Multi-boundary entry protection detection method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a multi-border entry protection detection method and device, electronic equipment and storage medium, relating to the technical field of computer, constructing a multi-subdomain network structure, wherein the multi-subdomain network structure includes network resources contained in each subdomain; a border firewall is set at the border of the multi-subdomain network structure, and a preset access rule is configured to obtain a configuration rule list of the border firewall; rules in the configuration rule list of each border firewall are converted into initial configuration quadruples, and the initial configuration quadruples are de-duplicated to obtain target configuration quadruples; a local IP is obtained and hashed to obtain LocalIP; LocalIP is compared with hash(SRC) in the target configuration quadruples; if the comparison result is completely consistent, it is determined that the protection performance of the border firewall is high, the effectiveness of each border firewall can be accurately judged, and the protection detection efficiency of the firewall is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a detection method, apparatus, electronic device, and storage medium for multi-boundary approach protection. Background Technology

[0002] In an enterprise's network architecture, there are office areas and production business areas. For security control purposes, the same data center is typically divided into different network subdomains, and then boundary firewalls are placed in each subdomain. This is used to control the inbound traffic of information assets across different network subdomains.

[0003] However, after configuring numerous ACL (Access Control List) rules, it is impossible to accurately confirm whether these ACL rules have achieved the purpose of access control. Existing technologies often rely on the personal experience of security administrators to make judgments, which often leads to misjudgments or low efficiency. Summary of the Invention

[0004] To address the aforementioned technical problems, embodiments of this application provide a detection method, apparatus, electronic device, and storage medium for multi-boundary approach protection.

[0005] In a first aspect, embodiments of this application provide a detection method for multi-boundary approach protection, the method comprising:

[0006] Construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes the network resources contained in each subdomain;

[0007] A boundary firewall is set up at the boundary of the multi-subdomain network structure, and preset access rules are configured to obtain a list of configuration rules for the boundary firewall.

[0008] The rules in the configuration rule list of each of the border firewalls are converted into initial configuration quadtuples, and the initial configuration quadtuples are deduplicated to obtain the target configuration quadtuples.

[0009] Obtain the local IP and hash it to get the LocalIP. Compare the LocalIP with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high.

[0010] According to a specific embodiment disclosed in this application, the step of deduplicating the initial configuration quadtuple to obtain the target configuration quadtuple includes:

[0011] Calculate whether each initial configuration quadruple has an inclusion relationship;

[0012] If an inclusion relationship exists, each of the initial configuration quadruples will be split into two configuration quadruples.

[0013] According to a specific embodiment disclosed in this application, the step of converting the rules in the configuration rule lists of each of the border firewalls into initial configuration quadtuples, and deduplicating the initial configuration quadtuples to obtain the target configuration quadtuples includes:

[0014] Hash the SRC in each of the initial configuration quadruples.

[0015] According to a specific embodiment disclosed in this application, after the step of obtaining the local IP and hashing it to obtain the LocalIP, comparing the LocalIP with the hash (SRC) in the target configuration four-tuple, and determining that the border firewall has high protection performance if the comparison results are completely consistent, the method further includes:

[0016] Identify the actions in the target configuration quadruple and determine the result of the actions;

[0017] If the result of the action is DENY and a connectivity call test can be performed, then the target configuration quadruple is marked as false.

[0018] If the result of the action is ALLOW and connectivity call testing cannot be performed, then the target configuration quadruple is marked as false.

[0019] Secondly, embodiments of this application provide a detection device for multi-boundary approach protection, the device comprising:

[0020] A construction module is used to construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes the network resources contained in each subdomain;

[0021] The configuration module is used to set up a boundary firewall at the boundary of the multi-subdomain network structure, configure preset access rules, and obtain a list of configuration rules for the boundary firewall.

[0022] The conversion module is used to convert the rules in the configuration rule list of each border firewall into initial configuration quadtuples, and to deduplicate the initial configuration quadtuples to obtain the target configuration quadtuples.

[0023] The comparison module is used to obtain the local IP and perform a hash to obtain the LocalIP. The LocalIP is then compared with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high.

[0024] According to a specific embodiment disclosed in this application, the conversion module is specifically used for:

[0025] Calculate whether each initial configuration quadruple has an inclusion relationship;

[0026] If an inclusion relationship exists, each of the initial configuration quadruples will be split into two configuration quadruples.

