Firewall policy conflict detection method and device

Abstract

The present invention provides a firewall policy conflict detection method and device, the firewall policy conflict detection method comprising: obtaining a policy to be detected; determining a target packet filtering policy corresponding to the policy to be detected based on a preset policy matching tree; and determining that the policy to be detected is a non-conflicting policy when it is determined that the third matching domain range does not belong to the fourth matching domain range. The method of the present invention determines the target packet policy by matching the policy to be detected with the policy matching tree, and then verifies whether there is an intersection between the matching domain ranges corresponding to the policy to be detected and any matching domain in the target packet policy to determine whether the policy to be detected is a conflicting policy. Each time a policy is added, the target packet filtering policy can be obtained by comparing only a number of matching domains, which reduces the workload of comparing one by one and improves the efficiency of detecting conflicting policies.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a firewall policy conflict detection method and device. Background Art

[0002] There are usually conflicting policies among the multiple policies matched by the message. The conflicting policies do not have a real filtering effect on the data packets of the message, but increase the number of policy matches, affecting system performance.

[0003] In the related art, when a user adds a policy to a firewall policy list, conflict detection is performed, and the newly added policy is compared with all existing policies one by one. During this process, a policy usually contains multiple matching domains, and each matching domain also needs to be matched in turn. If the number of policies in the firewall policy list is large (for example, the number reaches tens of thousands), the detection time increases accordingly, resulting in low policy detection efficiency. Summary of the invention

[0004] The present invention provides a firewall policy conflict detection method and device, which are used to solve the defect in the prior art that when performing conflict policy detection, a new policy needs to be compared with all policies in the firewall policy list one by one, and the detection time increases with the increase of the number of policies, resulting in low policy detection efficiency, thereby improving the conflict policy detection efficiency.

[0005] The present invention provides a firewall policy conflict detection method, comprising:

[0006] Acquire a policy to be detected, where the policy to be detected includes multiple matching domains, each matching domain corresponds to a first matching domain range;

[0007] Based on a preset policy matching tree, determine a target packet filtering policy corresponding to the policy to be detected, the policy matching tree includes multiple packet filtering policies, each of the packet filtering policies includes the multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain;

[0008] When it is determined that the third matching domain range does not belong to the fourth matching domain range, the policy to be detected is determined to be a non-conflicting policy, the third matching domain range is a first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is a second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

[0009] According to a firewall policy conflict detection method provided by the present invention, the first matching domain range includes a first value interval, and the first value interval includes a plurality of continuous matching domain ranges;

[0010] The step of determining the target packet filtering policy corresponding to the policy to be detected based on the preset policy matching tree includes:

[0011] Based on the minimum value of the first value interval corresponding to the multiple matching domains and the second matching domain range corresponding to the multiple packet filtering policies, determine the packet filtering policy in which the second matching domain range and the minimum value of the first value interval intersect as the target packet filtering policy;

[0012] In the case where it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy includes:

[0013] When it is determined that the minimum value of the third matching domain range does not belong to the fourth matching domain range, the policy to be detected is determined to be a non-conflicting policy.

[0014] According to a firewall policy conflict detection method provided by the present invention, the first matching domain range includes a first value interval, and the first value interval includes a plurality of continuous matching domain ranges;

[0015] The step of determining the target packet filtering policy corresponding to the policy to be detected based on the preset policy matching tree includes:

[0016] Based on the maximum value of the first value interval corresponding to the multiple matching domains and the second matching domain range corresponding to the multiple 5-packet filtering policies, determine the second matching domain range and the

[0017] The packet filtering policy for which the maximum values ​​of the first value interval have an intersection is the target packet filtering policy;

[0018] In the case where it is determined that the third matching domain range does not belong to the fourth matching domain range,

[0019] Determining the strategy to be detected as a non-conflicting strategy includes: determining that the maximum value of the third matching domain range does not belong to the fourth matching domain range

[0020] In the case of the conflicting environment, it is determined that the strategy to be detected is a non-conflicting strategy.

