A network access white list generation method, device, equipment and storage medium

Abstract

The application discloses a network access white list generation method, device and equipment and a storage medium. The method is applied to cloud services, and the cloud services include at least one deployable unit, at least one container is arranged in the deployable unit, and the network access policy generation method includes: acquiring dynamic data and static data; determining the call association relationship between the cloud services according to the dynamic data and the static data, wherein the call association relationship between the cloud services includes: identification information of an accessed cloud service, identification information of an accessed cloud service and a destination port; and generating a network access white list according to the identification information of the accessed cloud service, the identification information of the accessed cloud service and the destination port. Through the technical scheme, the network access white list can be generated, and then the network security policy is generated according to the network access white list, so that the omission and deviation are reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for generating a network access whitelist. Background Technology

[0002] Currently, while cloud-native network policy rules can provide a visualized network traffic topology and conditions for setting network security policies, these policies still require manual configuration by users based on statistical information (including tenant namespaces, labels, and IPs). Furthermore, network security policies require system administrators and application administrators to analyze known business processes, which can easily lead to omissions. Compared to traditional security policies, network security policies involve more filtering and aggregation (e.g., namespaces, labels, IPs, protocols, and ports). Because the information obtained during manual analysis is incomplete, the resulting network security policies may contain inaccuracies. Summary of the Invention

[0003] This invention provides a method, apparatus, device, and storage medium for generating a network access whitelist, which solves the problem that manual sorting of application access relationships is prone to incomplete information acquisition and policy formulation deviations.

[0004] According to one aspect of the present invention, a method for generating a network access whitelist is provided. This method is applied to a cloud service, the cloud service comprising: at least one deployable unit, wherein at least one container is disposed within the deployable unit; the network access policy generation method comprises:

[0005] Acquire dynamic and static data;

[0006] The call association between cloud services is determined based on the dynamic data and the static data, wherein the call association between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port;

[0007] A network access whitelist is generated based on the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port.

[0008] According to another aspect of the present invention, a network access whitelist generation apparatus is provided, the network access whitelist generation apparatus comprising:

[0009] The first acquisition module is used to acquire dynamic and static data;

[0010] The first determining module is used to determine the call association between cloud services based on the dynamic data and the static data, wherein the call association between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port;

[0011] The first generation module is used to generate a network access whitelist based on the identification information of the accessed cloud service, the identification information of the accessed cloud service, and the destination port.

[0012] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network access whitelist generation method according to any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the network access whitelist generation method according to any embodiment of the present invention.

[0017] This invention, through the acquisition of dynamic and static data, determines the call relationships between cloud services based on the dynamic and static data. These relationships include: the identifier information of the accessing cloud service, the identifier information of the accessed cloud service, and the destination port. A network access whitelist is generated based on the identifier information of the accessing cloud service, the identifier information of the accessed cloud service, and the destination port. This solves the problem of incomplete information acquisition and policy formulation bias caused by manually sorting application access relationships. It can generate a network access whitelist, and then generate network security policies based on the network access whitelist, reducing omissions and biases.

[0018] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a network access whitelist generation method according to Embodiment 1 of the present invention;

[0021] Figure 2 This is a schematic diagram of a network access whitelist generation device according to Embodiment 2 of the present invention;

[0022] Figure 3 This is a schematic diagram of the structure of an electronic device according to Embodiment 3 of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0026] Example 1

[0027] Figure 1This is a flowchart of a network access whitelist generation method according to Embodiment 1 of the present invention. The method is applied to a cloud service, which includes at least one deployable unit, and each deployable unit contains at least one container. It should be noted that there can be multiple deployable units in the cloud service, and each deployable unit can also contain multiple containers. One container can access multiple containers, or multiple containers can access each other. This embodiment is applicable to the generation of network isolation policies. This method can be executed by the network access whitelist generation device in this embodiment of the invention. This device can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0028] S110, acquire dynamic and static data.

