment can describe the address segment range of the target network area of ​​the wall-penetrating traffic. Of course, there are many forms of traffic passing through the firewall. It can be traffic that reaches the firewall, which can be understood as only being processed by the firewall itself when it reaches the firewall and not forwarded out. There is also a kind of wall-penetrating traffic, which can be understood as accessing 1 to 2 and being forwarded by the firewall after reaching the firewall, which is the wall-penetrating traffic.

[0036] In this embodiment, the end-to-end firewall requirements are decomposed into each firewall node on the network path. The target network topology may include multiple firewalls, in addition to switches, physical channels, etc. Each firewall in the network topology corresponds to the corresponding firewall requirement configuration information and firewall configuration information.

[0037] S120. Generate a first firewall configuration file corresponding to the target network topology according to the firewall configuration information.

[0038] Among them, the first firewall configuration file refers to the specific information corresponding to the traffic model composed of the data flow on the firewall. The information can be stored in the form of a dictionary in a JSON format configuration file or in other forms, which is not limited in this embodiment.

[0039] In this embodiment, the first firewall configuration file may include but is not limited to the priority, source security domain, target security zone, source address segment, and target address segment corresponding to each firewall in the target network topology. It can be understood that the four elements of source security domain, target security zone, source address segment, and target address segment jointly describe the flow of traffic on different firewalls.

[0040] In this embodiment, the source security domain, target security domain, source address segment and target address segment in the firewall configuration information can be used to describe the flow of traffic on each firewall to obtain the corresponding data flow direction. According to the data flow direction of each firewall, a corresponding traffic model can be formed, and the traffic model and firewall configuration information are stored in a configuration file in JSON format.

[0041] S130. Decompose the firewall requirement information into firewalls in the network path corresponding to the target network topology according to the first firewall configuration file.

[0042] In this embodiment, each firewall in the target network topology contains a corresponding routing table. When traffic flows on the firewall, the traffic can be forwarded according to the routing table on the firewall. It can be understood that the transmission interface of the traffic and the corresponding flow direction can be known based on the routing table.

[0043] In this embodiment, the source address segment and the destination address segment in the firewall requirement information and the source address segment and the destination address segment in the first firewall configuration file can be compared to jointly determine at least one firewall and data flow direction corresponding to the firewall requirement information based on the comparison result of the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and the comparison result of the destination address segment in the firewall requirement information and the destination address segment in the first firewall configuration file.

[0044] The technical solution of the embodiment of the present invention generates a first firewall configuration file corresponding to the target network topology through firewall configuration information, decomposes the firewall demand information to the firewall in the network path corresponding to the target network topology according to the first firewall configuration file, reduces the work of operation and maintenance personnel, and provides it to users in the form of services to achieve full life management of the firewall. .

[0045] In one embodiment, after decomposing the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the firewall configuration file, the method further includes:

[0046] Obtain at least two corresponding firewall policies according to the firewall requirement information;

[0047] Convert each firewall policy to obtain the corresponding policy standard table;

[0048] The policy standard table is converted to obtain a corresponding second firewall configuration file; wherein the firewall supports identification of the second firewall configuration file and cannot identify the policy standard table.

[0049] Among them, the firewall policy can control the traffic according to the source Internet Protocol (IP) address, source port, destination IP address, destination port and transport layer protocol. In addition to the source IP address, source port, destination IP address, destination port and transport layer protocol, the basic elements of the firewall policy may also include some other attributes designed by humans.

[0050] In this embodiment, the policy standard table can be understood as a policy standardization table. The field information that can be included in the policy standardization table can be field information involved in the life cycle management of the firewall, or some field information included in the firewall itself, and can also include related field information required by other firewalls. It should be noted that the policy standard table is a unified standardized form. For firewall manufacturers, some support the policy standard table, while others may not support it, so it needs to be converted into a configuration file that can be recognized by firewalls of different manufacturers.