[0021] According to a firewall policy conflict detection method provided by the present invention, the policy matching tree is obtained by the following steps:

[0022] Determining the first matching domain as a root node of the policy matching tree;

[0023] 5 Divide the first matching domain into multiple first matching domain intervals according to the length of the matching domain range of the first matching domain.

[0024] A first matching domain interval is associated with at least one packet filtering policy;

[0025] Obtaining the leaf node based on the multiple first matching domain intervals and associating at least one packet filtering policy with each of the first matching domain intervals;

[0026] In the case where the fourth matching domain corresponds to at least one leaf node, and at least one matching domain interval corresponding to the at least one leaf node 0 is associated with a packet filtering policy, the policy is obtained.

[0027] The fourth matching domain is a matching domain other than the first matching domain in the plurality of matching domains.

[0028] According to a firewall policy conflict detection method provided by the present invention, the method further includes:

[0029] 5. If the target packet filtering policy does not exist in the policy matching tree, determine

[0030] The strategy to be detected is a non-conflicting strategy.

[0031] According to a firewall policy conflict detection method provided by the present invention, the multiple matching fields include: a protocol number field, a source port field, a destination port field, a source address field and a destination address field.

[0032] The present invention also provides a firewall policy conflict detection device, comprising:

[0033] An acquisition module, used for acquiring a policy to be detected, wherein the policy to be detected includes a plurality of matching domains, each matching domain corresponding to a first matching domain range;

[0034] A matching module, used for determining a target packet filtering policy corresponding to the policy to be detected based on a preset policy matching tree, wherein the policy matching tree includes multiple packet filtering policies, each of which includes the multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain;

[0035] A determination module is used to determine that the policy to be detected is a non-conflicting policy when it is determined that the third matching domain range does not belong to the fourth matching domain range, the third matching domain range is any one of the first matching domain ranges corresponding to the multiple matching domains, the fourth matching domain range is one of the second matching domain ranges corresponding to the multiple matching domains, and the third matching domain range and the fourth matching domain range belong to the same matching domain.

[0036] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned firewall policy conflict detection methods is implemented.

[0037] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the firewall policy conflict detection method as described above is implemented.

[0038] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the firewall policy conflict detection method as described above is implemented.

[0039] The firewall policy conflict detection method and device provided by the present invention determine the target packet policy by matching the policy to be detected with the policy matching tree, and then verify whether the matching domain ranges corresponding to any matching domain in the policy to be detected and the target packet policy respectively have an intersection to determine whether the policy to be detected is a conflicting policy. Each time a policy is added, the target packet filtering policy can be obtained by comparing only a number of matching domains, thereby reducing the workload of one-by-one comparison and improving the efficiency of detecting conflicting policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 It is a flow chart of the firewall policy conflict detection method provided by the present invention;

[0042] Figure 2 It is a schematic diagram of interaction between the strategy to be detected and the strategy matching tree provided by the present invention;

[0043] Figure 3 It is a structural schematic diagram of a firewall policy conflict detection device provided by the present invention;

[0044] Figure 4 It is a schematic diagram of the physical structure of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Combine the following Figure 1-Figure 3 The present invention describes a firewall policy conflict detection method and device.

[0047] Figure 1 The following is a flow chart of a firewall policy conflict detection method provided by the present invention. The firewall policy conflict detection method comprises the following steps:

[0048] Step 110: Obtain a policy to be detected, where the policy to be detected includes multiple matching domains, each matching domain corresponding to a first matching domain range.

[0049] In this embodiment, the policy to be detected includes a policy newly added to the firewall policy list, and the matching domain type corresponding to the policy to be detected is the same as the matching domain type included in the known policy in the firewall policy list.

[0050] For example, when the policies in the firewall policy list include the protocol number field, the source port field, and the source address field, the policies to be detected added to the firewall policy list should also include the protocol number field, the source port field, and the source address field, so that conflicting policy detection can be completed by matching the same type of matching fields.