[0029] The dynamic data includes the source IP address, destination IP address, and destination port of the deployable unit, while the static data includes the tag information and the first IP address of the deployable unit. It should be noted that the first IP address is only used to distinguish it from the source and destination IP addresses for the convenience of describing this embodiment and has no other meaning.

[0030] Specifically, dynamic and static data can be obtained by using an EBPF probe.

[0031] S120, determine the call association between cloud services based on dynamic data and static data, wherein the call association between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port.

[0032] The destination port refers to the destination port in the dynamic data.

[0033] Specifically, the method for determining the call association between cloud services based on dynamic and static data can be as follows: Obtain the static data corresponding to the source IP address from the dynamic data; obtain the static data corresponding to the destination IP address from the dynamic data; integrate the source IP address and the corresponding static data to obtain the tag information of the deployable unit in the static information corresponding to the source IP address; determine the cloud service to which the deployable unit belongs based on the tag information of the deployable unit in the static information corresponding to the source IP address, and thus determine the identification information of the accessed cloud service; integrate the destination IP address and the corresponding static data from the dynamic data to obtain the tag information of the deployable unit in the static information corresponding to the destination IP address; determine the identification information of the accessed cloud service based on the tag information of the deployable unit in the static information corresponding to the destination IP address; and determine the call association between cloud services based on the destination port, the identification information of the accessed cloud service, and the identification information of the accessed cloud service in the dynamic data.

[0034] Optionally, the dynamic data includes: the source IP address of the deployable unit, the destination IP address of the deployable unit, and the destination port; the static data includes: the tag information of the deployable unit and the first IP address of the deployable unit.

[0035] Accordingly, the call association between cloud services is determined based on the dynamic data and the static data, including:

[0036] The dynamic data and the static data are filtered based on the source IP address, destination IP address and first IP address of the deployable unit to obtain first dynamic data, first static data and second static data. The source IP address of the deployable unit in the first dynamic data is the same as the first IP address in the first static data, and the destination IP address of the deployable unit in the first dynamic data is the same as the first IP address in the second static data.

[0037] The call relationships between cloud services are generated based on the first dynamic data, the first static data, and the second static data.

[0038] Specifically, the method for filtering the dynamic data and static data based on the source IP address, destination IP address, and first IP address of the deployable unit to obtain the first dynamic data, first static data, and second static data can be as follows: obtain the source IP address, destination IP address, and first IP address of the deployable unit for all dynamic and static data, filter the dynamic and static data, generate the first static data based on static data whose first IP address is the same as the source IP address in the dynamic data, generate the second static data based on static data whose first IP address is the same as the destination IP address in the dynamic data, and generate the first dynamic data based on dynamic data whose source IP address is the same as the first IP address in the static data and whose destination IP address is the same as the first IP address in the static data.

[0039] Specifically, the method for generating the call association between cloud services based on the first dynamic data, the first static data, and the second static data can be as follows: obtain the tag information of the deployable unit in the static information corresponding to the source IP address based on the first dynamic data and the first static data; obtain the identification information of the accessed cloud service based on the tag information of the deployable unit in the static information corresponding to the source IP address; obtain the tag information of the deployable unit in the static information corresponding to the destination IP address based on the first dynamic data and the second static data; obtain the identification information of the accessed cloud service based on the tag information of the deployable unit in the static information corresponding to the destination IP address; obtain the destination port based on the first dynamic data; and generate the call association between cloud services based on the identification information of the accessed cloud service, the identification information of the accessed cloud service, and the destination port.

[0040] Optionally, the call relationship between cloud services is generated based on the first dynamic data, the first static data, and the second static data, including:

[0041] Obtain the identification information for accessing cloud services corresponding to the tag information of the deployable unit in the first static information;

[0042] Obtain the identification information of the accessed cloud service corresponding to the tag information of the deployable unit in the second static information;

[0043] Obtain the destination port from the first dynamic information;

[0044] The call relationship between cloud services is generated based on the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port.

[0045] Among them, the first static information is the information corresponding to the first static data, the second static information is the information corresponding to the second static data, and the first dynamic information is the information corresponding to the first dynamic data. Tag information is used to distinguish deployable units.

