Security policy checking method and device, electronic device, and storage medium

Abstract

The application discloses a security policy checking method and device, an electronic device and a storage medium, wherein the checking method comprises the following steps: obtaining a set of security policies configured in a target device, and importing the set of security policies into a preset virtual environment; running a preset data packet in the preset virtual environment based on the set of security policies, obtaining a running result, and constructing a first mapping graph based on the running result; modifying the security policies in the set of security policies based on service requirement information of a target service, and constructing a second mapping graph based on the modified security policies; checking whether the security policies in the set of security policies are successfully modified based on the first mapping graph and the second mapping graph; and determining that the modification of the set of security policies is completed in the case that all the security policies are successfully modified. The application solves the technical problem that the modified security policies cannot be checked in time in the related art, thereby causing network failure.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a method, apparatus, electronic device, and storage medium for verifying security policies. Background Technology

[0002] Security policies are a fundamental function of network security devices, controlling traffic forwarding based on source IP address, destination IP address, source security domain, destination security domain, and service type. By default, security devices reject all information transmissions passing through them, while security policies determine which traffic is allowed and which is denied between security domains (or address ranges). To implement different access control behaviors for different services, a single security device is often configured with multiple security policies.

[0003] In related technologies, security gateway devices can identify attributes such as source address, destination address, source security domain, and destination security domain of traffic, and match these attributes with the conditions of security policies. If all conditions match, the traffic successfully matches the security policy. After the traffic matches the security policy, the device will execute the security policy action: allow or deny. If the action is "allow," the traffic is allowed; if the action is "deny," the traffic is denied.

[0004] Figure 1 It is a schematic diagram of an optional network topology based on relevant technologies, such as Figure 1 As shown, the network includes: a server zone (DMZ zone), an employee office zone (trust zone), and an Internet (untrust zone). The server zone includes a code server (10.100.1.0 / 24), a mail server (10.100.2.0 / 24), and an XX server (10.100.x.0 / 24), all connected to the security gateway via a switch. The employee office zone includes R&D personnel (192.168.1.0 / 24), sales personnel (192.168.2.0 / 24), and XX personnel (192.168.x.0 / 24), all connected to the security gateway via a switch. The untrust zone includes public network hosts and public network servers, and is also connected to the security gateway.

[0005] The following is combined Figure 1 The network topology diagram in the example illustrates the functions that the security policy needs to achieve.

[0006] Assume a company's network topology and IP address allocation are as follows: Figure 1The system is divided into a server zone (DMZ zone), an employee office zone (trust zone), and an untrust zone connected to the Internet. The following access control requirements need to be met through security policies: (1) Allow the company intranet to access the Internet; (2) Prohibit access to the company intranet from the Internet; (3) Allow the employee office zone to access the server zone, but except for R&D personnel, no one is allowed to access the code server.

[0007] Traffic is typically matched from top to bottom according to the policy. Once a policy is matched, the matching stops. In other words, in the security policy table, the higher the security policy is, the higher its priority, and the lower the security policy is, the lower its priority. Each security policy has a unique policy identifier ID. Security policies can be moved up or down, but the policy identifier ID remains unchanged after the move.

[0008] By configuring the security policies shown in Table 1, the above access control requirements can be met.

[0009] Table 1

[0010]

[0011] Security Policy 1: Allow employees to access the internet; Security Policy 2: Deny internet access to the company intranet; Security Policy 3: Allow service area access to the internet; Security Policy 4: Allow R&D employees to access the code server; Security Policy 5: Deny employee office area access to the code server; Security Policy 6: Allow employee office area access to the server area.

[0012] In certain application scenarios, such as large enterprises and large financial companies, the number of security policies on security gateways is extremely large, often reaching tens of thousands. Administrators find it difficult to clearly understand the relationships between so many security policies. Whenever an administrator changes a policy, they need to monitor whether the change affects business operations. Accidentally blocking or allowing certain business processes could lead to very serious failures. Therefore, administrators need to evaluate the impact of policy changes on business operations, and the evaluation method should be as close to real-world business processing as possible.

[0013] Suppose a company needs to adjust its security policy to allow traffic from the 192.168.1.0 / 24 IP address range coming from the Trust security domain to access servers in the DMZ domain with IP addresses ranging from 10.100.10.1 to 10.100.1.20. Now, the administrator needs to modify Policy 4 to change the destination IP addresses to 10.100.1.1 to 10.100.1.20. However, if a configuration error occurs and the destination addresses are accidentally changed from 10.100.1.1 to 10.100.1.20 to 10.100.1.1 to 10.100.1.30, and if there are many other policies between Policy 4 and Policy 5, the administrator may find it difficult to detect the mistakenly granting access to addresses 10.100.1.21 to 10.100.1.30, leading to network failures.