[0051] In this embodiment, the number of policies included in the firewall policy list and the different matching domain information corresponding to each policy can be customized according to user needs.

[0052] In this embodiment, the multiple matching domains include but are not limited to the matching domains corresponding to the five-tuple information. For example, the multiple matching domains can be one or more of the protocol number domain, source port domain, destination port domain, source address domain, and destination address domain, and can also be other matching domains.

[0053] Step 120: Based on a preset policy matching tree, determine the target packet filtering policy corresponding to the policy to be detected, the policy matching tree includes multiple packet filtering policies, each packet filtering policy includes multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as the root node and the second matching domain as the leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain.

[0054] In this step, multiple match domains in the firewall policy correspond to a domain value range, namely, a match domain range. Different types of policies contain the same type of match domains, but the match domain ranges corresponding to the same match domain contained in different policies are not exactly the same.

[0055] In this step, the policy matching tree is a conflict policy analysis tree constructed based on the existing policies in the firewall policy list. When constructing the policy matching tree, the same matching domain of all existing policies is regarded as a whole. Each matching domain is divided into several intervals according to the actual needs of the user. Each interval only saves the matching domain range that appears in this interval and a pointer to the next matching domain.

[0056] In this step, the target packet filtering policy may be one policy in the firewall policy list or multiple policies. The number of target packet filtering policies is determined according to the number of policy matching results of the to-be-detected policy in the policy matching tree.

[0057] In this embodiment, there are 5 packet filtering policies in the firewall policy list, each of which includes 3 matching domains, namely: protocol number domain, source port domain, and source address domain. The domain value range of the protocol number domain is 0-15, the domain value range of the source port domain is 0-15, and the domain value range of the source address domain is 0-20; the second matching domain ranges corresponding to the three matching domains in policy R1 are: (2-8), (8-12) and (2-12), respectively, and the second matching domain ranges corresponding to the three matching domains in policy R2 are: (11-13), (4-8) and (4-13). and (8-10), the second matching domain ranges corresponding to the three matching domains in strategy R3 are (7-9), (11-13) and (11-15), respectively; the second matching domain ranges corresponding to the three matching domains in strategy R4 are (2-3), (7-15) and (3-6), respectively; the second matching domain ranges corresponding to the three matching domains in strategy R5 are (4-8), (2-8) and (7-17), respectively; the first matching domain ranges corresponding to the three matching domains in the strategy R6 to be detected are (9), (12-15) and (6-11), respectively.

[0058] In this embodiment, the first matching field may be any one of a protocol number field, a source port field, and a source address field.

[0059] In this embodiment, the second matching domain range associated with each interval may be the matching domain range corresponding to the packet filtering policy stored in the interval. The packet filtering policy stored in each interval is related to the interval length and the matching domain range. For example, one interval may store one packet filtering policy, another interval may store two packet filtering policies, and the divided interval corresponding to the leaf node of the root node may not store a packet filtering policy.

[0060] Step 130: When it is determined that the third matching domain range does not belong to the fourth matching domain range, determine that the policy to be detected is a non-conflicting policy, the third matching domain range is the first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is the second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

[0061] In this embodiment, the third matching domain range belongs to the fourth matching domain range, and the end value of the third matching domain range may be within the range of the fourth matching domain range.

[0062] In this step example, when the third matching domain range is a fixed value, it has only one end value; when the third matching domain range corresponds to a matching domain range, its end values ​​include a left end value and a right end value, that is, the minimum value and the maximum value of the matching domain range.

[0063] For example, the first matching domain ranges corresponding to the three matching domains in the policy R6 to be detected are (9), (12-15) and (6-11) respectively, the target packet filtering policy is R1, and the fourth matching domain range corresponding to R1 can be (2-8). Then the third matching domain range corresponding to the policy R6 to be detected is (9). Since (9) is not within the range of (2-8), the policy R6 to be detected can be considered as a non-conflicting policy.