[0046] Specifically, the method for obtaining the identification information for accessing cloud services corresponding to the tag information of the deployable unit in the first static information can be as follows: obtain the first static information corresponding to the first static data, and determine the identification information for accessing cloud services based on the tag information of the deployable unit in the first static information. It should be noted that since the first IP address in the first static data is the same as the source IP address in the first dynamic data, the tag information of the deployable unit in the first static information corresponding to the first static data corresponds to the identification information for accessing cloud services.

[0047] Specifically, the method for obtaining the identifier information of the accessed cloud service corresponding to the tag information of the deployable unit in the second static information can be as follows: obtain the second static information corresponding to the second static data, and determine the identifier information of the accessed cloud service based on the tag information of the deployable unit in the second static information. It should be noted that since the first IP address in the second static data is the same as the destination IP address in the first dynamic data, the tag information of the deployable unit in the second static information corresponding to the second static data corresponds to the identifier information of the accessed cloud service.

[0048] Specifically, the method for obtaining the destination port in the first dynamic information can be: obtaining the first dynamic information corresponding to the first dynamic data, where the destination port in the first dynamic information is the destination port required to generate the call association relationship between cloud services.

[0049] It should be noted that there can be multiple first static information, second static information, and first dynamic information. Therefore, multiple identifiers of accessing cloud services, multiple identifiers of accessed cloud services, and multiple destination ports can be generated. Furthermore, the call association between multiple cloud services can be generated based on the multiple identifiers of accessing cloud services, the multiple identifiers of accessed cloud services, and the multiple destination ports.

[0050] S130 generates a network access whitelist based on the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port.

[0051] The network access whitelist is a list of permitted accesses, which mainly includes the identifier information of the cloud service being accessed, the identifier information of the cloud service being accessed, and the destination port. If the identifier information of the cloud service being accessed, the identifier information of the cloud service being accessed, and the destination port of the received access request can be found in the network access whitelist, then access can be granted; if the access request cannot be found in the network access whitelist, then access cannot be granted.

[0052] Specifically, the method for generating a network access whitelist based on the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port can be as follows: multiple data in dynamic data and static data are associated sequentially to obtain the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port, thereby obtaining multiple call associations, establishing a list based on the multiple call associations, and then generating a network access whitelist.

[0053] Optional, also includes:

[0054] Receive a network access request, wherein the network access request includes: the IP address of the accessing container, the IP address of the accessed container, and the access port;

[0055] The first identification information for accessing cloud services is determined based on the IP address of the access container;

[0056] The second identification information of the accessed cloud service is determined based on the IP address of the accessed container;

[0057] If the network access whitelist contains a call association with the same first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the same access port, then the network access request is executed.

[0058] There can be multiple IP addresses accessing a container, and there can also be multiple IP addresses being accessed by a container. Many-to-many access is possible between containers. It should be noted that the first identification information is the identification information of the cloud service being accessed, determined based on the IP address of the accessing container in actual application; the second identification information is the identification information of the cloud service being accessed, determined based on the IP address of the accessed container in actual application; and the access port is the destination port in actual application.

[0059] Specifically, the method for determining the first identification information for accessing cloud services based on the IP address of the access container can be as follows: determine the tag information of the access container based on the IP address of the access container, determine the tag information of the deployable unit to which the access container belongs based on the tag information of the access container, and determine the first identification information for accessing cloud services based on the tag information of the deployable unit.

[0060] Specifically, the method for determining the second identification information of the accessed cloud service based on the IP address of the accessed container can be as follows: determine the tag information of the accessed container based on the IP address of the accessed container, determine the tag information of the deployable unit to which the accessed container belongs based on the tag information of the accessed container, and determine the second identification information of the accessed cloud service based on the tag information of the deployable unit.

[0061] Specifically, if the network access whitelist contains a call association that is identical to the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port, the network access request can be executed as follows: obtain the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port; simultaneously obtain the call association between the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port; search the network access whitelist; if the network access whitelist contains a call association that is identical to the call association between the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port, then execute the network access request; if the network access whitelist does not contain a call association that is identical to the call association between the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port, then reject the network access request.

