Acl rule ordering adjustment method and apparatus, computer device, and medium

Abstract

The application provides an ACL rule sorting adjustment method and device, computer equipment and medium, comprising: when it is monitored that a session update occurs, obtaining first session index item data corresponding to the updated session; calculating a first session index item weight value corresponding to the first session index item data; updating a current ACL rule sorting linked list based on a size relationship between the first session index item weight value and a weight value corresponding to each ACL rule in the current ACL rule sorting linked list, and each ACL rule in the current ACL rule sorting linked list is sorted in descending order of the respective corresponding weight value. Through the application, the priority of the ACL strategy is dynamically adjusted by calculating the weight value, the time complexity is infinitely close to O(1), and the efficiency of the general network message matching is improved. Specifically, the ACL rule sorting adjustment method provided by the application can improve the matching efficiency for general network messages; for non-general network messages and abnormal messages, the method can delay the path time limit.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an ACL rule sorting adjustment method, device, computer equipment, and medium. Background Art

[0002] Access Control Lists (ACLs) are a packet-filtering access control technology consisting of a series of rules. By matching packets against ACL rules, the device can filter packets on an interface based on the specified conditions, allowing them to pass, discarding them, or taking other actions. ACLs effectively control user access to the network, thereby maximizing network security.

[0003] In the existing technology, since ACL rules are arranged linearly in memory, the kernel's HOOK matches them one by one by traversing the rule chain. When the number of rules reaches a certain number, inefficient matching and performance bottleneck problems will occur. Summary of the Invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the performance bottleneck problem in the prior art, thereby providing an ACL rule sorting adjustment method, apparatus, computer equipment and medium.

[0005] In conjunction with the first aspect, the present invention provides a method for adjusting ACL rule order, the method comprising:

[0006] When a session update is detected, obtaining first session indicator item data corresponding to the updated session;

[0007] Calculating a first session indicator item weight value corresponding to the first session indicator item data;

[0008] Based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list, the current ACL rule sorting list is updated, and the ACL rules in the current ACL rule sorting list are sorted in descending order according to their corresponding weight values.

[0009] In this approach, the ACL policy priority is dynamically adjusted by calculating the weight value, making the time complexity infinitely close to O(1), thereby improving the efficiency of matching normal network messages. Specifically, the ACL rule sorting adjustment method provided by the present invention can improve the matching efficiency for normal network messages; for non-normal network messages and abnormal messages, since the ACL rules matching such messages have a relatively low priority, it can play a role in delaying the path timeliness.

[0010] In combination with the first aspect, in a first embodiment of the first aspect, updating the current ACL rule sorting list based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list includes:

[0011] Determine whether there is a target ACL rule corresponding to the updated session in the current ACL rule sorting linked list;

[0012] When a target ACL rule corresponding to the updated session exists in the current ACL rule sorting chain table, determining a target sorting position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule sorting chain table;

[0013] The target ACL rule is adjusted from the current sorting position to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list are adjusted in sequence.

[0014] In combination with the first embodiment of the first aspect, in a second embodiment of the first aspect, when the target ACL rule corresponding to the updated session does not exist in the current ACL rule sorting list, a target sorting position corresponding to the target ACL rule is determined based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule sorting list;

[0015] The target ACL rule is added to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list are adjusted in sequence.

[0016] In combination with the first embodiment of the first aspect, in a third embodiment of the first aspect, determining the target sorting position corresponding to the target ACL rule based on a magnitude relationship between the weight value of the first session indicator item and the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list includes:

[0017] Determine whether the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list;

[0018] When the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, determining a weight value sorting position of the first session indicator item in the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list;

[0019] The weight value sorting position is determined as the target sorting position corresponding to the target ACL rule.

[0020] In combination with the third embodiment of the first aspect, in the fourth embodiment of the first aspect, when the weight value of the first session indicator item is not greater than the current weight value of the target ACL rule in the current ACL rule sorting list, the current sorting position of each target ACL rule in the current ACL rule sorting list is maintained.