[0014] There is currently no effective solution to the above problems. Summary of the Invention

[0015] This invention provides a method, apparatus, electronic device, and storage medium for verifying security policies, to at least solve the technical problem in related technologies where the inability to verify modified security policies in a timely manner leads to network failures.

[0016] According to one aspect of the present invention, a method for verifying security policies is provided, comprising: obtaining a set of security policies configured in a target device and importing the security policy set into a preset virtual environment, wherein the security policy set includes multiple security policies; running a preset data packet in the preset virtual environment based on the security policy set, obtaining a running result, and constructing a first mapping diagram based on the running result, wherein the first mapping diagram is used to display the security policies matched by the data flow in the preset data packet; modifying the security policies in the security policy set based on the service requirement information of the target service, and constructing a second mapping diagram based on the modified security policies, wherein the second mapping diagram is used to display the modified security policies matched by the data flow in the preset data packet; verifying whether the security policies in the security policy set have been successfully modified based on the first mapping diagram and the second mapping diagram, and determining that the modification of the security policy set is complete if all the security policies have been successfully modified.

[0017] Optionally, before obtaining the set of security policies configured in the target device and importing the set of security policies into the preset virtual environment, the method further includes: determining the operating environment of the target device; and establishing the preset virtual environment based on the operating environment.

[0018] Optionally, before running the preset data packet in the preset virtual environment based on the set of security policies and obtaining the running result, the method further includes: calling a port hook associated with the service port to capture the service traffic of the target service and obtaining the preset data packet, wherein the service port is a port used to transmit or receive the service traffic, and the preset data packet includes: multiple data streams, and the data stream information of each data stream includes at least: source address, destination address, source security domain, and destination security domain.

[0019] Optionally, the step of running a preset data packet in the preset virtual environment based on the set of security policies to obtain the running result includes: replaying each data stream in the preset data packet to the preset virtual environment; determining the security policy that matches the data stream; and recording the data stream and the security policy that matches the data stream in the running result.

[0020] Optionally, the step of verifying whether the security policy in the security policy set has been successfully modified based on the first mapping map and the second mapping map includes: comparing the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; based on the difference information, determining the second security policy indicated by the second security policy identifier which is inconsistent with the first security policy identifier, wherein the first security policy indicated by the first security policy identifier is the security policy matched by the target data flow indicated by the target data flow identifier in the first mapping map, and the second security policy is the security policy matched by the target data flow indicated by the target data flow identifier in the second mapping map; comparing the data flow information of the target data flow matched with the second security policy with preset configuration information to obtain a comparison result, wherein the preset configuration information includes: a preset threshold range, the preset threshold range including: a source address threshold range, a destination address threshold range, a source security domain threshold range, and a destination security domain threshold range; if the comparison result indicates that any one of the source address, destination address, source security domain, or destination security domain in the data flow information does not belong to the preset threshold range, determining that the modification of the security policy set has failed.

[0021] Optionally, after determining that the modification of the security policy set has failed, the method further includes: adjusting the security policies in the security policy set to obtain a target security policy set; determining whether there is a failed policy in the target security policy set according to a preset policy; and deleting the failed policy if there is a failed policy in the target security policy set.

[0022] Optionally, the step of determining whether there is an invalid policy in the target security policy set according to a preset strategy includes: based on a preset matching principle, if the policy information of the third security policy contains the policy information of the fourth security policy when the third security policy is located above the fourth security policy, the fourth security policy is determined to be the invalid policy, wherein the preset matching principle is a principle for matching data flows according to the order of the security policies in the target security policy set from top to bottom; or, if the policy information of the third security policy overlaps with the policy information of the fourth security policy, the fourth security policy is determined to be a policy to be confirmed; or, if the policy information of the third security policy does not overlap with the policy information of the fourth security policy, the fourth security policy is determined to be a valid policy; or, if the policy information of the fourth security policy contains the policy information of the third security policy, the fourth security policy is determined to be the policy to be confirmed.