[0062] Optionally, the first identification information for accessing the cloud service can be determined based on the IP address of the access container, including:

[0063] The container's first tag information is determined based on the IP address that accesses the container;

[0064] Determine the first label information of the deployable unit based on the first label information of the container;

[0065] The first identification information for accessing cloud services is determined based on the first label information of the deployable unit.

[0066] It should be noted that cloud services can pre-store the relationship between the IP address of the accessing container and the container's first label information, and can also pre-store the relationship between the IP address of the accessed container and the container's first label information. The storage method can be to store the relationship between the IP address of the accessing container and the container's first label information, and the relationship between the IP address of the accessed container and the container's first label information in a list.

[0067] The first label information of a container is the label information of the container corresponding to the IP address accessing the container, used to distinguish containers. The first label information of a deployable unit is the label information of the deployable unit to which the IP address accessing the container belongs.

[0068] Optionally, a second identification information for the accessed cloud service may be determined based on the IP address of the accessed container, including:

[0069] The second label information of the container is determined based on the IP address of the accessed container;

[0070] Determine the second label information of the deployable unit based on the second label information of the container;

[0071] The second identification information of the accessed cloud service is determined based on the second label information of the deployable unit.

[0072] The second label information of the container is the label information of the container corresponding to the IP address of the accessed container, and the second label information of the deployable unit is the label information of the deployable unit to which the IP address of the accessed container belongs.

[0073] Optionally, if the network access whitelist contains a call association with the same first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the same access port, then a network access request is executed, including:

[0074] A first call association is generated based on the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port.

[0075] If a second call association with the same name as the first call association exists in the network access whitelist, then a network access request is executed. In this case, the first identifier information of the cloud service accessed in the first call association is the same as the identifier information of the cloud service accessed in the second call association; the second identifier information of the cloud service accessed in the first call association is the same as the identifier information of the cloud service accessed in the second call association; and the access port in the first call association and the destination port in the second call association are the same.

[0076] The first call association is generated in actual application based on the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port; the second call association is stored in the network access whitelist and is the same as the first call association.

[0077] The technical solution of this embodiment acquires dynamic and static data; determines the call association between cloud services based on the dynamic and static data, wherein the call association between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port; and generates a network access whitelist based on the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port. This solves the problem that manual sorting of application access relationships is prone to incomplete information acquisition and policy formulation bias, and can generate a network access whitelist, thereby generating network security policies based on the network access whitelist, reducing omissions and biases.

[0078] Example 2

[0079] Figure 2This is a schematic diagram of a network access whitelist generation device according to Embodiment 2 of the present invention. This embodiment is applicable to the generation of network isolation policies. The device can be implemented in software and / or hardware, and can be integrated into any device that provides network access whitelist generation functionality, such as... Figure 2 As shown, the network access whitelist generation device specifically includes: a first acquisition module 210, a first determination module 220, and a first generation module 230.

[0080] The first acquisition module 210 is used to acquire dynamic data and static data;

[0081] The first determining module 220 is used to determine the call association relationship between cloud services based on the dynamic data and the static data, wherein the call association relationship between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port;

[0082] The first generation module 230 is used to generate a network access whitelist based on the identification information of the accessed cloud service, the identification information of the accessed cloud service, and the destination port.

[0083] Optionally, the dynamic data includes: the source IP address of the deployable unit, the destination IP address of the deployable unit, and the destination port; the static data includes: the tag information of the deployable unit and the first IP address of the deployable unit.

[0084] Accordingly, the first determining module is specifically used for:

[0085] The dynamic data and the static data are filtered based on the source IP address, destination IP address and first IP address of the deployable unit to obtain first dynamic data, first static data and second static data. The source IP address of the deployable unit in the first dynamic data is the same as the first IP address in the first static data, and the destination IP address of the deployable unit in the first dynamic data is the same as the first IP address in the second static data.

[0086] The call relationships between cloud services are generated based on the first dynamic data, the first static data, and the second static data.

