Strategy update methods, systems, devices and electronic equipment

Abstract

This application discloses a policy update method, system, apparatus, and electronic device. The method includes: obtaining a device identifier corresponding to each of a plurality of terminal devices; grouping the plurality of device identifiers according to the policy executed by each terminal device to obtain at least one policy group, wherein the terminal devices corresponding to each policy group execute the same policy; detecting whether the policy corresponding to the policy group has been updated; if the policy corresponding to the policy group has been updated, determining the policy group as a target policy group and determining the updated policy as the target policy; updating the local target policy stored in the target terminal device corresponding to the target policy group according to the policy identifier and update information of the target policy. This application solves the technical problem of low storage resource utilization in the prior art when servers manage policies corresponding to terminal devices.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a strategy update method, system, apparatus, and electronic device. Background Technology

[0002] An endpoint security management system is a system for security management and risk control of all terminal devices within a specified network. When managing a large number of terminal devices, an endpoint security management system typically employs a one-to-one policy management approach. For example, when the backend server of an endpoint security management system manages policies corresponding to N terminal devices simultaneously, the backend server needs to store the following maintenance records: Maintenance record 1: Policy A corresponds to terminal device 1; Maintenance record 2: Policy A corresponds to terminal device 2; Maintenance record 3: Policy A corresponds to terminal device 3; Maintenance record 4: Policy B corresponds to terminal device 4; Maintenance record 5: Policy B corresponds to terminal device 5… Maintenance record N: Policy N corresponds to terminal device N.

[0003] Therefore, even if multiple terminals use the same policy, the backend server still needs to maintain multiple records in the database. As the number of terminals and policies continues to increase, database storage resources will become increasingly strained, leading to a decrease in the resource utilization rate of the backend server.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a policy update method, system, apparatus, and electronic device to at least solve the technical problem of low storage resource utilization in the prior art when servers manage policies corresponding to terminal devices.

[0006] According to one aspect of the embodiments of this application, a policy update method is provided, comprising: obtaining a device identifier corresponding to each of a plurality of terminal devices; grouping the plurality of device identifiers according to a policy executed by each terminal device to obtain at least one policy group, wherein the terminal devices corresponding to each policy group execute the same policy, and the policy is used to characterize the business rules that the terminal devices need to execute; detecting whether the policy corresponding to the policy group is updated; if the policy corresponding to the policy group is updated, determining the policy group as a target policy group, and determining the updated policy as a target policy; updating the local target policy stored in the target terminal device corresponding to the target policy group according to the policy identifier of the target policy and update information, wherein the policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0007] Furthermore, the policy update method also includes: obtaining attribute information for each terminal device, wherein the attribute information is used to characterize the department to which the terminal device belongs, and terminal devices with the same attribute information execute the same policy; and grouping multiple device identifiers according to the attribute information to obtain at least one policy group.

[0008] Furthermore, the policy update method further includes: after grouping multiple device identifiers according to attribute information to obtain at least one policy group, detecting whether the attribute information of the first terminal device has been updated, wherein the first terminal device is any one of the multiple terminal devices, and the policy group corresponding to the first terminal device is the first policy group; if the attribute information corresponding to the first terminal device has been updated, determining the updated attribute information of the first terminal device as the target attribute information; moving the device identifier corresponding to the first terminal device from the first policy group to the second policy group according to the target attribute information, wherein the attribute information of the terminal device corresponding to the device identifier in the second policy group is the target attribute information.

[0009] Furthermore, the policy update method further includes: after moving the device identifier corresponding to the first terminal device from the first policy group to the second policy group according to the target attribute information, updating the local policy stored in the first terminal device to the policy in the second policy group; detecting whether the policy corresponding to the second policy group has been updated; when the policy corresponding to the second policy group has been updated, determining that the policy is a policy to be processed; updating the first local policy stored in the first terminal device according to the policy identifier of the policy to be processed and the update information of the policy to be processed, wherein the policy identifier of the first local policy is the same as the policy identifier of the policy to be processed.

[0010] Furthermore, the policy update method also includes: at least one policy group is stored in the target database of the control center, wherein the control center is a server used to manage at least one policy group.

[0011] Furthermore, the policy update method also includes: detecting whether there is an idle group in at least one policy group, wherein the idle group is a policy group that does not contain a device identifier; when there is an idle group in at least one policy group, deleting the policy under the idle group and deleting the idle group from the control center.

[0012] According to another aspect of the embodiments of this application, a policy update method is also provided, comprising: monitoring update information of a target policy corresponding to a target policy group, wherein the target policy group is a policy group among at least one policy group stored in a control center that has undergone policy update, each policy group in the at least one policy group corresponds to a terminal device that executes the same policy, the policy is used to characterize the business rules that the terminal device needs to execute, and the control center is a server for managing at least one policy group; updating a local target policy stored in a target terminal device according to the update information and the policy identifier of the target policy, wherein the target terminal device is the terminal device corresponding to the target policy group, and the policy identifier of the target policy is the same as the policy identifier of the local target policy.

[0013] According to another aspect of the embodiments of this application, a policy update system is also provided, comprising: a control center, configured to acquire a device identifier corresponding to each of a plurality of terminal devices, and group the plurality of device identifiers according to the policy executed by each terminal device to obtain at least one policy group, wherein the terminal devices corresponding to each policy group execute the same policy, and the policy is used to characterize the business rules that the terminal devices need to execute; and a target terminal device, configured to listen to the update information of the target policy corresponding to the target policy group, and update the local target policy stored in the target terminal device according to the update information and the policy identifier of the target policy, wherein the target policy group is the policy group among at least one policy group that has undergone policy update, the target terminal device is the terminal device corresponding to the target policy group, and the policy identifier of the target policy is the same as the policy identifier of the local target policy.