[0051] In this embodiment, in order to facilitate the unified full life cycle management of firewall policies of different brands and models, a standardized table form of firewall policies is given and stored in the database in the form of a table. The field information that the standardized form in this embodiment can contain is source security zone, source server IP, source server network address translation (Network Address Translation, NAT), destination security zone, destination server IP, destination server NAT, protocol and access port, policy identifier (IDentity, ID), policy description, policy rules, policy hit count, policy effective time, policy expiration time, status and demand identifier.

[0052] In this embodiment, the second firewall configuration file refers to some configuration files of the firewall itself, and the firewall in the network path corresponding to the target network topology can control the traffic through the second firewall configuration file. It should be noted that the policy standard table and the second firewall configuration file, that is, the configuration file of the firewall itself, are different. The firewall cannot directly recognize the policy standard table, and needs to convert the policy standard table into a configuration file that the firewall can recognize, that is, the second firewall configuration file that the firewall can recognize.

[0053] In this embodiment, at least two corresponding firewall policies can be obtained based on the firewall demand information, and each firewall policy can be converted through a policy adapter to obtain a corresponding policy standard table, and then the policy standard table can be converted to obtain a corresponding second firewall configuration file. It can be understood that a unified standardized policy form table is converted into a configuration file that can be recognized by firewalls of different manufacturers through a policy adapter. In this embodiment, when different firewalls convert the policy standard table into the second firewall configuration file, the conversion method of different firewalls is generally different. It is necessary to convert the policy standard table into a firewall configuration file that can be recognized by the firewall. For example, firewall 1 is converted into a configuration file that can be recognized by the firewall through method 1, and firewall 2 is converted into a configuration file that can be recognized by the firewall through method 2, and so on.

[0054] In one embodiment, each firewall policy is converted to obtain a corresponding policy standard table, including:

[0055] Identify the target field in each firewall policy;

[0056] Combine the target fields to generate the corresponding strategy standard table.

[0057] The target field refers to the relevant field information contained in the table that forms the standardized form of the firewall policy.

[0058] In some embodiments, the target field in each firewall policy in the network path corresponding to the target network topology can be identified, and the target fields can be combined to generate a corresponding policy standard table. It should be noted that the target field includes at least one of the following: policy identification; policy rules; number of policy hits; policy effective time; policy expiration time; current state of the firewall policy; requirement identification, in addition to which, it can also include policy description, source security zone, source server IP, source server NAT, destination security zone, destination server IP, destination server NAT, protocol and access port, etc. It should be noted that the policy description contained in the target field must include the requirement identifier and policy effective time information so that the policy and requirement can be associated during configuration analysis; the number of policy hits is used to monitor the firewall policy and prepare data for policy recovery and optimization; the policy effective time and policy expiration time provide the data basis for the full life cycle management of the firewall policy; the source server NAT and the destination server NAT strongly associate the firewall security policy with the NAT policy to facilitate operation and maintenance troubleshooting and resource cascade recovery; the firewall policy has three states: activated, invalid, and disabled, which are used for temporary management of the firewall policy; the requirement identifier strongly associates the firewall policy resources with the requirements and is used to obtain the resource organization information of the policy; the source security zone, source server IP, destination security zone, destination server IP, protocol and access port, policy rules, and policy identifier are necessary elements for opening the firewall security policy, and the IP address is standardized in CIRD format.

[0059] In one embodiment, the method further includes:

[0060] Reversely parse the second firewall configuration file to obtain the corresponding newly added fields;

[0061] Add the newly added fields to the corresponding policy criteria table.

[0062] Among them, the newly added fields can be understood as related field information manually added by the user.

[0063] In this embodiment, since user needs can be automated or added manually, the manually added configuration also needs to be registered in the policy standard table. At this time, the second firewall configuration file needs to be reversely parsed into the policy standard table through the configuration parser.

[0064] In one embodiment, in order to better understand the firewall requirements, the firewall requirements are converted into configuration files that can be recognized by each firewall. Figure 2 A schematic diagram of converting user requirements into configuration files that can be recognized by each firewall is provided for one embodiment of the present invention. In this embodiment, a mapping between a policy standard table and a second firewall configuration file is established through a policy adapter and a configuration parser (based on textflow), and the management of the firewall policy is indirectly achieved through the management of the policy standard table, thereby shielding the user from the complexity of the firewall brand and model.