[0023] According to another aspect of the present invention, a security policy verification device is also provided, comprising: an acquisition unit, configured to acquire a set of security policies configured in a target device and import the security policy set into a preset virtual environment, wherein the security policy set includes multiple security policies; a running unit, configured to run a preset data packet in the preset virtual environment based on the security policy set, obtain running results, and construct a first mapping diagram based on the running results, wherein the first mapping diagram is used to display the security policies matched by the data flow in the preset data packet; a modification unit, configured to modify the security policies in the security policy set based on the business requirement information of the target service, and construct a second mapping diagram based on the modified security policies, wherein the second mapping diagram is used to display the modified security policies matched by the data flow in the preset data packet; and a verification unit, configured to verify whether the security policies in the security policy set have been successfully modified based on the first mapping diagram and the second mapping diagram, and determine that the modification of the security policy set is complete if all the security policies have been successfully modified.

[0024] Optionally, the verification device further includes: a first determining module, configured to determine the operating environment of the target device before acquiring the set of security policies configured in the target device and importing the set of security policies into a preset virtual environment; and a first establishing module, configured to establish the preset virtual environment based on the operating environment.

[0025] Optionally, the verification device further includes: a first capture module, used to capture the service traffic of the target service by calling a port hook associated with the service port before running the preset data packet in the preset virtual environment based on the security policy set and obtaining the running result, thereby obtaining the preset data packet, wherein the service port is a port used to transmit or receive the service traffic, and the preset data packet includes: multiple data streams, and the data stream information of each data stream includes at least: source address, destination address, source security domain, and destination security domain.

[0026] Optionally, the running unit includes: a first playback module, used to play back each data stream in the preset data packet to the preset virtual environment; a second determination module, used to determine the security policy that matches the data stream; and a first recording module, used to record the data stream and the security policy that matches the data stream to the running result.

[0027] Optionally, the verification unit includes: a third determining module, configured to compare the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; a fourth determining module, configured to determine, based on the difference information, a second security policy indicated by a second security policy identifier that is inconsistent with the first security policy identifier, wherein the first security policy indicated by the first security policy identifier is the security policy matched by the target data stream indicated by the target data stream identifier in the first mapping map, and the second security policy is the security policy matched by the target data stream indicated by the target data stream identifier in the second mapping map; a first comparison module, configured to compare the data stream information of the target data stream matched with the second security policy with preset configuration information to obtain a comparison result, wherein the preset configuration information includes: a preset threshold range, the preset threshold range including: a source address threshold range, a destination address threshold range, a source security domain threshold range, and a destination security domain threshold range; and a fifth determining module, configured to determine that the security policy set modification failed if the comparison result indicates that any one of the source address, destination address, source security domain, or destination security domain in the data stream information does not belong to the preset threshold range.

[0028] Optionally, the verification device further includes: a first adjustment module, configured to adjust the security policies in the security policy set after determining that the modification of the security policy set has failed, to obtain a target security policy set; a sixth determination module, configured to determine whether there is a failed policy in the target security policy set according to a preset strategy; and a first deletion module, configured to delete the failed policy if the failed policy exists in the target security policy set.

[0029] Optionally, the sixth determining module includes: a first determining submodule, configured to, based on a preset matching principle, determine the fourth security policy as the invalid policy if the policy information of the third security policy contains the policy information of the fourth security policy when the third security policy is located above the fourth security policy, wherein the preset matching principle is a principle for matching data flows according to the order of the security policies in the target security policy set from top to bottom; a second determining submodule, configured to determine the fourth security policy as a policy to be confirmed if the policy information of the third security policy overlaps with the policy information of the fourth security policy; a third determining submodule, configured to determine the fourth security policy as a valid policy if the policy information of the third security policy does not overlap with the policy information of the fourth security policy; and a fourth determining submodule, configured to determine the fourth security policy as the policy to be confirmed if the policy information of the fourth security policy contains the policy information of the third security policy.

[0030] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the verification method of the above-mentioned security policy.

[0031] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the verification method of the security policy described above.