[0014] According to another aspect of the embodiments of this application, a policy update apparatus is also provided, comprising: an acquisition module, configured to acquire a device identifier corresponding to each of a plurality of terminal devices; a grouping module, configured to group the plurality of device identifiers according to the policy executed by each terminal device to obtain at least one policy group, wherein the terminal device corresponding to each policy group executes the same policy, and the policy is used to characterize the business rules that the terminal device needs to execute; a detection module, configured to detect whether the policy corresponding to the policy group has been updated; a determination module, configured to determine that the policy group is a target policy group and determine the updated policy as the target policy when the policy corresponding to the policy group has been updated; and an update module, configured to update the local target policy stored in the target terminal device corresponding to the target policy group according to the policy identifier of the target policy and update information, wherein the policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the above-described policy update method when running.

[0016] In this application, a method is adopted to group multiple device identifiers according to the policy executed by each terminal device to obtain at least one policy group. First, the device identifier corresponding to each of the multiple terminal devices is obtained, and the multiple device identifiers are grouped according to the policy executed by each terminal device to obtain at least one policy group. Then, it is detected whether the policy corresponding to the policy group has been updated. If the policy corresponding to the policy group has been updated, the policy group is determined as the target policy group, and the updated policy is determined as the target policy. Finally, the local target policy stored in the target terminal device corresponding to the target policy group is updated according to the policy identifier of the target policy and the update information. Each terminal device corresponding to each policy group executes the same policy, and the policy is used to characterize the business rules that the terminal device needs to execute. The policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0017] As described above, this application achieves unified management of at least one terminal device using the same policy by grouping the device identifiers of terminal devices executing the same policy into the same policy group. For example, if multiple terminal devices use the same policy, this application only needs to maintain a single record of the device identifiers of these terminal devices and the same policy used by these terminal devices in the server's database, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Furthermore, existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing a policy update. This application, however, uses policy groups to maintain the correspondence between policies and at least one terminal device using the policy separately, thereby improving the stability of the policy update process and ensuring that updates for every corresponding terminal device are not missed.

[0018] Therefore, the technical solution of this application achieves the goal of reducing the amount of data that the server needs to store when managing the policies corresponding to the terminal devices, thereby improving the utilization rate of the server's storage resources and solving the technical problem of low storage resource utilization in the prior art when the server manages the policies corresponding to the terminal devices. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a flowchart of an optional policy update method according to an embodiment of this application;

[0021] Figure 2 This is a schematic diagram illustrating the interaction between an optional control center and a terminal device according to an embodiment of this application;

[0022] Figure 3 This is a flowchart of another optional policy update method according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram of an optional policy update system according to an embodiment of this application;

[0024] Figure 5 This is a schematic diagram of an optional policy update device according to an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] According to an embodiment of this application, an embodiment of a policy update method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] Figure 1 This is a flowchart of an optional policy update method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain the device identifier corresponding to each of the multiple terminal devices.

[0031] In step S101, the terminal device includes, but is not limited to, various terminal devices such as smartphones, smart tablets, laptops, and desktop computers. The device identifier is a unique identifier for the terminal device. For example, the device identifier can be the terminal device's SN (serial number), IP (internet protocol address), MAC (media access control address), or a number assigned to the terminal device by a technician.

[0032] In this embodiment, the control center of the terminal security management system can serve as the execution entity of the policy update method in this embodiment. The control center is also the backend server of the terminal security management system. When obtaining the device identifier corresponding to each terminal device, the control center can also obtain other information about each terminal device, such as the terminal device's operating status, device type, etc.

[0033] Step S102: Based on the policy executed by each terminal device, group the multiple device identifiers to obtain at least one policy group.

[0034] In step S102, the terminal devices corresponding to each policy group execute the same policy. The policy characterizes the business rules that the terminal device needs to execute. While each terminal device executes a specific policy during operation, the policies executed by different terminal devices may differ. For example, the terminal devices in the finance department need to execute a first information encryption policy, which encrypts financial information such as account numbers, amounts, and flow of funds. Conversely, the terminal devices in the human resources department need to execute a second information encryption policy, which encrypts personnel information such as ID numbers and home addresses.

[0035] It should be noted that, as shown in Table 1, based on the existing one-to-one policy management method, if the finance department has N terminal devices that need to implement the first information encryption policy, the control center needs to store N policy records in the database.

[0036] Table 1

[0037] Strategy record number Terminal Identifier Strategy Identifier 1 Finance Department Terminal Equipment 1 First Information Encryption Strategy 2 Finance Department Terminal Equipment 2 First Information Encryption Strategy …… …… First Information Encryption Strategy N Finance Department Terminal Equipment N First Information Encryption Strategy

[0038] It's easy to notice that, similar to the maintenance method of the first information encryption strategy, if the HR department has M terminal devices that need to execute the second information encryption strategy, the control center needs to store M more strategy records in the database. As the number of strategies and terminal devices continues to increase, the control center's database storage resources will become increasingly strained.

[0039] This application manages terminal devices that execute the same strategy by placing them in a single strategy group, which significantly reduces the number of strategy records that need to be stored. As shown in Table 2, for the N terminal devices in the finance department mentioned above, according to the solution of this application, the control center only needs to store one strategy record, thereby greatly reducing the number of strategy records. This not only alleviates the storage pressure on the database but also improves the efficiency of strategy management.

[0040] Table 2

[0041] Strategy group identifier Terminal Identifier Strategy Identifier Strategy Grouping 1 Finance Department Terminal Equipment 1-N First Information Encryption Strategy

[0042] Step S103: Detect whether the policy corresponding to the policy group has been updated.

[0043] In step S103, the control center will monitor in real time whether the policies corresponding to each policy group have been updated. It should be noted that a policy group can correspond to one or more policies, depending on the number of identical policies executed by the terminal devices corresponding to that policy group. Furthermore, policy updates include, but are not limited to, policy deletion, policy addition, or policy modification.