[0065] In one embodiment, Figure 3 A flowchart of another firewall automatic operation and maintenance method provided for an embodiment of the present invention. Based on the above embodiments, this embodiment further refines the generation of a first firewall configuration file corresponding to the target network topology according to the firewall configuration information, and the decomposition of the firewall demand information to the firewall in the network path corresponding to the target network topology according to the first firewall configuration file.

[0066] like Figure 3 As shown, the firewall automatic operation and maintenance method in this embodiment may specifically include the following steps:

[0067] S310: Obtain pre-configured firewall requirement information and firewall configuration information corresponding to each firewall in the target network topology.

[0068] S320. Use the firewall configuration information to describe the flow of traffic on each firewall to obtain the corresponding data flow direction.

[0069] In this embodiment, based on the source security domain, target security zone, source address segment, and target address segment in the firewall configuration information, the flow of traffic on each firewall in the target network topology is described together, and the data flow direction on each firewall can be determined by the traffic flow.

[0070] S330. According to the data flow direction of each firewall, a corresponding traffic model is formed.

[0071] In this embodiment, after obtaining the data flow direction of each firewall, a corresponding traffic model can be formed according to the data flow direction of each firewall in the target network topology. It should be noted that the firewall automation operation and maintenance is centered on the firewall, so other devices in the traffic model, such as switches, load balancers, routers, etc., are ignored, and only the firewall is described for the corresponding traffic.

[0072] S340: Store the traffic model and firewall configuration information in a configuration file in JSON format to obtain a corresponding first firewall configuration file.

[0073] In this embodiment, the data flow direction of each firewall constitutes a corresponding traffic model, and the content of the traffic model includes but is not limited to the priority, source security domain, target security zone, source address segment, and target address segment corresponding to each firewall in the target network topology, and is finally stored in a configuration file in JSON format in the form of a dictionary to obtain the corresponding first firewall configuration file. Exemplarily, FW3 represents firewall 3, srcZone represents the source security domain, dstZone represents the target security zone, and srcIp represents the source address segment "FW3":{"priority1":[{"srcZone":"Inside","dstZone":"Outside","srcIp":["10.1.3.0 / 24"],"dstIp":["10.1.2.0 / 24"]}}, and the traffic form of the firewall is finally stored in a configuration file in JSON format in the form of a dictionary.

[0074] S350. Determine the comparison result between the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and the comparison result between the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file, as the corresponding first comparison result and second comparison result.

[0075] The first comparison result refers to the result of comparing the source address segment in the firewall requirement information with the source address segment in the first firewall configuration file. The second comparison result refers to the result of comparing the target address segment in the firewall requirement information with the target address segment in the first firewall configuration file.

[0076] In this embodiment, the source address segment and the destination address segment corresponding to each firewall are determined from the firewall requirement information, and the source address segment and the destination address segment corresponding to each firewall in the target network topology are determined from the first firewall configuration file, the source address segment corresponding to each firewall in the firewall requirement information is compared with the source address segment corresponding to each firewall in the first firewall configuration file, and the destination address segment in the firewall requirement information is compared with the destination address segment in the first firewall configuration file. When the source address segment corresponding to each firewall in the firewall requirement information and the source address segment corresponding to each firewall in the first firewall configuration file belong to the same address segment, or the source address segment corresponding to the firewall in the firewall requirement information is The segment is a subset of the source address segment corresponding to each firewall in the first firewall configuration file. It can be considered that the source address segments corresponding to the two can be matched. Similarly, when the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file belong to the same address segment, or when the target address segment in the firewall requirement information is a subset of the target address segment in the first firewall configuration file, it is considered that the target address segments corresponding to the two can be matched. Only when the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file can be matched, and the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file can be matched, can the final result be determined to be a successful match.