[0064] In this embodiment, the third matching domain range corresponding to the policy to be detected R6 can also be (12-15), then the fourth matching domain range corresponding to R1 is (8-12); the third matching domain range corresponding to the policy to be detected R6 can also be (6-11), then the fourth matching domain range corresponding to R1 is (2-12); as long as the matching domain range of any matching domain in the target packet filtering policy has no intersection with the matching domain range of the corresponding matching domain in the policy to be detected, it can be proved that the policy to be detected has no conflict with the policy in the firewall list.

[0065] The firewall policy conflict detection method provided by the embodiment of the present invention determines the target packet policy by matching the policy to be detected with the policy matching tree, and then verifies whether there is an intersection between the matching domain ranges corresponding to any matching domain in the policy to be detected and the target packet policy to determine whether the policy to be detected is a conflicting policy. Each time a policy is added, only a comparison of several matching domains is required to obtain the target packet filtering policy, which reduces the workload of one-by-one comparison and improves the efficiency of detecting conflicting policies.

[0066] In some embodiments, the first matching domain range includes a first value interval, and the first value interval includes multiple continuous matching domain ranges; based on a preset policy matching tree, determining a target packet filtering policy corresponding to the policy to be detected, including: based on a minimum value of the first value interval corresponding to multiple matching domains and a second matching domain range corresponding to multiple packet filtering policies, determining that the packet filtering policy in which the second matching domain range and the minimum value of the first value interval intersect is the target packet filtering policy; when it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy, including: when it is determined that the minimum value of the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy.

[0067] In this embodiment, the matching domain range corresponding to the matching domain of the packet filtering policy includes a fixed value or a value range. When the first matching domain range includes the first value interval, it is only necessary to take the left end value of the first value interval, that is, the minimum value of the first value interval as a reference object to determine whether the third matching domain range corresponding to the policy to be detected is within the range of the fourth matching domain range of the target packet filtering policy.

[0068] Figure 2 is an interactive schematic diagram of the matching between the strategy to be detected and the strategy matching tree provided by the present invention. Figure 2 In the illustrated embodiment, the matching domain range corresponding to the minimum value of the first value interval in R6 is 9, 12 or 6. In the protocol number domain, the interval that intersects with R6 is interval b, and the packet filtering policies stored in interval b are: R1, R2 and R5; in the source port domain, the interval that intersects with R6 is interval i, and the packet filtering policies stored in interval i are: R1 and R3; in the source address domain, the interval that intersects with R6 is interval q, and the packet filtering policy stored in interval q is: R1; then in the protocol number domain, source port domain and source address domain, the packet filtering policy that intersects with the policy to be detected R6 is R1, and therefore, R1 is the target packet filtering policy.

[0069] In this embodiment, the first matching domain ranges corresponding to the three matching domains in the policy R6 to be detected are (9), (12-15) and (6-11) respectively, the target packet filtering policy is R1, and the fourth matching domain range corresponding to R1 can be (2-8). It is only necessary to compare one of the matching domain ranges 9, 12 or 6 in R6 with the corresponding item in the second matching domain range (2-8), (8-12) or (2-12) in R1. For example, if the matching domain range (9) in R6 is not within the second matching domain range (2-8) in R1, it can be explained that the policy R6 to be detected is a non-conflicting policy.

[0070] The firewall policy conflict detection method provided by the embodiment of the present invention matches the minimum value of the first matching domain range of each matching domain in the policy to be detected with the second matching domain range of the corresponding matching domain in the policy matching tree, determines that the packet filtering policy in which each matching domain in the policy to be detected and the corresponding matching domain in the policy matching tree have an intersection is the target packet filtering policy, and then judges whether the minimum value of the matching domain range of each matching domain in the policy to be detected is within the matching domain range of the corresponding matching domain in the target packet filtering policy, so as to determine whether the policy to be detected is a conflicting policy, reduce the number of matches, and improve the matching efficiency of the policy to be detected in the policy matching tree.