[0044] Step S104: If the policy corresponding to the policy group is updated, determine the policy group as the target policy group and determine the updated policy as the target policy.

[0045] In step S104, if the control center detects that a policy corresponding to at least one policy group stored in the control center has been updated, the control center will determine that the policy group is the target policy group and determine that the updated policy is the target policy.

[0046] Step S105: Update the local target policy stored in the target terminal device corresponding to the target policy group according to the policy identifier and update information of the target policy.

[0047] In step S105, the policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0048] Optionally, assume the target policy group is policy group A, where the N terminal devices corresponding to policy group A are Finance Department Terminal Device 1, Finance Department Terminal Device 2, ..., Finance Department Terminal Device N. Within policy group A, the N terminal devices simultaneously execute policy 1-1, policy 1-2, and policy 1-3. If the target policy updated in the control center is policy 1-1, then each of the N terminal devices needs to update its local policy 1-1 stored locally on the terminal device.

[0049] It is important to note that existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing the policy update. This application, however, maintains the correspondence between policies and at least one terminal device using the policy separately by grouping policies, thereby improving the stability of the policy update process and ensuring that no corresponding terminal device is missed in the update process.

[0050] Based on the content of steps S101 to S105 above, in this application, a method is adopted to group multiple device identifiers according to the policy executed by each terminal device to obtain at least one policy group. First, the device identifier corresponding to each of the multiple terminal devices is obtained, and the multiple device identifiers are grouped according to the policy executed by each terminal device to obtain at least one policy group. Then, it is detected whether the policy corresponding to the policy group has been updated. If the policy corresponding to the policy group has been updated, the policy group is determined to be the target policy group, and the updated policy is determined to be the target policy. Finally, the local target policy stored in the target terminal device corresponding to the target policy group is updated according to the policy identifier of the target policy and the update information. Each terminal device corresponding to each policy group executes the same policy. The policy is used to characterize the business rules that the terminal device needs to execute, and the policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0051] As described above, this application achieves unified management of at least one terminal device using the same policy by grouping the device identifiers of terminal devices executing the same policy into the same policy group. For example, if multiple terminal devices use the same policy, this application only needs to maintain a single record of the device identifiers of these terminal devices and the same policy used by these terminal devices in the server's database, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Furthermore, existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing a policy update. This application, however, uses policy groups to maintain the correspondence between policies and at least one terminal device using the policy separately, thereby improving the stability of the policy update process and ensuring that updates for every corresponding terminal device are not missed.

[0052] Therefore, the technical solution of this application achieves the goal of reducing the amount of data that the server needs to store when managing the policies corresponding to the terminal devices, thereby improving the utilization rate of the server's storage resources and solving the technical problem of low storage resource utilization in the prior art when the server manages the policies corresponding to the terminal devices.

[0053] In one alternative embodiment, at least one policy group is stored in a target database of a control center, wherein the control center is a server for managing at least one policy group.

[0054] Optionally, the target database mentioned above is the etcd database. etcd is a distributed key-value storage database developed by CoreOS based on the Raft protocol, which can be used for service discovery, shared configuration, and consistency assurance. etcd has a listening function, allowing terminal devices to monitor one or a group of keys. When the value corresponding to a key changes, the terminal device receives a notification of the change.

[0055] The solution in this application uses the etcd database as the database in the control center to store at least one policy group, and implements the functions of querying, distributing and monitoring policy status.

[0056] In addition, the control center will check for idle groups within at least one policy group. Idle groups are policy groups that do not contain device identifiers. If an idle group is found in at least one policy group, the control center will delete the policy under the idle group and remove the idle group from the control center.

[0057] It's easy to understand that if a policy group in the control center has no device identifier, it means that the policy group will no longer manage any terminal devices. Therefore, the control center can delete the policies under that policy group to save database storage resources.

[0058] In one optional embodiment, the control center can obtain attribute information for each terminal device and group multiple device identifiers according to the attribute information to obtain at least one policy group. The attribute information is used to characterize the department to which the terminal device belongs, and terminal devices with the same attribute information execute the same policy.

[0059] As shown in Table 3, Table 3 illustrates an optional strategy grouping definition diagram according to an embodiment of this application.

[0060] Table 3

[0061]

[0062]

[0063] In one optional embodiment, since terminal devices within the same department are typically used to handle the same business, to facilitate the division of strategy groups, terminal devices can be assigned to different strategy groups based on their department. For example, terminal devices in the finance department are managed under strategy group A, and terminal devices in the human resources department are managed under strategy group B. Additionally, the other group information in Table 3 can include remarks about the group, such as the group's creation time, the number of corresponding terminal devices, and the group's creator information. This additional group information can improve the efficiency of technical personnel in managing strategy groups.

[0064] In addition, Table 4 shows a schematic diagram illustrating the definition of an optional terminal device information according to an embodiment of this application, as shown in Table 4:

[0065] Table 4

[0066]

[0067] Optionally, the terminal ID mentioned above is a unique identifier for each terminal device. Each terminal device has a unique terminal ID on a control center. Through the terminal ID, the control center can distinguish between different terminal devices. The control center maintains a terminal information list, which contains the terminal ID of each terminal device and the group ID of the policy group to which each terminal device belongs. This terminal information list is stored in a relational database within the control center.

[0068] In one alternative embodiment, Table 5 shows a schematic diagram of an alternative strategy definition according to an embodiment of this application, as shown in Table 5:

[0069] Table 5

[0070]

[0071] Optionally, each policy is stored in the etcd database in the control center.

[0072] In addition, each terminal device needs to know which policy group it belongs to. Based on the group ID written by the control center by listening to the terminal ID, the policy group to which the terminal device belongs is determined in real time in order to obtain the corresponding policy.

[0073] Table 6 shows the storage format of policy groups in the etcd database.