[0021] In combination with the third embodiment of the first aspect, in a fifth embodiment of the first aspect, the method further includes:

[0022] When the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, the current weight value is updated based on the weight value of the first session indicator item.

[0023] In combination with the second embodiment of the first aspect, in a sixth embodiment of the first aspect, after adding the target ACL rule to the target sorting position, the method further includes:

[0024] The weight value of the first session indicator item is determined as the current weight value of the target ACL rule in the current ACL rule sorting list.

[0025] In a second aspect of the present invention, the present invention further provides an ACL rule order adjustment device, the device comprising:

[0026] an acquiring unit, configured to acquire first session indicator item data corresponding to the updated session when a session update is detected;

[0027] a weight calculation unit, configured to calculate a first session indicator item weight value corresponding to the first session indicator item data;

[0028] The ACL rule sorting unit is configured to update the current ACL rule sorting chain table based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting chain table, wherein the ACL rules in the current ACL rule sorting chain table are sorted in descending order according to their corresponding weight values.

[0029] In combination with the second aspect, in a first embodiment of the second aspect, the ACL rule sorting unit includes:

[0030] A first determining unit is configured to determine whether there is a target ACL rule corresponding to the updated session in the current ACL rule sorting linked list;

[0031] a first ranking determining unit configured to, when a target ACL rule corresponding to the updated session exists in the current ACL rule ranking chain table, determine a target ranking position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule ranking chain table;

[0032] The first adjusting unit adjusts the target ACL rule from the current sorting position to the target sorting position, and sequentially adjusts the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list.

[0033] In combination with the first embodiment of the second aspect, in a second embodiment of the second aspect, the ACL rule sorting unit further includes:

[0034] a second ranking determining unit, configured to determine, when a target ACL rule corresponding to the updated session does not exist in the current ACL rule ranking chain table, a target ranking position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule ranking chain table;

[0035] The second adjusting unit is configured to add the target ACL rule to the target sorting position and sequentially adjust the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list.

[0036] In combination with the first embodiment of the second aspect, in a third embodiment of the second aspect, the first ranking determination unit includes:

[0037] a second judging unit, configured to judge whether the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting linked list;

[0038] a first determining subunit, configured to determine a weight value ranking position of the first session indicator item among weight values ​​corresponding to respective ACL rules in the current ACL rule sorting list when the weight value of the first session indicator item is greater than a current weight value of the target ACL rule in the current ACL rule sorting list;

[0039] The first sorting subunit is configured to determine the weight value sorting position as a target sorting position corresponding to the target ACL rule.

[0040] In combination with the third embodiment of the second aspect, in a fourth embodiment of the second aspect, the first determining subunit further includes:

[0041] The maintaining unit maintains the current sorting position of each target ACL rule in the current ACL rule sorting list when the weight value of the first session indicator item is not greater than the current weight value of the target ACL rule in the current ACL rule sorting list.

[0042] In combination with the third embodiment of the second aspect, in a fifth embodiment of the second aspect, the first determining subunit further includes:

[0043] The updating subunit is configured to update the current weight value based on the first session indicator item weight value when the first session indicator item weight value is greater than the current weight value of the target ACL rule in the current ACL rule sorting list.

[0044] In combination with the second embodiment of the second aspect, in a sixth embodiment of the second aspect, the ACL rule sorting unit further includes:

[0045] The weight value updating unit is configured to determine the weight value of the first session indicator item as the current weight value of the target ACL rule in the current ACL rule sorting linked list.

[0046] According to a third aspect, an embodiment of the present invention further provides a computer device, comprising a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the ACL rule sorting adjustment method of the first aspect and any one of its optional embodiments by executing the computer instructions.

[0047] According to a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium storing computer instructions for causing the computer to execute the ACL rule order adjustment method of the first aspect and any one of its optional embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 The present invention is a flowchart of a method for adjusting the order of ACL rules proposed according to an exemplary embodiment.

[0050] Figure 2 The present invention is a flowchart of an ACL rule priority adjustment proposed according to an exemplary embodiment.

[0051] Figure 3 It is a structural block diagram of an ACL rule order adjustment device proposed according to an exemplary embodiment.