[0077] For example, the source address segment in the firewall requirement information is 10.1.1.2, the destination address segment in the firewall requirement information is 10.1.3.1, the source address segment in the first firewall configuration file includes firewall 1 as 10.1.1.0 and firewall 2 as 10.1.1.0; the destination address segment in the first firewall configuration file includes firewall 2 as 10.1.3.0 and firewall 1 as 10.1.2.0; it can be seen that the source address segment in the first firewall configuration file includes firewall 1 as 10.1.1.0 and firewall 2 as 10.1.1.0, which are consistent with the firewall The source address segment 10.1.1.2 in the requirement information belongs to the same address segment, and the source address segment can be matched. The target address segment in the first firewall configuration file is 10.1.3.0 for firewall 2 and 10.1.2.0 for firewall 1. Among them, the target address segment 10.1.2.1 in the firewall requirement information is in the same address segment as firewall 2, which is 10.1.3.0. In summary, the source address segment in the firewall requirement information and the source address segment corresponding to firewall 2, as well as the target address segment in the firewall requirement information and the target address segment corresponding to firewall 2 can all be matched.

[0078] S360. Determine the target firewall and data flow direction corresponding to the firewall requirement information according to the first comparison result and the second comparison result.

[0079] The target firewall is at least one firewall in the network path corresponding to the target network topology.

[0080] In this embodiment, based on the first comparison result between the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and the second comparison result between the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file, the target firewall and the data flow direction corresponding to the firewall requirement information can be determined. Exemplarily, when the source address segment in the firewall requirement information and the source address segment corresponding to firewall 2, and the target address segment in the firewall requirement information and the target address segment corresponding to firewall 2 can all match, it can be determined that the source address segment and the target address segment in the firewall requirement information only pass through firewall 2, and the flow direction of the traffic on the firewall is from Inside1 to Inside2.

[0081] The above technical solution of this embodiment forms a corresponding traffic model through the data flow direction of each firewall, stores the traffic model and the firewall configuration information in a configuration file in JSON format, obtains the corresponding first firewall configuration file, and respectively determines the comparison result between the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and the comparison result between the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file. According to the above comparison results, the target firewall and the data flow direction corresponding to the firewall requirement information are determined, so that when the topology of the traffic model changes, only a small amount of configuration modification is required to meet the new requirements without modifying other business logic codes, and the requirements can be decomposed into each firewall on the network path, and the information required for opening the firewall policy is obtained.

[0082] In one embodiment, to facilitate a better understanding of the firewall automatic operation and maintenance method, Figure 4 A structural diagram of a flow description format using a network topology is provided for one embodiment of the present invention. This embodiment can be used as a preferred embodiment to further illustrate the automatic operation and maintenance method of a firewall. Figure 4 The network devices included are LAN switch (LanSWitch, LSW), customer edge device (Customer Edge, CE) and 3 firewalls (FireWall, FW).

[0083] like Figure 4 As shown in the figure, the pre-configured firewall requirement information is 10.1.1.2->10.1.3.1TCP / 80, where 10.1.1.2 represents the source address segment and 10.1.3.1 represents the destination address segment. The security zones and corresponding address segments of each firewall are as follows: Figure 4As shown in the figure, the network path of LSW2<->LSW1 is LSW2-FW2-CE1-FW1-LSW1, the network path of LSW2<->LSW3 is LSW2-FW2-CE1-FW3-LSW3, and the network path of LSW1<->LSW3 is LSW1-FW2-LSW3. The traffic model is described using the description form of the firewall. The result of firewall 1 is as follows: "FW1":{"priority1":[{"srcZone":"Inside","dstZone":"Outside","srcIp":["10.1.1.0 / 24"],"dstIp":["10.1.2.0 / 24"]}]}.