[0032] In this disclosure, a set of security policies configured in the target device is obtained and imported into a preset virtual environment. Preset data packets are run in the preset virtual environment based on the security policy set to obtain the running results. A first mapping graph is constructed based on the running results. Based on the business requirements information of the target service, the security policies in the security policy set are modified. A second mapping graph is constructed based on the modified security policies. The first and second mapping graphs are used to verify whether the security policies in the security policy set have been successfully modified. If all security policies have been successfully modified, the modification of the security policy set is considered complete. In this disclosure, the set of security policies configured in the target device is first imported into a preset virtual environment. Then, preset data packets are run in the preset virtual environment. A first mapping graph is constructed based on the security policies matched by the data flow. After modifying the security policies, the preset data packets are run again, and a second mapping graph is constructed based on the modified security policies matched by the data flow. Then, the security policies are verified based on the first and second mapping graphs. This allows for timely verification of modified security policies when there are many security policies, avoiding security policies that may affect business operations, reducing network failures, and thus solving the technical problem in related technologies where modified security policies cannot be verified in a timely manner, leading to network failures. Attached Figure Description

[0033] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0034] Figure 1 It is a schematic diagram of an optional network topology based on relevant technologies;

[0035] Figure 2 This is a flowchart of an optional security policy verification method according to an embodiment of the present invention;

[0036] Figure 3 This is a schematic diagram of an optional mapping before changing the security policy according to an embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of an optional security policy modification mapping according to an embodiment of the present invention;

[0038] Figure 5 This is a schematic diagram of a mapping diagram after changing the security policy according to another optional embodiment of the present invention;

[0039] Figure 6 This is a schematic diagram of an optional verification system for the impact of changing security policies on business operations, according to an embodiment of the present invention.

[0040] Figure 7 This is a schematic diagram of a verification device for an optional security strategy according to an embodiment of the present invention;

[0041] Figure 8 This is a hardware structure block diagram of an electronic device (or mobile device) for a security policy verification method according to an embodiment of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0044] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0045] This invention proposes a method for verifying the impact of security policy changes on existing services on a security gateway. It can promptly verify the effectiveness of security policies and, through the linkage of technologies such as traffic mirroring, packet replay, and statistical analysis, can display traffic hit results and verify whether the changed policy has affected existing services. When there are numerous security policies on security devices, and administrators cannot accurately determine whether policy changes will affect existing services, this method can assist administrators in verifying whether the changed security policy may impact existing services. It can also clearly display the statistical analysis results to administrators, effectively reducing network failures.

[0046] The present invention will now be described in detail with reference to various embodiments.

[0047] Example 1

[0048] According to an embodiment of the present invention, an embodiment of a security policy verification method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0049] Figure 2 This is a flowchart of an optional security policy verification method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0050] Step S201: Obtain the set of security policies configured in the target device and import the set of security policies into the preset virtual environment. The set of security policies includes multiple security policies.

[0051] Step S202: Run a preset data packet in a preset virtual environment based on a set of security policies, obtain the running results, and construct a first mapping graph based on the running results. The first mapping graph is used to display the security policies matched by the data stream in the preset data packet.

[0052] Step S203: Based on the business requirement information of the target business, modify the security policy in the security policy set, and construct a second mapping graph based on the modified security policy. The second mapping graph is used to display the modified security policy matched by the data flow in the preset data packet.

[0053] Step S204: Based on the first mapping map and the second mapping map, verify whether the security policies in the security policy set have been successfully modified, and if all security policies have been successfully modified, determine that the modification of the security policy set is complete.

[0054] Through the above steps, the set of security policies configured in the target device can be obtained, and the set of security policies can be imported into a preset virtual environment. Preset data packets are run in the preset virtual environment based on the set of security policies to obtain the running results. A first mapping graph is constructed based on the running results. Based on the business requirements information of the target service, the security policies in the set of security policies are modified, and a second mapping graph is constructed based on the modified security policies. Based on the first and second mapping graphs, it is verified whether the security policies in the set of security policies have been successfully modified. If all security policies have been successfully modified, it is determined that the modification of the set of security policies is complete. In this embodiment of the invention, the set of security policies configured in the target device can be imported into a preset virtual environment first, and then a preset data packet is run in the preset virtual environment. A first mapping graph is constructed based on the security policies matched by the data flow. After modifying the security policies, the preset data packet is run again, and a second mapping graph is constructed based on the modified security policies matched by the data flow. Then, based on the first and second mapping graphs, the security policies are verified. This allows for timely verification of modified security policies when there are many security policies, avoiding security policies that may affect the business, reducing network failures, and thus solving the technical problem in related technologies where modified security policies cannot be verified in a timely manner, leading to network failures.

[0055] The embodiments of the present invention will now be described in detail with reference to the steps described above.

[0056] Optionally, before obtaining the set of security policies configured in the target device and importing the set of security policies into the preset virtual environment, the method further includes: determining the operating environment of the target device; and establishing the preset virtual environment based on the operating environment.