[0052] Figure 4 The figure is a schematic diagram of the hardware structure of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0053] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0054] In related technologies, ACL (Access Control List) is an access control technology based on packet filtering. It consists of a series of rules. By matching messages with ACL rules, the device can filter the data packets on the interface according to the set conditions, allowing them to pass, discard them, or take other actions. With the help of ACL access control lists, user access to the network can be effectively controlled, thereby maximizing network security. Because ACL rules are arranged linearly in memory, the kernel's HOOK matches them one by one by traversing the rule chain. When the number of rules reaches a certain number, inefficient matching and performance bottlenecks will occur.

[0055] To solve the above problems, an embodiment of the present invention provides an ACL rule sorting adjustment method for use in a computer device. It should be noted that its execution subject can be an ACL rule sorting adjustment device, which can be implemented as part or all of the computer device through software, hardware, or a combination of software and hardware. The computer device can be a terminal, a client, or a server. The server can be a single server or a server cluster composed of multiple servers. The terminal in the embodiment of this application can be a smart phone, a personal computer, a tablet computer, a wearable device, an intelligent robot, or other intelligent hardware devices. In the following method embodiments, the execution subject is a computer device as an example for explanation.

[0056] The computer device in this embodiment is suitable for use in scenarios where messages are matched with ACL rules. The ACL rule sorting and adjustment method provided by the present invention can dynamically adjust the ACL policy priority by calculating the weight value, making the time complexity infinitely close to O(1), thereby improving the efficiency of matching normal network messages. Specifically, the ACL rule sorting and adjustment method provided by the present invention can improve the matching efficiency for normal network messages; for non-normal network messages and abnormal messages, since the ACL rule priority for matching such messages is relatively low, it can play a role in delaying the path timeliness.

[0057] Figure 1 This is a flow chart of a method for adjusting the order of ACL rules proposed according to an exemplary embodiment. Figure 1 As shown, the ACL rule order adjustment method includes the following steps S101 to S103.

[0058] In step S101, when a session update is detected, first session indicator item data corresponding to the updated session is obtained.

[0059] In the embodiment of the present invention, when a session is updated, session metrics are updated synchronously. Session metrics include: last packet sending time, session duration, number of packets, number of bytes, average response time, and maximum response time.

[0060] In step S102, a first conversation indicator item weight value corresponding to the first conversation indicator item data is calculated.

[0061] In an embodiment of the present invention, after receiving the first session indicator item data corresponding to the updated session, in order to facilitate sorting of the ACL rules corresponding to the updated session, the weight value corresponding to the updated session indicator item is calculated to clarify the priority of the session and its corresponding ACL rule.

[0062] In one example, the weight value corresponding to the session indicator item can be calculated using the entropy method, using the weight calculation formula: Calculate the session indicator item weight value corresponding to the session indicator item data. The method for calculating the session indicator item weight value is not limited in the present invention. Example session indicator items are shown in Table 1.

[0063] Table 1

[0064]

[0065]

[0066] In step S103, based on the relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list, the current ACL rule sorting list is updated, and the ACL rules in the current ACL rule sorting list are sorted in descending order according to their corresponding weight values.

[0067] In the embodiment of the present invention, in order to improve the efficiency of matching messages with ACL rules, the priorities of ACL rules are adjusted, and the ACL rule sorting list is further adjusted to make the ACL rule sorting more reasonable.

[0068] In an embodiment of the present invention, the ACL policy priority is dynamically adjusted by calculating the weight value, so that the time complexity is infinitely close to O(1), thereby improving the efficiency of general network packet matching. Based on the relationship between the weight value of the first session indicator item and the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list, the current ACL rule sorting list is updated, including:

[0069] Determine whether the target ACL rule corresponding to the updated session exists in the current ACL rule sorting list;

[0070] When a target ACL rule corresponding to the updated session exists in the current ACL rule sorting list, the target sorting position corresponding to the target ACL rule is determined based on the relationship between the weight value of the first session indicator item and the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list. The target ACL rule is adjusted from the current sorting position to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting list are adjusted in sequence.