[0084] In this embodiment, the source address segment and the destination address segment in the firewall requirement information are compared with the source address segment and the destination address segment in the first firewall configuration file, respectively. According to the firewall requirement information 10.1.1.2->10.1.3.1, the source address segment and the destination address segment in the first firewall configuration file are compared. Since 10.1.1.2 is the source address segment in the firewall requirement information, 10.1.3.1 represents the destination address segment in the firewall requirement information, such as Figure 4 In the figure, the source address segment corresponding to firewall 1 (FW1) is 10.1.1.0 / 24 (inside), and the destination address segment is 10.1.2.0 / 24 (outside); the source address segment corresponding to firewall 2 (FW2) is 10.1.1.0 / 24 (inside1), and the destination address segment is 10.1.3.0 / 24 (inside2); the source address segment corresponding to firewall 3 (FW3) is 10.1.3.0 / 24 (inside), and the destination address segment is 10.1.2.0 / 24 (outside). After comparison, it can be seen that the addresses with matching source address segments are firewall 1 and firewall 2; the addresses with matching destination address segments are firewall 3 and firewall 2. Since both the source address segment and the destination address segment need to match, it can be determined that the traffic only passes through FW2, and the direction of traffic on this firewall is from Inside1 to Inside2.

[0085] In one embodiment, Figure 5 This is a structural block diagram of a firewall automatic operation and maintenance system provided in an embodiment of the present invention, which can be configured in an electronic device to implement a firewall automatic operation and maintenance method in an embodiment of the present invention. The relevant terms in this embodiment, such as firewall demand information, firewall configuration information, etc., have been explained in the above embodiments, and will not be explained in this embodiment.

[0086] like Figure 5As shown in the figure, the firewall automatic operation and maintenance system is divided into three layers, namely the aggregation service layer, the basic service layer, and the storage layer. The firewall is managed through the configuration delivery service and configuration query service in the third-party service. The storage layer is used to store the data of the entire system, and the storage methods include database storage and file storage; the basic service layer is used to provide basic core services and public services; the aggregation service layer aggregates and cuts the basic services of the lower layer for direct interaction with users.

[0087] Among them, the basic service layer includes: path analysis module, policy adaptation module and configuration parsing module;

[0088] The path analysis module is used to decompose the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the firewall requirement information and the firewall configuration information corresponding to each firewall in the target network topology;

[0089] The policy adaptation module is used to convert each firewall policy corresponding to the firewall requirement information into a corresponding second firewall configuration file;

[0090] The configuration parsing module is used to perform reverse parsing on the second firewall configuration file to obtain corresponding newly added fields, and add the newly added fields to the corresponding policy standard table.

[0091] The embodiment of the present invention can reduce the workload of operation and maintenance personnel through the above technical solution, and provide it to users in the form of a service to achieve full life cycle management of the firewall.

[0092] In one embodiment, the system further includes: a policy query module and a policy analysis module;

[0093] The policy query module is used to query each of the firewall policies to obtain corresponding firewall configuration information;

[0094] The policy analysis module is used to compare each firewall policy with the policy in the target database, and execute the corresponding application abandonment operation, policy merging operation or policy splitting operation according to the comparison result.

[0095] In one embodiment, the system further includes: a resource monitoring module, a resource allocation module, a resource recovery module and a resource query module;

[0096] The resource monitoring module is used to regularly monitor the number of policy hits in the firewall policy and store the monitored number of policy hits in a database;

[0097] The resource allocation module is used to automatically allocate NAT addresses and generate policy identifiers;

[0098] The resource recovery module is used to recover the NAT address and policy identifier;

[0099] The resource query module is used to query the allocation of NAT addresses, the use of policy identifiers, address group members, address pool members and routing tables.

[0100] In one embodiment, the system further includes: a change verification module; the change verification module is used to compare the second firewall configuration file corresponding to the applied firewall policy with the current firewall configuration file to determine the firewall policy change according to the comparison result.

[0101] The firewall automatic operation and maintenance system provided in the embodiment of the present invention can execute the firewall automatic operation and maintenance method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0102] In one embodiment, Figure 6 A structural block diagram of another firewall automatic operation and maintenance system provided by an embodiment of the present invention is shown in FIG. Figure 6 As shown, the firewall automatic operation and maintenance system is divided into a three-layer structure, namely, the aggregation service layer, the basic service layer, and the storage layer. The firewall is managed through the configuration delivery service and the configuration query service in the third-party service. The path analysis service in this embodiment is represented by the path analysis module in the above embodiment, the policy adaptation service is represented by the policy adaptation module in the above embodiment, the configuration parsing service is represented by the configuration parsing service module in the above embodiment, the policy query service is represented by the policy query module in the above embodiment, the policy analysis service is represented by the policy analysis module in the above embodiment, the resource monitoring service is represented by the resource monitoring module in the above embodiment, the resource allocation service is represented by the resource allocation module in the above embodiment, the resource recovery service is represented by the module in the above embodiment, and the resource query is represented by the resource recovery module in the above embodiment, and the change verification service is represented by the change verification module in the above embodiment.