[0074] Table 6

[0075] key value / prefix / ${agent_id} / group_id ${group_id}

[0076] In Table 6, ${agent_id} is a variable representing the agent_id of the terminal device; ${group_id} is a variable representing the group ID of the policy group corresponding to the terminal device, which is defined by the control center and issued to the terminal device. Each terminal device stores a copy of the corresponding group ID locally.

[0077] Table 7 shows the storage format of the grouping strategy in the etcd database.

[0078] Table 7

[0079]

[0080] In Table 7, ${group_id} is a variable that represents the group ID of the policy group to which the terminal device belongs. When the terminal device detects a change in the group ID, it changes the ${group_id} value in the key of the policy for the group to be monitored. The value is used to represent the specific policy item content of the group policy, which can be in JSON format.

[0081] It should be noted that in endpoint security management systems, there are usually multiple policies for endpoint devices. Therefore, the control center needs to store multiple policies under each policy group, and each endpoint device updates its local policy by listening to the policies of its own group.

[0082] In one optional embodiment, after grouping multiple device identifiers according to attribute information to obtain at least one policy group, the control center detects whether the attribute information of the first terminal device has been updated. The first terminal device is any one of the multiple terminal devices, and the policy group corresponding to the first terminal device is the first policy group. If the attribute information corresponding to the first terminal device has been updated, the control center determines the updated attribute information of the first terminal device as the target attribute information, and moves the device identifier corresponding to the first terminal device from the first policy group to the second policy group according to the target attribute information. The attribute information of the terminal device corresponding to the device identifier in the second policy group is the target attribute information.

[0083] Optionally, when the control center detects a change in the attribute information of a terminal device (such as the first terminal device mentioned above), it indicates that the department to which the terminal device belongs has changed (for example, it has moved from department A to department B). Based on this, since the two departments handle different businesses, the policy to be executed by the terminal device has also changed. The control center needs to move the device identifier of the terminal device from the original first policy group to the second policy group, where all terminal devices corresponding to the second policy group belong to department B.

[0084] In an optional embodiment, after moving the device identifier corresponding to the first terminal device from the first policy group to the second policy group according to the target attribute information, the control center updates the local policy stored in the first terminal device to the policy in the second policy group, and detects whether the policy corresponding to the second policy group has been updated. If the policy corresponding to the second policy group has been updated, the policy is determined to be a policy to be processed. Finally, the control center updates the first local policy stored in the first terminal device according to the policy identifier of the policy to be processed and the update information of the policy to be processed, wherein the policy identifier of the first local policy is the same as the policy identifier of the policy to be processed.

[0085] Optionally, after the control center moves the device identifier of the first terminal device from the first policy group to the second policy group, the control center will write the group ID of the second policy group into the configuration information of the first terminal device. Thus, the first terminal device will detect that its corresponding policy group has changed, and the first terminal device will actively obtain all policies under the second policy group to its local machine, stop listening to the policies of the original first policy group, and start listening to all policies of the second policy group. When it detects that the policies of the second policy group have been updated, the first terminal device will update its local policies accordingly.

[0086] In one alternative embodiment, Figure 2A schematic diagram illustrating the interaction between an optional control center and a terminal device according to an embodiment of this application is shown. Figure 2 As shown, when terminal device A connects to the control center, the control center assigns it a corresponding policy group 1 based on its attribute information and writes the group ID (policy group 1) into the terminal device A's configuration information. When terminal device A detects that its configuration information contains the group ID (policy group 1), it will actively retrieve all policies under policy group 1 to its local machine and begin monitoring all policies in policy group 1. If any policy changes, it will update the corresponding local policy.

[0087] Furthermore, if the control center moves terminal device A from policy group 1 to policy group 2, the control center will rewrite the group ID "policy group 1" in the configuration information of terminal device A to "policy group 2". After terminal device A detects this change in the configuration information, terminal device A will re-acquire the policies under policy group 2 and listen to the policies under policy group 2. If there is a policy change, the corresponding local policy will be updated.

[0088] In addition, such as Figure 2 As shown, when the control center needs to add a new group, it writes the policies for all new groups into the policy configuration of that group ID. All terminal devices under that group will immediately detect the change in group policy and receive the latest policy. Furthermore, administrators can directly view policy group information through the terminal security management system's display interface. This policy group information is directly provided by the control center's etcd database.

[0089] Furthermore, it should be noted that the technical solutions in this application embodiment are also applicable to scenarios where a control center manages the configurations of multiple clients through groups (such as general host management systems, multi-node cluster management systems, etc.). When the system has multiple child nodes, and these child nodes can be divided into multiple groups, with terminals within the same group having the same configuration, this solution can also achieve the beneficial effects described in the invention.

[0090] According to the solution in this application, the goal of unified management of at least one terminal device using the same target strategy is achieved, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Simultaneously, the terminal device can actively monitor changes in its own strategy group and strategy, enabling more timely responses and faster strategy synchronization to the local machine. Furthermore, since the control center uses the same set of strategies for local use, page display, and terminal device monitoring, the problem of errors occurring during the conversion of multiple sets of strategy data can be avoided.

[0091] Example 2

[0092] According to the embodiments of this application, another embodiment of the policy update method is also provided, such as... Figure 3 As shown, the method includes the following steps:

[0093] Step S301: Monitor the update information of the target policy corresponding to the target policy group.

[0094] In step S301, the target policy group is the policy group that has undergone policy update among at least one policy group stored in the control center. The terminal device corresponding to each policy group in the at least one policy group executes the same policy. The policy is used to characterize the business rules that the terminal device needs to execute. The control center is a server used to manage at least one policy group.

[0095] Step S302: Update the local target policy stored in the target terminal device according to the update information and the policy identifier of the target policy.

[0096] In step S302, the target terminal device is the terminal device corresponding to the target policy group, and the policy identifier of the target policy is the same as the policy identifier of the local target policy.