[0027] According to a specific embodiment disclosed in this application, the conversion module is specifically used for:

[0028] Hash the SRC in each of the initial configuration quadruples.

[0029] According to a specific embodiment disclosed in this application, the comparison module is specifically used for:

[0030] Identify the actions in the target configuration quadruple and determine the result of the actions;

[0031] If the result of the action is DENY and a connectivity call test can be performed, then the target configuration quadruple is marked as false.

[0032] If the result of the action is ALLOW and connectivity call testing cannot be performed, then the target configuration quadruple is marked as false.

[0033] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the computer program executes the multi-boundary approach protection detection method provided in the first aspect when the processor is running.

[0034] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a processor, executes the multi-boundary approach protection detection method provided in the first aspect.

[0035] The multi-border inbound protection detection method provided in this application constructs a multi-subdomain network structure, wherein the multi-subdomain network structure includes network resources contained in each subdomain; a border firewall is set at the boundary of the multi-subdomain network structure, and preset access rules are configured to obtain a configuration rule list for the border firewall; the rules in the configuration rule list of each border firewall are converted into initial configuration quadtuples, and the initial configuration quadtuples are deduplicated to obtain a target configuration quadtuple; the local IP is obtained and hashed to obtain the LocalIP; the LocalIP is compared with the hash (SRC) in the target configuration quadtuple; if the comparison result is completely consistent, it is determined that the protection performance of the border firewall is high, which can accurately determine the effectiveness of each border firewall and improve the detection efficiency of the firewall. Attached Figure Description

[0036] To more clearly illustrate the technical solutions of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be considered as a limitation on the scope of protection of this application. In the various drawings, similar components are numbered similarly.

[0037] Figure 1 A flowchart illustrating the detection method for multi-boundary approach protection provided in an embodiment of this application is shown.

[0038] Figure 2 This paper shows a schematic diagram of the structure of the detection device for multi-boundary approach protection provided in an embodiment of this application;

[0039] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0040] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0041] The components of the embodiments of this application described and illustrated in the accompanying drawings can be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0042] In the following, the terms “comprising,” “having,” and their cognates, which may be used in various embodiments of this application, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as excluding, firstly, the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more features, numbers, steps, operations, elements, components, or combinations thereof.

[0043] Furthermore, the terms "first," "second," and "third" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0044] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of this application pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be construed as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of this application.

[0045] Example 1

[0046] This disclosure provides a detection method for multi-boundary incoming protection.

[0047] For details, see Figure 1 The method includes:

[0048] Step S101: Construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes the network resources contained in each subdomain.

[0049] Specifically, the multi-subdomain network structure refers to a network structure that includes multiple network subdomains. Each network subdomain will allocate business services or server resources as needed. For example, each subdomain will have SVC01~SVC[N], that is, n network resources.

[0050] Step S102: Set up a border firewall at the boundary of the multi-subdomain network structure and configure preset access rules to obtain a configuration rule list for the border firewall.

[0051] Specifically, placing border firewalls at the boundaries of each network resource allows for control over incoming network traffic. The preset access rules are the service access rules configured by the user according to their needs. The configuration rules of each border firewall are summed together to obtain the border firewall configuration rule list.

[0052] Step S103: Convert the rules in the configuration rule list of each border firewall into initial configuration quadtuples, and deduplicate the initial configuration quadtuples to obtain the target configuration quadtuples.

[0053] Understandably, the configuration rule list of each border firewall can be obtained by initiating border probe requests to each network subdomain, and all rules can be processed into an initial configuration quadruple. The format of the initial configuration quadruple is B1:SRC:DEST:ACTION, where B1 represents the rule for border 1.

[0054] The step of deduplicating the initial configuration quadtuple to obtain the target configuration quadtuple includes:

[0055] Calculate whether each initial configuration quadruple has an inclusion relationship;

[0056] If an inclusion relationship exists, each of the initial configuration quadruples will be split into two configuration quadruples.

[0057] Specifically, for rules that access the same target resource, the need for deduplication is determined by calculating whether such rules have an inclusion relationship. For example, if 192.168.0.2 / 32 and 192.168.0.2 / 31 access the same resource address 10.1.0.2:8080, then 192.168.0.2 / 32 and 192.168.0.2 / 31 have an intersection 192.168.0.2 / 32. After expanding 192.168.0.2 / 31, it becomes 192.168.0.2 / 32 and 192.168.0.3 / 32. Therefore, the duplicate addresses need to be removed to obtain the initial configuration quadruple.