[0103] In this embodiment, the storage layer is used to store the data of the entire system. The storage method includes database storage and file storage. The stored data includes firewall policy standardization records, demand processing process, firewall basic information, firewall resource registration, demand registration, operation log, and user records. In this embodiment, the storage layer mainly includes firewall policy standardization records, demand processing process, firewall basic information, firewall resource registration, demand registration, operation log, and user records. Among them, the firewall policy standardization record is mainly a firewall policy standardized form presented in a table and stored in the database. The table fields include source security zone, source address, destination security zone, destination address, protocol and port, etc. The demand processing process mainly includes the system generating intermediate files when processing user requests. These intermediate files are stored in the database and record the requester information, request processing time, request issuance time, etc. Firewall basic information: stored in a single table in the database, mainly used for configuration issuance, including name, manufacturer, model, out-of-band address, group, master and backup status, and policy identification usage. Firewall resource registration mainly includes resources such as NAT address, address group, address pool, routing table, etc., which are stored in the database table. Demand registration: The original firewall policy requirements are formatted and stored in the database for association with the existing network firewall policy. Operation log records the operation log of the system, which is stored on the local disk and is kept for up to 100 days. User record: Mainly registers user accounts, passwords, permissions, etc. for user authentication.

[0104] In this embodiment, the basic service layer is used to provide basic core services and public services. The service layer includes user management services, request processing services, path analysis services, policy adaptation services, policy query services, policy analysis services, resource monitoring services, resource allocation services, resource recovery services, resource query services, change verification services, log management services, configuration analysis services, change monitoring services, and email alert services. The service is designed in a hierarchical structure, in which the data access layer is used to provide each service module with operations on the database or call third-party services; the interface service layer is the interface provided by each module to the outside world, which is used to provide services to the outside world; the business logic layer is the main body of the service module, which performs logical processing according to the service request.

[0105] In this embodiment, the path analysis service: according to the source and destination addresses and network area information in the firewall demand information, through the firewall-centered network topology, automatically analyzes the firewall information on the network path (including firewall group information, source and destination security domains of the through-wall traffic, whether NAT conversion is required, and whether static routes need to be added), thereby decomposing the end-to-end service into the firewall nodes passed by the network path. Policy adaptation service: converts the policy standardized form (policy standard table) into the corresponding second firewall configuration file, shielding the differences in firewall wall brands and models for operation and maintenance personnel. In addition, this service provides the following aspects of demand conversion for firewall configuration: security policy addition (converting the table into some configurations added to the security policy), security policy deletion, NAT policy addition, NAT policy deletion, static route addition, static route deletion, priority adjustment, address group creation, address pool creation, service book creation. Policy query service: This module provides a five-tuple query method for firewall policies. Any four tuples in the five-tuple content can be empty. This query method does not use string matching, but uses set intersection matching. This method is more in line with the needs of operation and maintenance personnel. When querying 1.1.1.1 to access port 80 of 2.2.2.2 using TCP protocol, the 1.1.1.0 / 28 to 2.2.2.0 / 28tcp / 80 security policy can be matched. If the string matching method is used, the policy cannot be located. Configuration parsing service: This service provides the function of semi-structured parsing of existing network configuration files through textflow templates and combining them into a standardized form of policies. First, address groups, address pools, routing tables and other resources are parsed, and then security policies and NAT policies are parsed.