[0097] In this embodiment, the target terminal device can serve as the execution subject of the policy update method in this embodiment. It should be noted that before the target terminal device listens for the update information of the target policy corresponding to the target policy group, the control center first obtains the device identifier corresponding to each of the multiple terminal devices. Then, based on the policy executed by each terminal device, the multiple device identifiers are grouped to obtain at least one policy group. If the policy corresponding to any one of the at least one policy group is updated, that policy group is determined to be the target policy group, and the updated policy is determined to be the target policy.

[0098] Optionally, the aforementioned terminal devices include, but are not limited to, various terminal devices such as smartphones, tablets, laptops, and desktop computers. The device identifier is a unique identifier for the terminal device; for example, it can be the terminal device's serial number (SN), IP address, MAC address, or a number assigned to the terminal device by a technician. The terminal device executes specific strategies during operation; however, the strategies executed by different terminal devices may differ. For example, for the finance department's terminal devices, a first information encryption strategy is required, which encrypts financial information such as account numbers, amounts, and fund flows. For the human resources department's terminal devices, a second information encryption strategy is required, which encrypts personnel information such as ID numbers and home addresses.

[0099] It should be noted that, as shown in Table 1, based on the existing one-to-one policy management method, if the finance department has N terminal devices that need to implement the first information encryption policy, the control center needs to store N policy records in the database.

[0100] Table 1

[0101] Strategy record number Terminal Identifier Strategy Identifier 1 Finance Department Terminal Equipment 1 First Information Encryption Strategy 2 Finance Department Terminal Equipment 2 First Information Encryption Strategy …… …… First Information Encryption Strategy N Finance Department Terminal Equipment N First Information Encryption Strategy

[0102] It's easy to notice that, similar to the maintenance method of the first information encryption strategy, if the HR department has M terminal devices that need to execute the second information encryption strategy, the control center needs to store M more strategy records in the database. As the number of strategies and terminal devices continues to increase, the control center's database storage resources will become increasingly strained.

[0103] This application manages terminal devices that execute the same strategy by placing them in a single strategy group, which significantly reduces the number of strategy records that need to be stored. As shown in Table 2, for the N terminal devices in the finance department mentioned above, according to the solution of this application, the control center only needs to store one strategy record, thereby greatly reducing the number of strategy records. This not only alleviates the storage pressure on the database but also improves the efficiency of strategy management.

[0104] Table 2

[0105] Strategy group identifier Terminal Identifier Strategy Identifier Strategy Group A Finance Department Terminal Equipment 1-N First Information Encryption Strategy

[0106] In one optional embodiment, assume the target policy group is policy group A, where the N terminal devices corresponding to policy group A are respectively Finance Department Terminal Device 1, Finance Department Terminal Device 2, ..., Finance Department Terminal Device N. Within policy group A, the N terminal devices simultaneously execute policy 1-1, policy 1-2, and policy 1-3. If the target policy to be updated is policy 1-1, then each of the N terminal devices needs to update its local policy 1-1 stored locally on the terminal device.

[0107] It is important to note that existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing the policy update. This application, however, maintains the correspondence between policies and at least one terminal device using the policy separately by grouping policies, thereby improving the stability of the policy update process and ensuring that no corresponding terminal device is missed in the update process.

[0108] As described above, this application achieves unified management of at least one terminal device using the same policy by grouping the device identifiers of terminal devices executing the same policy into the same policy group. For example, if multiple terminal devices use the same policy, this application only needs to maintain a single record of the device identifiers of these terminal devices and the same policy used by these terminal devices in the server's database, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Furthermore, existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing a policy update. This application, however, uses policy groups to maintain the correspondence between policies and at least one terminal device using the policy separately, thereby improving the stability of the policy update process and ensuring that updates for every corresponding terminal device are not missed.

[0109] Therefore, the technical solution of this application achieves the goal of reducing the amount of data that the server needs to store when managing the policies corresponding to the terminal devices, thereby improving the utilization rate of the server's storage resources and solving the technical problem of low storage resource utilization in the prior art when the server manages the policies corresponding to the terminal devices.

[0110] In one alternative embodiment, at least one policy group is stored in a target database of a control center, wherein the control center is a server for managing at least one policy group.

[0111] Optionally, the target database mentioned above is the etcd database. etcd is a distributed key-value storage database developed by CoreOS based on the Raft protocol, which can be used for service discovery, shared configuration, and consistency assurance. etcd has a listening function, allowing terminal devices to monitor one or a group of keys. When the value corresponding to a key changes, the terminal device receives a notification of the change.

[0112] The solution in this application uses the etcd database as the database in the control center to store at least one policy group, and implements the functions of querying, distributing and monitoring policy status.

[0113] In addition, the control center will check for idle groups within at least one policy group. Idle groups are policy groups that do not contain device identifiers. If an idle group is found in at least one policy group, the control center will delete the policy under the idle group and remove the idle group from the control center.

[0114] It's easy to understand that if a policy group in the control center has no device identifier, it means that the policy group will no longer manage any terminal devices. Therefore, the control center can delete the policies under that policy group to save database storage resources.

[0115] In one alternative embodiment, Figure 2 A schematic diagram illustrating the interaction between an optional control center and a terminal device according to an embodiment of this application is shown. Figure 2 As shown, when terminal device A connects to the control center, the control center assigns it a corresponding policy group 1 based on its attribute information and writes the group ID (policy group 1) into the terminal device A's configuration information. When terminal device A detects that its configuration information contains the group ID (policy group 1), it will actively retrieve all policies under policy group 1 to its local machine and begin monitoring all policies in policy group 1. If any policy changes, it will update the corresponding local policy.

[0116] Furthermore, if the control center moves terminal device A from policy group 1 to policy group 2, the control center will rewrite the group ID "policy group 1" in the configuration information of terminal device A to "policy group 2". After terminal device A detects this change in the configuration information, terminal device A will re-acquire the policies under policy group 2 and listen to the policies under policy group 2. If there is a policy change, the corresponding local policy will be updated.