[0071] In some embodiments, the first matching domain range includes a first value interval, and the first value interval includes multiple continuous matching domain ranges; based on a preset policy matching tree, determining a target packet filtering policy corresponding to the policy to be detected, including: based on the maximum value of the first value interval corresponding to multiple matching domains and the second matching domain ranges corresponding to multiple packet filtering policies, determining that the packet filtering policy in which the second matching domain range and the maximum value of the first value interval intersect is the target packet filtering policy; when it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy, including: when it is determined that the maximum value of the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy.

[0072] In this embodiment, the matching domain range corresponding to the matching domain of the packet filtering policy includes a fixed value or a value range. When the first matching domain range includes the first value interval, the right end value of the first value interval, that is, the maximum value of the first value interval is taken as a reference object to determine whether the third matching domain range corresponding to the policy to be detected is within the range of the fourth matching domain range of the target packet filtering policy.

[0073] In this embodiment, the matching domain range corresponding to the maximum value of the first value interval in R6 is 9, 15 or 11. In the protocol number domain, if the packet filtering policies that intersect with R6 are: R1, R2 and R5; in the source port domain, if the packet filtering policies that intersect with R6 are: R1 and R5; in the source address domain, if the packet filtering policies that intersect with R6 are: R5; then in the protocol number domain, source port domain and source address domain, the packet filtering policy that intersects with the policy to be detected R6 is R5, therefore, R5 is the target packet filtering policy.

[0074] In this embodiment, the first matching domain ranges corresponding to the three matching domains in the policy R6 to be detected are (9), (12-15) and (6-11), respectively. The target packet filtering policy is R5, and the fourth matching domain range corresponding to R5 can be (2-8). It is only necessary to compare one of the matching domain ranges 9, 15 or 11 in R6 with the corresponding item in the second matching domain range (4-8), (2-8) or (7-17) in R1. For example, if the matching domain range 15 in R6 is not within the second matching domain range (2-8) in R1, it can be explained that the policy R6 to be detected is a non-conflicting policy.

[0075] The firewall policy conflict detection method provided by the embodiment of the present invention matches the maximum value of the first matching domain range of each matching domain in the policy to be detected with the second matching domain range of the corresponding matching domain in the policy matching tree, determines that the packet filtering policy in which each matching domain in the policy to be detected and the corresponding matching domain in the policy matching tree have an intersection is the target packet filtering policy, and then judges whether the maximum value of the matching domain range of each matching domain in the policy to be detected is within the matching domain range of the corresponding matching domain in the target packet filtering policy, so as to determine whether the policy to be detected is a conflicting policy, reduce the number of matches, and improve the matching efficiency of the policy to be detected in the policy matching tree.

[0076] In this embodiment, the policy matching tree is obtained through the following steps: determining the first matching domain as the root node of the policy matching tree; dividing a plurality of first matching domain intervals according to the length of the matching domain range of the first matching domain, each first matching domain interval being associated with at least one packet filtering policy; obtaining leaf nodes based on the plurality of first matching domain intervals and each first matching domain interval being associated with at least one packet filtering policy; obtaining a policy matching tree when the fourth matching domain corresponds to at least one leaf node, and at least one matching domain interval corresponding to at least one leaf node is associated with a packet filtering policy, and the fourth matching domain is other matching domains among the plurality of matching domains except the first matching domain.

[0077] In this embodiment, the number of layers of the matching tree is the same as the number of matching domains included in the packet filtering policy.

[0078] In this embodiment, the root node of the policy matching tree may include the second matching domain ranges corresponding to the protocol number domains in R1 to R5, that is, the root node includes: {(2-8), (11-13), (11-13), (7-9) and (2-3)}, the source port domain or the source address domain can serve as a leaf node of the root node, and the matching domain range contained in the leaf node is determined according to the policies associated with different intervals in the root node.