[0057] In this embodiment of the invention, a preset virtual environment (i.e., a virtual security gateway simulating the operating environment of the security gateway device) can be established first based on the operating environment of the target device (i.e., the security gateway device to be verified, which needs to determine whether the security policy in the device affects the business). This virtual environment is used to verify the security policy in the virtual environment of the virtual security gateway, so as to avoid affecting the running business.

[0058] Step S201: Obtain the set of security policies configured in the target device and import the set of security policies into the preset virtual environment. The set of security policies includes multiple security policies.

[0059] In this embodiment of the invention, a set of security policies configured in the target device (the set of security policies includes multiple security policies) is obtained, and then the set of security policies is imported into a preset virtual environment to complete offline mapping (that is, mapping the security policies in the target device to the preset virtual environment).

[0060] Table 2 shows all the security policies on a large enterprise security gateway.

[0061] Table 2

[0062]

[0063]

[0064] In this embodiment, the configuration of all security policies on the large enterprise security gateway can be imported into the virtual security gateway.

[0065] Optionally, before running the preset data packet in a preset virtual environment based on a set of security policies and obtaining the running result, the method further includes: calling the port hook associated with the service port to capture the service traffic of the target service and obtaining the preset data packet. The service port is a port used to transmit or receive service traffic. The preset data packet includes: multiple data streams. The data stream information of each data stream includes at least: source address, destination address, source security domain, and destination security domain.

[0066] In this embodiment of the invention, the service traffic of the target device can be captured and saved by mirroring. Specifically, a port hook (i.e., a traffic capture tool deployed on the service port) associated with the service port can be invoked to capture the service traffic of the target service to obtain a preset data packet (the preset data packet includes: multiple data streams, and the data stream information of each data stream includes at least: source address, destination address, source security domain, and destination security domain). The service port is a port used to transmit or receive service traffic and can be deployed on the target device to capture the service traffic passing through the target device.

[0067] Step S202: Run a preset data packet in a preset virtual environment based on a set of security policies, obtain the running results, and construct a first mapping graph based on the running results. The first mapping graph is used to display the security policies matched by the data stream in the preset data packet.

[0068] Optionally, the step of running a preset data packet in a preset virtual environment based on a set of security policies to obtain the running results includes: replaying each data stream in the preset data packet to the preset virtual environment; determining the security policy that matches the data stream; and recording the data stream and the security policy that matches the data stream in the running results.

[0069] In this embodiment of the invention, preset data packets can be run in a preset virtual environment based on a set of security policies to obtain the running results. Specifically, data packets can be replayed to a virtual security gateway on a data stream basis (e.g., TCP (Transmission Control Protocol) or UDP (User Datagram Protocol)). The matched security policies are then obtained (i.e., the security policies matching the data streams are determined). The matched security policies are then statistically analyzed, and the analysis results are saved to a database (i.e., the data streams and the matched security policies are recorded in the running results). Afterwards, a mapping diagram of data streams and matched policies is constructed based on the running results. This can also be called a baseline (i.e., a first mapping diagram is constructed based on the running results, which is used to display the security policies matched by the data streams in the preset data packets). For example, TCP data stream 1 matches security policy 1, TCP data stream 2 matches security policy 2, etc. The constructed mapping diagram can then be displayed.

[0070] For example, based on all the security policies on this large enterprise security gateway in Table 2, a baseline mapping can be generated by replaying data packets in the virtual security gateway. Figure 3 This is a schematic diagram of an optional mapping before changing the security policy according to an embodiment of the present invention, such as... Figure 3 As shown, the data flow is divided into data flow identifier ID and the data packet replay policy hit ID before the policy change. Specifically, data flow 1 hits security policy 2, data flow 2 hits security policy 1, data flow 3 (source IP: 192.168.1.10, destination IP: 10.100.1.8) hits security policy 4 (source security domain: Trust, source IP: 192.168.1.0 / 24, destination security domain: DMZ, destination IP: 10.100.1.1-10.100.1.10, service: any, action: allow), data flow 4 hits security policy 3, and data flow 5 (source IP: 192.168.1.10 / 24 / DMZ / 10.100.1.10 ... Data flow 1.10 (Destination IP: 10.100.1.12) hits security policy 5 (Source security domain: Trust, Source IP: any, Destination security domain: DMZ, Destination IP: 10.100.1.0 / 24, Service: any, Action: Deny), data flow 6 (Source IP: 192.168.1.10, Destination IP: 10.100.1.21) hits security policy 5 (Source security domain: Trust, Source IP: any, Destination security domain: DMZ, Destination IP: 10.100.1.0 / 24, Service: any, Action: Deny), data flow N hits security policy 6, etc.