[0117] In addition, such as Figure 2 As shown, when the control center needs to add a new group, it writes the policies for all new groups into the policy configuration of that group ID. All terminal devices under that group will immediately detect the change in group policy and receive the latest policy. Furthermore, administrators can directly view policy group information through the terminal security management system's display interface. This policy group information is directly provided by the control center's etcd database.

[0118] As described above, the solution presented in this application achieves the goal of unified management of at least one terminal device using the same target strategy, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Simultaneously, the terminal device can actively monitor changes in its own strategy group and strategy, enabling more timely responses and faster strategy synchronization to the local machine. Furthermore, since the control center uses the same set of strategies for local use, page display, and terminal device monitoring, the problem of errors occurring during the conversion of multiple sets of strategy data can be avoided.

[0119] Example 3

[0120] According to embodiments of this application, an embodiment of a policy update system is also provided, such as... Figure 4 As shown, the system includes:

[0121] The control center is used to obtain the device identifier corresponding to each of the multiple terminal devices, and group the multiple device identifiers according to the policy executed by each terminal device to obtain at least one policy group. The terminal devices corresponding to each policy group execute the same policy, and the policy is used to characterize the business rules that the terminal devices need to execute.

[0122] The target terminal device is used to monitor the update information of the target policy corresponding to the target policy group, and update the local target policy stored in the target terminal device according to the update information and the policy identifier of the target policy. The target policy group is a policy group that has undergone policy update in at least one policy group, the target terminal device is the terminal device corresponding to the target policy group, and the policy identifier of the target policy is the same as the policy identifier of the local target policy.

[0123] Optionally, the policy update system is also called an endpoint security management system. If the policy corresponding to any policy group in at least one policy group is updated, the policy update system determines that policy group as the target policy group and the updated policy as the target policy. Furthermore, the aforementioned endpoint devices include, but are not limited to, smartphones, tablets, laptops, desktop computers, and other various endpoint devices. The device identifier is a unique identifier for the endpoint device; for example, the device identifier can be the endpoint device's serial number, IP address, MAC address, or a number assigned to the endpoint device by a technician. The endpoint device executes specific policies during operation; however, the policies executed by multiple different endpoint devices may differ. For example, for the endpoint devices in the finance department, a first information encryption policy needs to be executed. According to the first information encryption policy, the finance department's endpoint devices will encrypt financial information such as account numbers, fund amounts, and fund flows. For the endpoint devices in the human resources department, a second information encryption policy needs to be executed. According to the second information encryption policy, the human resources department's endpoint devices will encrypt personnel information such as personnel ID numbers and home addresses.

[0124] It should be noted that, as shown in Table 1, based on the existing one-to-one policy management method, if the finance department has N terminal devices that need to implement the first information encryption policy, the control center needs to store N policy records in the database.

[0125] Table 1

[0126] Strategy record number Terminal Identifier Strategy Identifier 1 Finance Department Terminal Equipment 1 First Information Encryption Strategy 2 Finance Department Terminal Equipment 2 First Information Encryption Strategy …… …… First Information Encryption Strategy N Finance Department Terminal Equipment N First Information Encryption Strategy

[0127] It's easy to notice that, similar to the maintenance method of the first information encryption strategy, if the HR department has M terminal devices that need to execute the second information encryption strategy, the control center needs to store M more strategy records in the database. As the number of strategies and terminal devices continues to increase, the control center's database storage resources will become increasingly strained.

[0128] This application manages terminal devices that execute the same strategy by placing them in a single strategy group, which significantly reduces the number of strategy records that need to be stored. As shown in Table 2, for the N terminal devices in the finance department mentioned above, according to the solution of this application, the control center only needs to store one strategy record, thereby greatly reducing the number of strategy records. This not only alleviates the storage pressure on the database but also improves the efficiency of strategy management.

[0129] Table 2

[0130] Strategy group identifier Terminal Identifier Strategy Identifier Strategy Group A Finance Department Terminal Equipment 1-N First Information Encryption Strategy

[0131] In one optional embodiment, assume the target policy group is policy group A, where the N terminal devices corresponding to policy group A are respectively Finance Department Terminal Device 1, Finance Department Terminal Device 2, ..., Finance Department Terminal Device N. Within policy group A, the N terminal devices simultaneously execute policy 1-1, policy 1-2, and policy 1-3. If the target policy to be updated is policy 1-1, then each of the N terminal devices needs to update its local policy 1-1 stored locally on the terminal device.

[0132] It is important to note that existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing the policy update. This application, however, maintains the correspondence between policies and at least one terminal device using the policy separately by grouping policies, thereby improving the stability of the policy update process and ensuring that no corresponding terminal device is missed in the update process.

[0133] As described above, this application achieves unified management of at least one terminal device using the same policy by grouping the device identifiers of terminal devices executing the same policy into the same policy group. For example, if multiple terminal devices use the same policy, this application only needs to maintain a single record of the device identifiers of these terminal devices and the same policy used by these terminal devices in the server's database, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Furthermore, existing policy update methods do not maintain the correspondence between policies and at least one terminal device using the policy, which easily leads to update omissions. For example, during a policy update, a corresponding terminal device may not receive the update notification message, resulting in that terminal device not performing a policy update. This application, however, uses policy groups to maintain the correspondence between policies and at least one terminal device using the policy separately, thereby improving the stability of the policy update process and ensuring that updates for every corresponding terminal device are not missed.

[0134] Therefore, the technical solution of this application achieves the goal of reducing the amount of data that the server needs to store when managing the policies corresponding to the terminal devices, thereby improving the utilization rate of the server's storage resources and solving the technical problem of low storage resource utilization in the prior art when the server manages the policies corresponding to the terminal devices.

[0135] In one alternative embodiment, at least one policy group is stored in a target database of a control center, wherein the control center is a server for managing at least one policy group.