[0058] The step of converting the rules in the configuration rule lists of each of the border firewalls into initial configuration quadtuples, and deduplicating the initial configuration quadtuples to obtain the target configuration quadtuples includes:

[0059] Hash the SRC in each of the initial configuration quadruples.

[0060] Step S104: Obtain the local IP and hash it to obtain the LocalIP. Compare the LocalIP with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high.

[0061] Understandably, the protective capability of the border firewall can be determined by comparing the string of the local IP address with the string of the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, the border firewall is determined to have high protective performance.

[0062] After the steps of obtaining the local IP and hashing it to obtain the LocalIP, comparing the LocalIP with the hash (SRC) in the target configuration four-tuple, and determining that the perimeter firewall has high protection performance if the comparison results are completely consistent, the method further includes:

[0063] Identify the actions in the target configuration quadruple and determine the result of the actions;

[0064] If the result of the action is DENY and a connectivity call test can be performed, then the target configuration quadruple is marked as false.

[0065] If the result of the action is ALLOW and connectivity call testing cannot be performed, then the target configuration quadruple is marked as false.

[0066] The multi-boundary inbound protection detection method provided in this embodiment constructs a multi-subdomain network structure, wherein the multi-subdomain network structure includes network resources contained in each subdomain; a boundary firewall is set at the boundary of the multi-subdomain network structure, and preset access rules are configured to obtain a configuration rule list for the boundary firewall; the rules in the configuration rule list of each boundary firewall are converted into initial configuration quadtuples, and the initial configuration quadtuples are deduplicated to obtain a target configuration quadtuple; the local IP is obtained and hashed to obtain the LocalIP; the LocalIP is compared with the hash (SRC) in the target configuration quadtuple; if the comparison result is completely consistent, it is determined that the protection performance of the boundary firewall is high, which can accurately judge the effectiveness of each boundary firewall and improve the protection detection efficiency of the firewall.

[0067] Example 2

[0068] Furthermore, embodiments of this disclosure provide a detection device 200 for multi-boundary approach protection.

[0069] Specifically, see Figure 2 The device includes:

[0070] The construction module 201 is used to construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes network resources contained in each subdomain;

[0071] Configuration module 202 is used to set up a boundary firewall at the boundary of the multi-subdomain network structure and configure preset access rules to obtain a list of configuration rules for the boundary firewall.

[0072] The conversion module 203 is used to convert the rules in the configuration rule list of each border firewall into an initial configuration quadruple, and to deduplicate the initial configuration quadruple to obtain the target configuration quadruple.

[0073] The comparison module 204 is used to obtain the local IP and perform a hash to obtain the LocalIP. The LocalIP is compared with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high.

[0074] The conversion module is specifically used for:

[0075] Calculate whether each initial configuration quadruple has an inclusion relationship;

[0076] If an inclusion relationship exists, each of the initial configuration quadruples will be split into two configuration quadruples.

[0077] The conversion module is specifically used for:

[0078] Hash the SRC in each of the initial configuration quadruples.

[0079] The comparison module is specifically used for:

[0080] Identify the actions in the target configuration quadruple and determine the result of the actions;

[0081] If the result of the action is DENY and a connectivity call test can be performed, then the target configuration quadruple is marked as false.

[0082] If the result of the action is ALLOW and connectivity call testing cannot be performed, then the target configuration quadruple is marked as false.

[0083] This embodiment provides a multi-boundary approach protection detection device 200 that can perform the multi-boundary approach protection detection method shown in Embodiment 1. To avoid repetition, it will not be described again here.

[0084] The multi-boundary inbound protection detection device provided in this embodiment constructs a multi-subdomain network structure, wherein the multi-subdomain network structure includes network resources contained in each subdomain; a boundary firewall is set at the boundary of the multi-subdomain network structure, and preset access rules are configured to obtain a configuration rule list for the boundary firewall; the rules in the configuration rule list of each boundary firewall are converted into initial configuration quadtuples, and the initial configuration quadtuples are deduplicated to obtain a target configuration quadtuple; the local IP is obtained and hashed to obtain the LocalIP, and the LocalIP is compared with the hash (SRC) in the target configuration quadtuple. If the comparison result is completely consistent, it is determined that the protection performance of the boundary firewall is high, which can accurately judge the effectiveness of each boundary firewall and improve the protection detection efficiency of the firewall.