[0106] In this embodiment, user management service: based on the user record table in the database, it provides services such as user creation, deletion, authority management, and user authentication. Request processing service: receiving a policy task request sent by at least one requester, and when the policy task request is in the approved state, it decides whether to process the corresponding request according to the operation of the existing system. If not, it returns an error state. If it is processed, it formats the registration requirement. Policy analysis module: this service provides automatic analysis and processing of the applied firewall policy. The analysis and processing steps are as follows: the applied policy is compared with the standardized form of the policy stored in the database. If it is already included in the database, the application of the business is abandoned. If there is a redundant relationship, it is merged with the existing policy. If there is an intersection relationship, the applied policy is split. Resource monitoring service: this module mainly provides timed monitoring of the number of firewall policy hits and stores it in the database. Resource allocation service: it provides automatic allocation of NAT addresses and policy identifier generation functions, which can be expanded according to the scenario. Resource recycling service: it provides NAT address recycling and policy identifier recycling functions, which can be expanded according to the scenario. Resource query service: provides query on NAT address allocation, policy identifier usage, address group members, address pool members, and routing table. Change verification service: compares the configuration file corresponding to the applied policy with the existing network configuration of the firewall. If the content of the configuration file exists in the existing network configuration, the firewall policy change is successful. Log management service module: mainly provides query, export and deletion operations on the system log, operation log, operation log, etc. Change monitoring service module: monitors changes involving the firewall, including policy identifier monitoring, routing conflict monitoring, important system resource recovery monitoring, etc., which can be expanded according to the scenario. Email alarm service module: through this module, alarm information can be sent to network operation and maintenance personnel via email.

[0107] In this embodiment, the aggregation service layer aggregates and cuts the underlying basic services for direct interaction with users. The service layer mainly provides policy application, policy recovery, policy modification, policy query, and network path query services. Among them, policy application service: This service provides users with security policy application services through a combination of request processing service, path analysis service, policy adaptation service, policy analysis service, resource allocation service, change verification service, log management service, change monitoring service, and email alert service. Policy recovery service: Provide users with security policy and related resource recovery services through a combination of request processing service, path analysis service, policy adaptation service, policy analysis service, resource recovery service, change verification service, log management service, change monitoring service, and email alert service. Policy modification: Provide users with security policy and related resource recovery services through a combination of request processing service, path analysis service, policy adaptation service, policy analysis service, resource allocation, resource recovery service, change verification service, log management service, change monitoring service, and email alert service. Policy query service: Provide security policy query and activation status services to users through request processing module, path analysis module, resource query module and policy query service. Network path query: Provide network path query to users through request processing service and path analysis service. Through this module, users can judge whether they need to activate relevant firewalls.

[0108] In one embodiment, Figure 7 A schematic diagram of the structure of an electronic device provided for an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0109] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0111] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the firewall automatic operation and maintenance method.

[0112] In some embodiments, the firewall automatic operation and maintenance method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the firewall automatic operation and maintenance method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the firewall automatic operation and maintenance method in any other appropriate manner (for example, by means of firmware).

[0113] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] The computer program for implementing the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable firewall automatic operation and maintenance device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0115] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0119] In one embodiment, the embodiment of the present invention further includes a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the automatic operation and maintenance method of the firewall described in any embodiment of the present invention is implemented.

[0120] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0121] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0122] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A firewall automatic operation and maintenance method, characterized in that: include: Obtaining pre-configured firewall requirement information and firewall configuration information corresponding to each firewall in the target network topology; Generate a first firewall configuration file corresponding to the target network topology according to the firewall configuration information; Decomposing the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the first firewall configuration file; The firewall configuration information includes at least: a source security domain, a target security domain, a source address segment, and a target address segment; The decomposing the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the first firewall configuration file includes: Respectively determine a comparison result between the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and a comparison result between the destination address segment in the firewall requirement information and the destination address segment in the first firewall configuration file as corresponding first comparison results and second comparison results; Determine the target firewall and data flow direction corresponding to the firewall requirement information according to the first comparison result and the second comparison result; wherein the target firewall is at least one firewall in the network path corresponding to the target network topology; After decomposing the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the first firewall configuration file, the method further includes: Acquire at least two corresponding firewall policies according to the firewall requirement information; Convert each of the firewall policies to obtain a corresponding policy standard table; The policy standard table is converted to obtain a corresponding second firewall configuration file; wherein the firewall supports identification of the second firewall configuration file and cannot identify the policy standard table.