[0079] For example, the matching domain corresponding to the root node is divided into space a, space b and space c. The policies stored in space a include R1, R4 and R5, the policies stored in space b include R1, R3 and R5, and the policies stored in space c include R2. When the source port domain is used as the leaf node of the root node, there are three matching domains corresponding to the leaf node, which are the three intervals of the root node and the number of policies stored in each interval. If the leaf node also has child nodes, for example, when multiple matching domains also include the source address domain, the matching domain corresponding to each leaf node can be further divided into several spaces, each of which corresponds to storing at least one policy or no stored policy, until the last matching domain. The leaf node pointed to by each interval of the last matching domain stores the data of the remaining policies, thereby obtaining a policy matching tree.

[0080] In this embodiment, the root node may also include the second matching domain ranges corresponding to the source port domains or source address domains in R1 to R5 respectively, and accordingly, the leaf nodes or child nodes are other matching domains in the multiple matching domains except the matching domain corresponding to the root node.

[0081] The firewall policy conflict detection method provided by the embodiment of the present invention selects the first matching domain as the root node from multiple matching domains, divides the first matching domain into multiple intervals, stores a certain number of packet filtering policies in each interval, and uses each interval as a leaf node of the fourth matching domain until the construction of the corresponding nodes of all matching domains is completed to obtain a policy matching tree, thereby providing a model basis for simplifying the number of matches of the policies to be detected, thereby improving the efficiency of conflict policy detection.

[0082] In some embodiments, the method further includes: when there is no target packet filtering policy in the policy matching tree, determining that the policy to be detected is a non-conflicting policy.

[0083] In this embodiment, if the matching domain range of the policy to be detected cannot find a target packet filtering policy during the process of matching the matching domain ranges corresponding to each matching domain in the policy matching tree, the policy to be detected can be directly used as a non-conflicting policy.

[0084] exist Figure 2In the illustrated embodiment, if the first matching domain ranges corresponding to each matching domain in the policy R6 to be detected are 2, 2, and 11 respectively, in the protocol number domain, there is an interval a that intersects with 2, and the strategies stored in interval a are R1 and R4; in the source port domain, there are intervals d and g that intersect with 2, and the strategies stored in interval d and interval g are both R5. Since there is no intersection between the corresponding packet filtering policies in the protocol number domain and the source port domain of the policy R6 to be detected, R6 can be directly considered as a non-conflicting strategy.

[0085] The firewall policy conflict detection method provided by the embodiment of the present invention directly determines that the policy to be detected is a non-conflicting policy when the target filtering policy cannot be found after the matching domain range of the policy to be detected is matched with the matching domain ranges corresponding to each matching domain in the policy matching tree, thereby improving the detection efficiency of the conflicting policies.

[0086] In some embodiments, the multiple matching fields include: a protocol number field, a source port field, a destination port field, a source address field, and a destination address field.

[0087] In this embodiment, the multiple matching domains may be quintuples respectively, which are used to complete the packet filtering policy conflict detection process.

[0088] In other embodiments, the number and type of matching domains may be increased according to user requirements to satisfy policy detection in different application scenarios.

[0089] The firewall policy conflict detection method provided by the embodiment of the present invention sets the quintuple as different types of matching domains and applies them to the firewall conflict policy detection process, thereby improving the practicability of the conflict policy detection method.

[0090] The following is a description of the firewall policy conflict detection device provided by the present invention. The firewall policy conflict detection device described below and the firewall policy conflict detection method described above can be referred to in conjunction with each other.

[0091] Figure 3 It is a structural diagram of a firewall policy conflict detection device provided by the present invention. The firewall policy conflict detection device includes: an acquisition module 310, a matching module 320 and a determination module 330.

[0092] An acquisition module 310 is used to acquire a policy to be detected, where the policy to be detected includes multiple matching domains, each matching domain corresponds to a first matching domain range;

[0093] A matching module 320 is used to determine a target packet filtering policy corresponding to the policy to be detected based on a preset policy matching tree, wherein the policy matching tree includes multiple packet filtering policies, each packet filtering policy includes multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain;

[0094] The determination module 330 is used to determine that the policy to be detected is a non-conflicting policy when it is determined that the third matching domain range does not belong to the fourth matching domain range, the third matching domain range is the first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is the second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of multiple matching domains.