[0085] Example 3

[0086] Furthermore, this disclosure provides an electronic device 300, including a memory and a processor. The memory stores a computer program, which, when executed on the processor, performs the multi-boundary approach protection detection method provided in Embodiment 1 above.

[0087] For details, see Figure 3 The electronic device 300 includes: a transceiver 301, a bus interface, and a processor 302.

[0088] In this embodiment of the invention, the electronic device 300 further includes a memory 303. Figure 3In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 302) and memory (memory 303). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 301 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 302 is responsible for managing the bus architecture and general processing, and the memory 303 can store data used by the processor 302 during operation.

[0089] The electronic device 300 provided in this embodiment of the invention can execute the multi-boundary approach protection detection method shown in Embodiment 1. To avoid repetition, it will not be described again here.

[0090] Example 4

[0091] In this embodiment, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0092] The computer-readable storage medium provided in this embodiment 4 can execute the multi-boundary approach protection detection method shown in embodiment 1. To avoid repetition, it will not be described again here.

[0093] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes that element.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0095] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A detection method for multi-boundary approach protection, characterized in that, The method includes: Construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes the network resources contained in each subdomain; A boundary firewall is set up at the boundary of the multi-subdomain network structure, and preset access rules are configured to obtain a list of configuration rules for the boundary firewall. The rules in the configuration rule list of each of the border firewalls are converted into initial configuration quadtuples, and the initial configuration quadtuples are deduplicated to obtain the target configuration quadtuples. Obtain the local IP and hash it to get the LocalIP. Compare the LocalIP with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high. The step of deduplicating the initial configuration quadtuple to obtain the target configuration quadtuple includes: Calculate whether there is an inclusion relationship between each initial configuration quadruple; if there is an inclusion relationship, split each initial configuration quadruple into two configuration quadruples. The process of obtaining the local IP address and hashing it to obtain the LocalIP, comparing the LocalIP with the hash (SRC) in the target configuration tuple, and determining the high protection performance of the border firewall if the comparison results are completely consistent, further includes: identifying the action in the target configuration tuple and judging the result of the action; if the result of the action is DENY and a connectivity call test can be performed, then the target configuration tuple is marked as false; if the result of the action is ALLOW and a connectivity call test cannot be performed, then the target configuration tuple is marked as false.

2. The method according to claim 1, characterized in that, The step of converting the rules in the configuration rule lists of each of the border firewalls into initial configuration quadtuples, and deduplicating the initial configuration quadtuples to obtain the target configuration quadtuples includes: Hash the SRC in each of the initial configuration quadruples.

3. A detection device for multi-boundary approach protection, characterized in that, The device includes: A construction module is used to construct a multi-subdomain network structure, wherein the multi-subdomain network structure includes the network resources contained in each subdomain; The configuration module is used to set up a boundary firewall at the boundary of the multi-subdomain network structure, configure preset access rules, and obtain a list of configuration rules for the boundary firewall. The conversion module is used to convert the rules in the configuration rule list of each border firewall into initial configuration quadtuples, and to deduplicate the initial configuration quadtuples to obtain the target configuration quadtuples. The comparison module is used to obtain the local IP and perform a hash to obtain the LocalIP. The LocalIP is then compared with the hash (SRC) in the target configuration quadruple. If the comparison results are completely consistent, it is determined that the protection performance of the border firewall is high. Specifically, the conversion module is used to: calculate whether there is an inclusion relationship between each initial configuration quadruple; if there is an inclusion relationship, split each initial configuration quadruple into two configuration quadruples; Specifically, the comparison module is used to: identify the action in the target configuration quadruple and determine the result of the action; if the result of the action is DENY and a connectivity call test can be performed, then the target configuration quadruple is marked as false; if the result of the action is ALLOW and a connectivity call test cannot be performed, then the target configuration quadruple is marked as false.

4. The apparatus according to claim 3, characterized in that, The conversion module is specifically used for: Hash the SRC in each of the initial configuration quadruples.

5. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program that executes the multi-boundary approach protection detection method according to any one of claims 1 to 2 when the processor is running.

6. A computer-readable storage medium, characterized in that, It stores a computer program that, when run on a processor, executes the multi-boundary approach protection detection method according to any one of claims 1 to 2.

Images