[0087] Optionally, the first determining module is specifically used for:

[0088] Obtain the identification information for accessing cloud services corresponding to the tag information of the deployable unit in the first static information;

[0089] Obtain the identification information of the accessed cloud service corresponding to the tag information of the deployable unit in the second static information;

[0090] Obtain the destination port from the first dynamic information;

[0091] The call relationship between cloud services is generated based on the identifier information of the accessed cloud service, the identifier information of the accessed cloud service, and the destination port.

[0092] Optional, also includes:

[0093] The first receiving module is used to receive network access requests, wherein the network access request includes: the IP address of the accessing container, the IP address of the accessed container, and the access port;

[0094] The second determining module is used to determine the first identification information for accessing cloud services based on the IP address of the access container;

[0095] The third determining module is used to determine the second identification information of the accessed cloud service based on the IP address of the accessed container;

[0096] The first execution module is used to execute a network access request if there is a call association in the network access whitelist that is the same as the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port.

[0097] Optionally, the second determining module is specifically used for:

[0098] The container's first tag information is determined based on the IP address that accesses the container;

[0099] Determine the first label information of the deployable unit based on the first label information of the container;

[0100] The first identification information for accessing cloud services is determined based on the first label information of the deployable unit.

[0101] Optionally, the first execution module is specifically used for:

[0102] A first call association is generated based on the first identifier information of the accessed cloud service, the second identifier information of the accessed cloud service, and the access port.

[0103] If a second call association with the same name as the first call association exists in the network access whitelist, then a network access request is executed. In this case, the first identifier information of the cloud service accessed in the first call association is the same as the identifier information of the cloud service accessed in the second call association; the second identifier information of the cloud service accessed in the first call association is the same as the identifier information of the cloud service accessed in the second call association; and the access port in the first call association and the destination port in the second call association are the same.

[0104] The above-described products can perform the methods provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects for performing the methods.

[0105] The technical solution of this embodiment acquires dynamic and static data; determines the call association between cloud services based on the dynamic and static data, wherein the call association between cloud services includes: the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port; and generates a network access whitelist based on the identification information of the accessing cloud service, the identification information of the accessed cloud service, and the destination port. This solves the problem that manual sorting of application access relationships is prone to incomplete information acquisition and policy formulation bias, and can generate a network access whitelist, thereby generating network security policies based on the network access whitelist, reducing omissions and biases.

[0106] Example 3

[0107] Figure 3 This is a schematic diagram of an electronic device according to Embodiment 3 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0108] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0110] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the network access whitelist generation method.

[0111] In some embodiments, the network access whitelist generation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network access whitelist generation method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network access whitelist generation method by any other suitable means (e.g., by means of firmware).

[0112] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0114] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0115] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0116] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0117] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0118] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0119] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network access whitelist generation method characterized by comprising: The application is applied to a cloud service, and the cloud service comprises at least one deployable unit, at least one container is arranged in the deployable unit, and the network access policy generation method comprises: obtaining dynamic data and static data; the dynamic data comprises a source IP address of a deployable unit, a destination IP address of the deployable unit and a destination port, and the static data comprises label information of the deployable unit and a first IP address of the deployable unit; determining a calling association relationship between cloud services according to the dynamic data and the static data, comprising: screening the dynamic data and the static data according to the source IP address of the deployable unit, the destination IP address of the deployable unit and the first IP address of the deployable unit to obtain first dynamic data, first static data and second static data, wherein the source IP address of the deployable unit in the first dynamic data is the same as the first IP address in the first static data, and the destination IP address of the deployable unit in the first dynamic data is the same as the first IP address in the second static data; generating a calling association relationship between cloud services according to the first dynamic data, the first static data and the second static data; the first static data is generated according to static data in which the first IP address in the static data is the same as the source IP address in the dynamic data; the second static data is generated according to static data in which the first IP address in the static data is the same as the destination IP address in the dynamic data; the first dynamic data is generated according to dynamic data in which the source IP address in the dynamic data is the same as the first IP address in the static data, and the destination IP address in the dynamic data is the same as the first IP address in the static data; wherein the calling association relationship between cloud services comprises identification information of an accessed cloud service, identification information of an accessed cloud service and a destination port; generating a network access white list according to the identification information of the accessed cloud service, the identification information of the accessed cloud service and the destination port.