[0095] The firewall policy conflict detection device provided by the embodiment of the present invention determines the target packet policy by matching the policy to be detected with the policy matching tree, and then verifies whether there is an intersection between the matching domain ranges corresponding to the policy to be detected and any matching domain in the target packet policy to determine whether the policy to be detected is a conflicting policy. Each time a policy is added, only a comparison of several matching domains is required to obtain the target packet filtering policy, which reduces the workload of one-by-one comparison and improves the efficiency of detecting conflicting policies.

[0096] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor (processor) 410, a communication interface (Communications Interface) 420, a memory (memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the firewall policy conflict detection method, which includes: obtaining a policy to be detected, the policy to be detected includes multiple matching domains, each matching domain corresponds to a first matching domain range; based on a preset policy matching tree, determining a target packet filtering policy corresponding to the policy to be detected, the policy matching tree includes multiple packet filtering policies, each packet filtering policy includes multiple matching domains corresponding to a second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval of the multiple intervals included in the first matching domain; when it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy, the third matching domain range is the first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is the second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

[0097] In addition, the logic instructions in the memory 430 can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer programmable

[0098] Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including:

[0099] The instructions are used to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention.

[0100] The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0101] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program can be stored in a non-transitory computer readable storage medium

[0102] In essence, when the computer program is executed by a processor, the computer can execute the firewall policy conflict detection method provided by the above methods, the method comprising: obtaining a policy to be detected, the policy to be detected comprising a plurality of matching domains, each matching domain corresponding to a first matching domain range;

[0103] Based on the preset policy matching tree, determine the target packet filtering policy corresponding to the policy to be detected. The policy matching tree includes multiple packet filtering policies, each of which includes multiple matching domains corresponding to

[0104] The second matching domain range, the target packet filtering policy is at least one of the multiple packet filtering policies;

[0105] The policy matching tree is obtained by taking the first matching domain as the root node and the second matching domain as the leaf node. The first matching domain is one of the multiple matching domains. The second matching domain includes

[0106] The second matching domain range associated with each of the multiple intervals is obtained; in the case where it is determined that the third matching domain range does not belong to the fourth matching domain range, the strategy to be detected is determined to be non-conflicting

[0107] strategy, the third matching domain range is the first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is the second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

[0108] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is executed by a processor to perform the above-mentioned

[0109] The method provides a firewall policy conflict detection method, the method comprising: obtaining a policy to be detected, wherein the policy to be detected comprises a plurality of matching domains, each matching domain corresponding to a first matching domain range;

[0110] Based on a preset policy matching tree, determine a target packet filtering policy corresponding to the policy to be detected, the policy matching tree includes multiple packet filtering policies, each packet filtering policy includes multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies;

[0111] The strategy matching tree is obtained by taking the first matching domain as the root node and the second matching domain as the leaf node. The first matching domain is one of the multiple matching domains. The second matching domain includes

[0112] The second matching domain range associated with each of the multiple intervals is obtained; when it is determined that the third matching domain range does not belong to the fourth matching domain range, the strategy to be detected is determined to be a non-conflicting strategy, and the third matching domain range is the first matching domain corresponding to the third matching domain in the strategy to be detected.

[0113] The fourth matching domain range is the fifth second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

[0114] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., may be located in one place or may not be physically separate.

[0115] It can be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] It can be understood and implemented without creative labor.

[0117] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform.

[0118] Based on this understanding, the above technical solution, in essence or in other words, the part that contributes to the existing technology, can be embodied in the form of a software product.