[0071] When the target ACL rule corresponding to the updated session does not exist in the current ACL rule sorting list, the target sorting position corresponding to the target ACL rule is determined based on the relationship between the weight value of the first session indicator item and the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list; the target ACL rule is added to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting list are adjusted in sequence.

[0072] In an embodiment of the present invention, determining a target sorting position corresponding to a target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in a current ACL rule sorting list includes:

[0073] Determine whether the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list; when the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, determine the weight value sorting position of the first session indicator item weight value in the weight values ​​corresponding to each ACL rule in the current ACL rule sorting list; and determine the weight value sorting position as the target sorting position corresponding to the target ACL rule.

[0074] In one example, the weight values ​​of the three existing session index items corresponding to the same ACL rule are 1, 2, and 3 respectively. When the ACL rule corresponding to the updated session is the same, the weight value of the session index item is 1, and compared with the weight values ​​of the previous three sessions, it is not greater than the weight values ​​of the previous three sessions, and the sorting position of the current ACL rule remains unchanged; when the ACL rule corresponding to the updated session is the same, and the weight value of the session index item is 4, and compared with the weight values ​​of the previous three sessions, it is greater than the weight values ​​of the previous three sessions, and the sorting position of the current ACL rule is updated.

[0075] In an embodiment of the present invention, to ensure the real-time performance of the ACL rule sorting list, when the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, the current weight value is updated based on the weight value of the first session indicator item.

[0076] In the embodiment of the present invention, after the target ACL rule is added to the target sorting position, the weight value of the first session indicator item is determined as the current weight value of the target ACL rule in the current ACL rule sorting linked list.

[0077] Figure 2 FIG. 1 is a flow chart of an ACL rule priority adjustment proposed according to an exemplary embodiment. Figure 2 As shown, in one example, ACL rule priority adjustment may include:

[0078] Determine whether the ACL rule corresponding to the session is in the ACL sorting list:

[0079] When the ACL rule is not in the ACL sorting list, the ACL rule ID is determined based on the session indicator item weight value; and the ACL rule is inserted into the ACL sorting list based on the ACL rule ID.

[0080] When an ACL rule is in the ACL sorting list, determine whether the weight of the ACL rule ID is greater than the weight of the updated session indicator item:

[0081] If the weight of the ACL rule ID is greater than the weight of the updated session indicator, the priority of the ACL rule in the ACL sorting list is maintained unchanged, and an ACL sorting list matching the session is obtained.

[0082] If the weight of the ACL rule ID is not greater than the updated session indicator weight, determine whether the current ACL rule ID satisfies the following conditions: the post-weight is greater than the updated session indicator weight and the pre-weight is less than the updated session indicator weight:

[0083] When the ACL rule ID satisfies the requirement that the post-weight value is greater than the updated session indicator item weight value and the pre-weight value is less than the updated session indicator item weight value, the updated session indicator item weight value is used as the ACL rule ID weight value to determine the priority of the ACL rule.

[0084] If the ACL rule ID does not satisfy the requirement that the post-weight value is greater than the updated session indicator weight value and the pre-weight value is less than the updated session indicator weight value, the ACL rule is removed from the ACL rule sorting list. Based on the weight value of the ACL rule ID, the priority of the ACL rule is determined, and the ACL rule is inserted into the corresponding position in the ACL rule sorting list.

[0085] Through the above embodiment, the ACL policy priority is dynamically adjusted by calculating the weight value, making the time complexity infinitely close to O(1), thereby improving the efficiency of matching normal network messages. Specifically, the ACL rule sorting adjustment method provided by the present invention can improve the matching efficiency for normal network messages; for non-normal network messages and abnormal messages, since the ACL rules matching such messages have a relatively low priority, it can play a role in delaying the path timeliness.

[0086] Based on the same inventive concept, the present invention also provides an ACL rule sorting adjustment device.

[0087] Figure 3 This is a structural block diagram of an ACL rule sorting adjustment device proposed according to an exemplary embodiment. Figure 3 As shown, the ACL rule order adjustment device includes an acquisition unit 301 , a weight calculation unit 302 and an ACL rule ordering unit 303 .