[0136] Optionally, the target database mentioned above is the etcd database. etcd is a distributed key-value storage database developed by CoreOS based on the Raft protocol, which can be used for service discovery, shared configuration, and consistency assurance. etcd has a listening function, allowing terminal devices to monitor one or a group of keys. When the value corresponding to a key changes, the terminal device receives a notification of the change.

[0137] The solution in this application uses the etcd database as the database in the control center to store at least one policy group, and implements the functions of querying, distributing and monitoring policy status.

[0138] In addition, the control center will check for idle groups within at least one policy group. Idle groups are policy groups that do not contain device identifiers. If an idle group is found in at least one policy group, the control center will delete the policy under the idle group and remove the idle group from the control center.

[0139] It's easy to understand that if a policy group in the control center has no device identifier, it means that the policy group will no longer manage any terminal devices. Therefore, the control center can delete the policies under that policy group to save database storage resources.

[0140] In one alternative embodiment, Figure 2 A schematic diagram illustrating the interaction between an optional control center and a terminal device according to an embodiment of this application is shown. Figure 2 As shown, when terminal device A connects to the control center, the control center assigns it a corresponding policy group 1 based on its attribute information and writes the group ID (policy group 1) into the terminal device A's configuration information. When terminal device A detects that its configuration information contains the group ID (policy group 1), it will actively retrieve all policies under policy group 1 to its local machine and begin monitoring all policies in policy group 1. If any policy changes, it will update the corresponding local policy.

[0141] Furthermore, if the control center moves terminal device A from policy group 1 to policy group 2, the control center will rewrite the group ID "policy group 1" in the configuration information of terminal device A to "policy group 2". After terminal device A detects this change in the configuration information, terminal device A will re-acquire the policies under policy group 2 and listen to the policies under policy group 2. If there is a policy change, the corresponding local policy will be updated.

[0142] In addition, such as Figure 2 As shown, when the control center needs to add a new group, it writes the policies for all new groups into the policy configuration of that group ID. All terminal devices under that group will immediately detect the change in group policy and receive the latest policy. Furthermore, administrators can directly view policy group information through the terminal security management system's display interface. This policy group information is directly provided by the control center's etcd database.

[0143] As described above, the solution presented in this application achieves the goal of unified management of at least one terminal device using the same target strategy, thereby reducing the data storage pressure on the database and improving the utilization rate of server storage resources. Simultaneously, the terminal device can actively monitor changes in its own strategy group and strategy, enabling more timely responses and faster strategy synchronization to the local machine. Furthermore, since the control center uses the same set of strategies for local use, page display, and terminal device monitoring, the problem of errors occurring during the conversion of multiple sets of strategy data can be avoided.

[0144] Example 4

[0145] According to embodiments of this application, an embodiment of a policy update device is also provided, such as... Figure 5 As shown, the device includes: an acquisition module 501, used to acquire the device identifier corresponding to each of a plurality of terminal devices; a grouping module 502, used to group the plurality of device identifiers according to the policy executed by each terminal device to obtain at least one policy group, wherein the terminal device corresponding to each policy group executes the same policy, and the policy is used to characterize the business rules that the terminal device needs to execute; a detection module 503, used to detect whether the policy corresponding to the policy group has been updated; a determination module 504, used to determine that the policy group is a target policy group and determine the updated policy as the target policy when the policy corresponding to the policy group has been updated; and an update module 505, used to update the local target policy stored in the target terminal device corresponding to the target policy group according to the policy identifier of the target policy and update information, wherein the policy identifier of the local target policy is the same as the policy identifier of the target policy.

[0146] Optionally, the grouping module described above further includes an acquisition unit and a grouping unit. The acquisition unit is used to acquire attribute information for each terminal device, wherein the attribute information is used to characterize the department to which the terminal device belongs, and terminal devices with the same attribute information execute the same policy. The grouping unit is used to group multiple device identifiers according to the attribute information to obtain at least one policy group.

[0147] Optionally, the policy update device further includes: a first detection module, a first determination module, and a movement module. The first detection module is used to detect whether the attribute information of the first terminal device has been updated, wherein the first terminal device is any one of a plurality of terminal devices, and the policy group corresponding to the first terminal device is a first policy group; the first determination module is used to determine, if the attribute information corresponding to the first terminal device has been updated, that the updated attribute information of the first terminal device is the target attribute information; the movement module is used to move the device identifier corresponding to the first terminal device from the first policy group to a second policy group according to the target attribute information, wherein the attribute information of the terminal device corresponding to the device identifier in the second policy group is the target attribute information.

[0148] Optionally, the policy update device further includes: a first update module, a second detection module, a second determination module, and a second update module. The first update module is used to update the local policy stored in the first terminal device to the policy in the second policy group; the second detection module is used to detect whether the policy corresponding to the second policy group has been updated; the second determination module is used to determine that the policy corresponding to the second policy group is a policy to be processed when it has been updated; the second update module is used to update the first local policy stored in the first terminal device according to the policy identifier of the policy to be processed and the update information of the policy to be processed, wherein the policy identifier of the first local policy is the same as the policy identifier of the policy to be processed.

[0149] Optionally, at least one policy group is stored in the target database of the control center, wherein the control center is a server used to manage at least one policy group.

[0150] Optionally, the policy update device further includes a third detection module and a deletion module. The third detection module is used to detect whether there are idle groups in at least one policy group, wherein an idle group is a policy group that does not contain a device identifier; the deletion module is used to delete the policies under the idle group when an idle group exists in at least one policy group, and to delete the idle group from the control center.

[0151] Example 5

[0152] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the policy update methods in Embodiments 1 and 2 above when running.