[0119] The software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A firewall policy conflict detection method, characterized in that: include: Acquire a policy to be detected, where the policy to be detected includes multiple matching domains, each matching domain corresponds to a first matching domain range; Based on a preset policy matching tree, determine a target packet filtering policy corresponding to the policy to be detected, the policy matching tree includes multiple packet filtering policies, each packet filtering policy includes the multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain; In the case where it is determined that the third matching domain range does not belong to the fourth matching domain range, the policy to be detected is determined to be a non-conflicting policy, the third matching domain range is a first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is a second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains; The strategy matching tree is obtained through the following steps: Determining the first matching domain as a root node of the policy matching tree; Divide a plurality of first matching domain intervals according to the length of the matching domain range of the first matching domain, and associate each first matching domain interval with at least one packet filtering policy; Obtaining the leaf node based on the multiple first matching domain intervals and associating at least one packet filtering policy with each of the first matching domain intervals; When the fourth matching domain corresponds to at least one leaf node, and at least one matching domain interval corresponding to the at least one leaf node is associated with a packet filtering policy, the policy matching tree is obtained, and the fourth matching domain is other matching domains among the multiple matching domains except the first matching domain.

2. The firewall policy conflict detection method according to claim 1, characterized in that: The first matching domain range includes a first value interval, and the first value interval includes a plurality of continuous matching domain ranges; The step of determining the target packet filtering policy corresponding to the policy to be detected based on the preset policy matching tree includes: Based on the minimum value of the first value interval corresponding to the multiple matching domains and the second matching domain range corresponding to the multiple packet filtering policies, determine the packet filtering policy in which the second matching domain range and the minimum value of the first value interval intersect as the target packet filtering policy; In the case where it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy includes: When it is determined that the minimum value of the third matching domain range does not belong to the fourth matching domain range, the policy to be detected is determined to be a non-conflicting policy.

3. The method for detecting firewall policy conflicts according to claim 1, characterized in that: The first matching domain range includes a first value interval, and the first value interval includes a plurality of continuous matching domain ranges; The step of determining the target packet filtering policy corresponding to the policy to be detected based on the preset policy matching tree includes: Based on the maximum values ​​of the first value interval corresponding to the multiple matching domains and the second matching domain ranges corresponding to the multiple packet filtering policies, determining the packet filtering policy in which the second matching domain range and the maximum value of the first value interval intersect as the target packet filtering policy; In the case where it is determined that the third matching domain range does not belong to the fourth matching domain range, determining that the policy to be detected is a non-conflicting policy includes: In the case where it is determined that the maximum value of the third matching domain range does not belong to the fourth matching domain range, the policy to be detected is determined to be a non-conflicting policy.

4. The method for detecting a firewall policy conflict according to any one of claims 1 to 3, characterized in that: The method further comprises: When the target packet filtering policy does not exist in the policy matching tree, it is determined that the policy to be detected is a non-conflicting policy.

5. The method for detecting firewall policy conflicts according to claim 1, characterized in that: The multiple matching fields include: a protocol number field, a source port field, a destination port field, a source address field and a destination address field.

6. A firewall policy conflict detection device corresponding to the firewall policy conflict detection method according to claim 1, characterized in that: include: An acquisition module, used for acquiring a policy to be detected, wherein the policy to be detected includes a plurality of matching domains, each matching domain corresponding to a first matching domain range; A matching module, used for determining a target packet filtering policy corresponding to the policy to be detected based on a preset policy matching tree, wherein the policy matching tree includes multiple packet filtering policies, each of which includes the multiple matching domains corresponding to the second matching domain range, and the target packet filtering policy is at least one of the multiple packet filtering policies; the policy matching tree is obtained with the first matching domain as a root node and the second matching domain as a leaf node, the first matching domain is one of the multiple matching domains, and the second matching domain is obtained based on the second matching domain range associated with each interval in the multiple intervals included in the first matching domain; A determination module is used to determine that the policy to be detected is a non-conflicting policy when it is determined that the third matching domain range does not belong to the fourth matching domain range, the third matching domain range is the first matching domain range corresponding to the third matching domain in the policy to be detected, the fourth matching domain range is the second matching domain range corresponding to the third matching domain in the target packet filtering policy, and the third matching domain is any one of the multiple matching domains.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the firewall policy conflict detection method as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the firewall policy conflict detection method according to any one of claims 1 to 5 is implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the firewall policy conflict detection method according to any one of claims 1 to 5 is implemented.

Images