[0088] The acquiring unit 301 is configured to acquire first session indicator item data corresponding to the updated session when a session update is detected;

[0089] A weight calculation unit 302 is configured to calculate a first session indicator item weight value corresponding to the first session indicator item data;

[0090] The ACL rule sorting unit 303 is configured to update the current ACL rule sorting list based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list. The ACL rules in the current ACL rule sorting list are sorted in descending order according to their corresponding weight values.

[0091] In one embodiment, the ACL rule sorting unit 303 includes: a first determining unit configured to determine whether a target ACL rule corresponding to the updated session exists in the current ACL rule sorting list; a first sorting determining unit configured to determine, when a target ACL rule corresponding to the updated session exists in the current ACL rule sorting list, a target sorting position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule sorting list; and a first adjusting unit configured to adjust the target ACL rule from the current sorting position to the target sorting position, and to sequentially adjust the sorting positions of the remaining ACL rules in the current ACL rule sorting list.

[0092] In another embodiment, the ACL rule sorting unit 303 further includes: a second sorting determination unit, configured to determine a target sorting position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule sorting list, when the target ACL rule corresponding to the updated session does not exist in the current ACL rule sorting list; and a second adjustment unit, configured to add the target ACL rule to the target sorting position and sequentially adjust the sorting positions of the remaining ACL rules in the current ACL rule sorting list.

[0093] In another embodiment, the first ranking determination unit includes: a second judgment unit, configured to judge whether the weight value of the first session metric item is greater than the current weight value of the target ACL rule in the current ACL rule ranking list; a first determination subunit, configured to determine a weight value ranking position of the first session metric item among the weight values ​​corresponding to the ACL rules in the current ACL rule ranking list when the weight value of the first session metric item is greater than the current weight value of the target ACL rule in the current ACL rule ranking list; and a first ranking subunit, configured to determine the weight value ranking position as a target ranking position corresponding to the target ACL rule.

[0094] In another embodiment, the first determining subunit further includes: a maintaining unit, which maintains the current sorting position of each target ACL rule in the current ACL rule sorting list when the weight value of the first session indicator item is not greater than the current weight value of the target ACL rule in the current ACL rule sorting list.

[0095] In another embodiment, the first determining subunit further includes: an updating subunit, configured to update the current weight value based on the first session indicator item weight value when the first session indicator item weight value is greater than the current weight value of the target ACL rule in the current ACL rule sorting list.

[0096] In another embodiment, the ACL rule sorting unit 303 further includes: a weight value updating unit, configured to determine the weight value of the first session indicator item as the current weight value of the target ACL rule in the current ACL rule sorting linked list.

[0097] The specific limitations and beneficial effects of the ACL rule order adjustment device can be found in the above-mentioned limitations of the ACL rule order adjustment method and will not be further elaborated here. Each of the above modules can be implemented in whole or in part via software, hardware, or a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0098] Figure 4 FIG. 1 is a schematic diagram of the hardware structure of a computer device according to an exemplary embodiment. Figure 4 As shown, the device includes one or more processors 410 and a memory 420, and the memory 420 includes a persistent memory, a volatile memory, and a hard disk. Figure 4 The apparatus may further include an input device 430 and an output device 440.

[0099] The processor 410, the memory 420, the input device 430 and the output device 440 may be connected via a bus or other means. Figure 4 The bus connection is taken as an example.

[0100] The processor 410 may be a central processing unit (CPU). The processor 410 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. The general-purpose processor may be a microprocessor or any conventional processor.

[0101] Memory 420, as a non-transitory computer-readable storage medium, includes persistent memory, volatile memory, and a hard disk, and can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the program instructions / modules corresponding to the service management method in the embodiments of the present application. Processor 410 executes the non-transitory software programs, instructions, and modules stored in memory 420 to execute various server functional applications and data processing, thereby implementing any of the aforementioned ACL rule ordering adjustment methods.