[0153] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0154] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0156] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0157] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0158] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0159] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A policy updating method characterized by comprising: The method comprises: obtaining a device identifier corresponding to each of a plurality of terminal devices; grouping a plurality of the device identifiers according to a policy executed by each of the terminal devices to obtain at least one policy group, wherein each of the policy groups corresponds to terminal devices executing the same policy, and the policy is used to represent a service rule required to be executed by the terminal device; detecting whether the policy corresponding to the policy group is updated; in a case where the policy corresponding to the policy group is updated, determining that the policy group is a target policy group, and determining that the policy that is updated is a target policy; updating a local target policy stored in a target terminal device corresponding to the target policy group according to a policy identifier and update information of the target policy, wherein the policy identifier of the local target policy is the same as the policy identifier of the target policy; wherein grouping a plurality of the device identifiers according to a policy executed by each of the terminal devices to obtain at least one policy group comprises: obtaining attribute information of each of the terminal devices, wherein the attribute information is used to represent a home department of the terminal device, and terminal devices with the same attribute information execute the same policy; and grouping a plurality of the device identifiers according to the attribute information to obtain at least one of the policy groups.

2. The method of claim 1, wherein, After grouping a plurality of the device identifiers according to the attribute information to obtain at least one of the policy groups, the method comprises: detecting whether attribute information of a first terminal device is updated, wherein the first terminal device is any one of a plurality of the terminal devices, and a policy group corresponding to the first terminal device is a first policy group; in a case where the attribute information corresponding to the first terminal device is updated, determining that updated attribute information of the first terminal device is target attribute information; moving a device identifier corresponding to the first terminal device from the first policy group to a second policy group according to the target attribute information, wherein terminal devices corresponding to device identifiers in the second policy group have the target attribute information.

3. The method of claim 2, wherein, After moving the device identifier corresponding to the first terminal device from the first policy group to the second policy group according to the target attribute information, the method further comprises: updating a local policy stored in the first terminal device to a policy in the second policy group; detecting whether the policy corresponding to the second policy group is updated; in a case where the policy corresponding to the second policy group is updated, determining that the policy is a to-be-processed policy; updating a first local policy stored in the first terminal device according to a policy identifier and update information of the to-be-processed policy, wherein the policy identifier of the first local policy is the same as the policy identifier of the to-be-processed policy.

4. The method of claim 1, wherein, At least one of the policy groups is stored in a target database of a control center, wherein the control center is a server used to manage at least one of the policy groups.

5. The method of claim 4, wherein, The method comprises: detecting whether an idle packet exists in at least one of the policy packets, wherein the idle packet is a policy packet that does not contain the device identifier; when the idle packet exists in at least one of the policy packets, deleting the policy under the idle packet and deleting the idle packet from the control center.

6. A policy updating method characterized by comprising: The method comprises: listening to update information of a target policy corresponding to a target policy packet, wherein the target policy packet is a policy packet in which a policy update occurs in at least one policy packet stored in a control center, each policy packet in the at least one policy packet corresponds to a terminal device that executes the same policy, the policy is used to represent a service rule that needs to be executed by the terminal device, and the control center is a server used to manage the at least one policy packet; updating a local target policy stored in a target terminal device according to the update information and a policy identifier of the target policy, wherein the target terminal device is a terminal device corresponding to the target policy packet, and the policy identifier of the target policy is the same as a policy identifier of the local target policy; wherein, before listening to the update information of the target policy corresponding to the target policy packet, the method further comprises: grouping a plurality of device identifiers according to the policy executed by each terminal device to obtain at least one policy packet, comprising: obtaining attribute information of each terminal device, wherein the attribute information is used to represent the home department of the terminal device, and terminal devices with the same attribute information execute the same policy; grouping a plurality of device identifiers according to the attribute information to obtain at least one policy packet; wherein, if a change in the policy packet in the configuration information is listened to, all policies under a new policy packet are obtained locally, and listening to the policies of the original policy packet is stopped, and whether a change in the policies of the new policy packet occurs is listened to.

7. A policy updating system characterized by comprising: The method comprises: a control center configured to obtain a device identifier corresponding to each terminal device in a plurality of terminal devices, and group a plurality of device identifiers according to a policy executed by each terminal device to obtain at least one policy packet, wherein each policy packet corresponds to a terminal device that executes the same policy, and the policy is used to represent a service rule that needs to be executed by the terminal device; a target terminal device configured to listen to update information of a target policy corresponding to a target policy packet, and update a local target policy stored in the target terminal device according to the update information and a policy identifier of the target policy, wherein the target policy packet is a policy packet in which a policy update occurs in at least one policy packet, the target terminal device is a terminal device corresponding to the target policy packet, and the policy identifier of the target policy is the same as a policy identifier of the local target policy. The device identifiers are grouped according to the policy executed by each terminal device, to obtain at least one policy group, including: obtaining attribute information of each terminal device, wherein the attribute information is used to represent the home department of the terminal device, and terminal devices with the same attribute information execute the same policy; and grouping the device identifiers according to the attribute information, to obtain at least one policy group.

8. A policy updating apparatus characterized by comprising: Including: The acquisition module is configured to acquire a device identifier corresponding to each terminal device in a plurality of terminal devices; The grouping module is configured to group the device identifiers according to a policy executed by each terminal device, to obtain at least one policy group, wherein terminal devices corresponding to each policy group execute the same policy, and the policy is used to represent a service rule required to be executed by the terminal device; The detection module is configured to detect whether the policy corresponding to the policy group exists in an update; The determination module is configured to determine that the policy group is a target policy group and a policy that has been updated is a target policy, in a case where the policy corresponding to the policy group exists in an update; The update module is configured to update a local target policy stored in a target terminal device corresponding to the target policy group according to a policy identifier and update information of the target policy, wherein the policy identifier of the local target policy is the same as the policy identifier of the target policy. The electronic device includes one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program for running, wherein the program is set to execute the policy update method in any one of claims 1-6 when running.

9. An electronic device, comprising: The electronic device includes one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program for running, wherein the program is set to execute the policy update method in any one of claims 1-6 when running.

Images