2. The method of claim 1, wherein, generating a calling association relationship between cloud services according to the first dynamic data, the first static data and the second static data, comprising: obtaining identification information of an accessed cloud service corresponding to label information of a deployable unit in first static information; obtaining identification information of an accessed cloud service corresponding to label information of a deployable unit in second static information; obtaining a destination port in first dynamic information; generating a calling association relationship between cloud services according to the identification information of the accessed cloud service, the identification information of the accessed cloud service and the destination port; wherein the first static information is information corresponding to the first static data, the second static information is information corresponding to the second static data, and the first dynamic information is information corresponding to the first dynamic data.

3. The method of claim 1, wherein, further comprising: receiving a network access request, wherein the network access request comprises an IP address of an accessed container, an IP address of an accessed container and an access port; determining first identification information of an accessed cloud service according to the IP address of the accessed container; determining second identification information of an accessed cloud service according to the IP address of the accessed container; If there is a calling association relationship same as the first identification information of the accessed cloud service, the second identification information of the accessed cloud service and the access port in the network access whitelist, the network access request is executed.

4. The method of claim 3, wherein, The first identification information of the accessed cloud service is determined according to the IP address of the access container, including: The first label information of the container is determined according to the IP address of the access container. The first label information of the deployable unit is determined according to the first label information of the container. The first identification information of the accessed cloud service is determined according to the first label information of the deployable unit.

5. The method of claim 3, wherein, If there is a calling association relationship same as the first identification information of the accessed cloud service, the second identification information of the accessed cloud service and the access port in the network access whitelist, the network access request is executed, including: The first calling association relationship is generated according to the first identification information of the accessed cloud service, the second identification information of the accessed cloud service and the access port. If there is a second calling association relationship same as the first calling association relationship in the network access whitelist, the network access request is executed, wherein the first identification information of the accessed cloud service in the first calling association relationship is same as the identification information of the accessed cloud service in the second calling association relationship, the second identification information of the accessed cloud service in the first calling association relationship is same as the identification information of the accessed cloud service in the second calling association relationship, and the access port in the first calling association relationship is same as the destination port in the second calling association relationship.

6. A network access whitelist generation apparatus characterized by comprising: The network access whitelist generation device includes: The first acquisition module is configured to acquire dynamic data and static data, wherein the dynamic data includes source IP address of the deployable unit, destination IP address of the deployable unit and destination port, and the static data includes label information of the deployable unit and first IP address of the deployable unit. The first determination module is configured to determine calling association relationship between cloud services according to the dynamic data and the static data, wherein the calling association relationship between cloud services includes identification information of accessed cloud service, identification information of accessed cloud service and destination port. The first generation module is configured to generate network access whitelist according to the identification information of accessed cloud service, the identification information of accessed cloud service and the destination port. The first determination module is specifically configured to: The dynamic data and the static data are filtered according to the source IP address of the deployable unit, the destination IP address of the deployable unit and the first IP address of the deployable unit to obtain first dynamic data, first static data and second static data, wherein the source IP address of the deployable unit in the first dynamic data is same as the first IP address in the first static data, and the destination IP address of the deployable unit in the first dynamic data is same as the first IP address in the second static data. The calling association relationship between cloud services is generated according to the first dynamic data, the first static data and the second static data. The first static data is generated according to static data in which the first IP address is same as the source IP address in the dynamic data; the second static data is generated according to static data in which the first IP address is same as the destination IP address in the dynamic data; and the first dynamic data is generated according to dynamic data in which the source IP address is same as the first IP address in the static data, and the destination IP address is same as the first IP address in the static data.

7. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the network access white list generation method in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to implement the network access white list generation method in any one of claims 1-5 when executed.

Images