[0102] The memory 420 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data required for use, etc. In addition, the memory 420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 420 may optionally include a memory remotely located relative to the processor 410, and these remote memories may be connected to the data processing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0103] The input device 430 can receive input digital or character information and generate key signal input related to user settings and function control. The output device 440 can include a display device such as a display screen.

[0104] One or more modules are stored in the memory 420 and when executed by one or more processors 410, perform the following operations: Figure 1-Figure 2 The method shown.

[0105] The above-mentioned product can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. Figure 1-Figure 2 Related description of the embodiment shown.

[0106] An embodiment of the present invention further provides a non-transitory computer storage medium storing computer-executable instructions that can execute the authentication method of any of the above method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); the storage medium can also include a combination of the above types of memory.

[0107] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications based on the above descriptions are possible. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. A method for adjusting the order of ACL rules, characterized in that: The method comprises: When a session update is detected, first session metric data corresponding to the updated session is obtained; the first session metric data includes: the last packet sending time of the session, the session duration, the number of data packets, the number of session bytes, the average response time of the session, and the maximum response time of the session; Calculating a first session indicator item weight value corresponding to the first session indicator item data; Based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list, the current ACL rule sorting list is updated, and the ACL rules in the current ACL rule sorting list are sorted in descending order according to their corresponding weight values.

2. The method according to claim 1, characterized in that The updating of the current ACL rule sorting linked list based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting linked list includes: Determine whether there is a target ACL rule corresponding to the updated session in the current ACL rule sorting linked list; When a target ACL rule corresponding to the updated session exists in the current ACL rule sorting chain table, determining a target sorting position corresponding to the target ACL rule based on a relationship between a weight value of the first session indicator item and weight values ​​corresponding to each ACL rule in the current ACL rule sorting chain table; The target ACL rule is adjusted from the current sorting position to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list are adjusted in sequence.

3. The method according to claim 2, characterized in that When the target ACL rule corresponding to the updated session does not exist in the current ACL rule sorting chain table, determining a target sorting position corresponding to the target ACL rule based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting chain table; The target ACL rule is added to the target sorting position, and the sorting positions of the remaining ACL rules in the current ACL rule sorting chain list are adjusted in sequence.

4. The method according to claim 2, characterized in that The determining, based on a magnitude relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list, of a target sorting position corresponding to the target ACL rule includes: Determine whether the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list; When the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, determining a weight value sorting position of the first session indicator item in the weight values ​​corresponding to the ACL rules in the current ACL rule sorting list; The weight value sorting position is determined as the target sorting position corresponding to the target ACL rule.

5. The method according to claim 4, characterized in that When the weight value of the first session indicator item is not greater than the current weight value of the target ACL rule in the current ACL rule sorting list, the current sorting position of each target ACL rule in the current ACL rule sorting list is maintained.

6. The method according to claim 4, characterized in that Also includes: When the weight value of the first session indicator item is greater than the current weight value of the target ACL rule in the current ACL rule sorting list, the current weight value is updated based on the weight value of the first session indicator item.

7. The method according to claim 3, characterized in that After adding the target ACL rule to the target sorting position, the method further includes: The weight value of the first session indicator item is determined as the current weight value of the target ACL rule in the current ACL rule sorting list.

8. An ACL rule sorting adjustment device, characterized in that: The device comprises: an acquiring unit, configured to acquire first session indicator data corresponding to the updated session upon detecting a session update; the first session indicator data including: last packet sending time of the session, session duration, number of data packets, number of bytes in the session, average response time of the session, and maximum response time of the session; a weight calculation unit, configured to calculate a first session indicator item weight value corresponding to the first session indicator item data; The ACL rule sorting unit is configured to update the current ACL rule sorting chain table based on a relationship between the weight value of the first session indicator item and the weight values ​​corresponding to the ACL rules in the current ACL rule sorting chain table, wherein the ACL rules in the current ACL rule sorting chain table are sorted in descending order according to their corresponding weight values.

9. A computer device, characterized in that: The system comprises a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the ACL rule sorting adjustment method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the ACL rule order adjustment method according to any one of claims 1 to 7.

Images