2. The method according to claim 1, characterized in that The firewall configuration information at least includes: a source security domain, a target security domain, a source address segment, and a target address segment; the generating a first firewall configuration file corresponding to the target network topology according to the firewall configuration information includes: The firewall configuration information is used to describe the flow of traffic on each firewall to obtain the corresponding data flow direction; According to the data flow direction of each firewall, a corresponding traffic model is formed; The traffic model and the firewall configuration information are stored in a configuration file in JSON format to obtain a corresponding first firewall configuration file.

3. The method according to claim 1, characterized in that Also includes: Reversely parse the second firewall configuration file to obtain the corresponding newly added field; Add the newly added fields to the corresponding policy standard table.

4. The method according to claim 1, characterized in that: The step of converting each of the firewall policies to obtain a corresponding policy standard table includes: identifying a target field in each of said firewall policies; The target fields are combined to generate a corresponding policy standard table.

5. The method according to claim 4, characterized in that The target field includes at least one of the following: policy identification; policy rules; policy hit count; policy effective time; policy expiration time; current status of the firewall policy; and requirement identification.

6. A firewall automatic operation and maintenance system, characterized in that: include: Path analysis module, policy adaptation module and configuration parsing module; The path analysis module is used to decompose the firewall requirement information to the firewalls in the network path corresponding to the target network topology according to the firewall requirement information and the firewall configuration information corresponding to each firewall in the target network topology; The policy adaptation module is used to convert each firewall policy corresponding to the firewall requirement information into a corresponding second firewall configuration file; The configuration parsing module is used to reversely parse the second firewall configuration file to obtain the corresponding newly added field, and add the newly added field to the corresponding policy standard table; The firewall configuration information includes at least: a source security domain, a target security domain, a source address segment, and a target address segment; The path analysis module is specifically used to generate a first firewall configuration file corresponding to the target network topology according to the firewall configuration information; respectively determine the comparison result between the source address segment in the firewall requirement information and the source address segment in the first firewall configuration file, and the comparison result between the target address segment in the firewall requirement information and the target address segment in the first firewall configuration file as the corresponding first comparison result and second comparison result; determine the target firewall and data flow direction corresponding to the firewall requirement information according to the first comparison result and the second comparison result; wherein the target firewall is at least one firewall in the network path corresponding to the target network topology; Among them, the policy adaptation module is specifically used to obtain corresponding at least two firewall policies according to the firewall requirement information; convert each of the firewall policies to obtain a corresponding policy standard table; convert the policy standard table to obtain a corresponding second firewall configuration file; wherein the firewall supports identification of the second firewall configuration file and cannot identify the policy standard table.

7. The system according to claim 6, characterized in that Also includes: Strategy query module and strategy analysis module; The policy query module is used to query each of the firewall policies to obtain corresponding firewall configuration information; The policy analysis module is used to compare each firewall policy with the policy in the target database, and execute the corresponding application abandonment operation, policy merging operation or policy splitting operation according to the comparison result.

8. The system according to claim 6, characterized in that Also includes: Resource monitoring module, resource allocation module, resource recovery module and resource query module; The resource monitoring module is used to regularly monitor the number of policy hits in the firewall policy and store the monitored number of policy hits in a database; The resource allocation module is used to automatically allocate network address translation NAT addresses and generate policy identifiers; The resource recovery module is used to recover the network address translation NAT address and policy identifier; The resource query module is used to query the allocation of network address translation NAT addresses, the use of policy identifiers, address group members, address pool members and routing tables.

9. The system according to claim 6, characterized in that Also includes: Change verification module: The change verification module is used to compare the second firewall configuration file corresponding to the applied firewall policy with the current firewall configuration file to determine the firewall policy change according to the comparison result.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the firewall automatic operation and maintenance method according to any one of claims 1 to 5.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the firewall automatic operation and maintenance method according to any one of claims 1 to 5 when executed.

Images