[0071] Step S203: Based on the business requirement information of the target business, modify the security policy in the security policy set, and construct a second mapping graph based on the modified security policy. The second mapping graph is used to display the modified security policy matched by the data flow in the preset data packet.

[0072] In this embodiment of the invention, the security policies in the security policy set can be modified according to the business requirements information of the target business (i.e., the target business needs to prohibit or allow a certain source IP address to access a certain destination IP address). After modifying the security policies, the data packets can be replayed to obtain the mapping diagram of the hit policies (i.e., based on the modified security policies, a second mapping diagram is constructed, which is used to display the modified security policies matched by the data stream in the preset data packets). Then, the mapping diagram of the hit security policies can be displayed.

[0073] For example, this large enterprise needs to adjust the security policy in Table 2 based on current business needs, allowing traffic from the trust security domain with IP address 192.168.1.0 / 24 to access servers in the DMZ domain with IP addresses ranging from 10.100.10.1 to 10.100.1.20. Now, the administrator needs to modify policy 4 to change the destination IP address to 10.100.1.1 to 10.100.1.20. However, when modifying security policy 4, the administrator mistakenly changed 10.100.1.10 to 10.100.1.30, as shown in Table 3.

[0074]

[0075] Therefore, it is necessary to verify whether the modified security policy affects the existing policy and whether the modification meets expectations.

[0076] Figure 4 This is a schematic diagram of an optional security policy modification mapping according to an embodiment of the present invention, such as... Figure 4As shown, the data flow is divided into several categories: data flow identifier ID, policy ID hit by data packet replay before policy change, policy ID hit by data packet replay after policy change, and whether there is a difference. Specifically, data flow 1 hit security policy 2 before and after the policy change, with no difference in the hit policy ID; data flow 2 hit security policy 1 before and after the policy change, with no difference in the hit policy ID; data flow 3 hit security policy 4 before and after the policy change, with no difference in the hit policy ID. The IDs are identical; data flow 4 hits security policy 3 before and after the policy change, and the policy IDs are identical; data flow 5 (source IP: 192.168.1.10, destination IP: 10.100.1.12) hits security policy 5 (source security domain: Trust, source IP: any, destination security domain: DMZ, destination IP: 10.100.1.0 / 24, service: any, action: prohibit) before the policy change, and hits security policy 4 after the policy change. Source security domain: Trust, source IP: 192.168.1.0 / 24, destination security domain: DMZ, destination IP: 10.100.1.1-10.100.1.30, service: any, action: allow), the policy IDs hit differ; data flow 6 (source IP: 192.168.1.10, destination IP: 10.100.1.21) hit security policy 5 (source security domain: Trust, source IP: any, destination security domain: DMZ, destination IP: 10.100.1.1-10.100.1.30, service: any, action: allow) before the policy change. Data flow N hits security policy 4 (source security domain: Trust, source IP: 192.168.1.0 / 24, destination security domain: DMZ, destination IP: 10.100.1.1-10.100.1.30, service: any, action: allow) after the policy change, and the policy IDs are different. Data flow N hits security policy 6 before the policy change and hits security policy 6 after the policy change, and the policy IDs are the same.

[0077] Step S204: Based on the first mapping map and the second mapping map, verify whether the security policies in the security policy set have been successfully modified, and if all security policies have been successfully modified, determine that the modification of the security policy set is complete.

[0078] Optionally, the step of verifying whether the security policies in the security policy set have been successfully modified based on the first mapping map and the second mapping map includes: comparing the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; based on the difference information, determining the second security policy indicated by the second security policy identifier that is inconsistent with the first security policy identifier, wherein the first security policy indicated by the first security policy identifier is the security policy matched by the target data flow indicated by the target data flow identifier in the first mapping map, and the second security policy is the security policy matched by the target data flow indicated by the target data flow identifier in the second mapping map; comparing the data flow information of the target data flow matched with the second security policy with preset configuration information to obtain a comparison result, wherein the preset configuration information includes: preset threshold ranges, the preset threshold ranges include: source address threshold range, destination address threshold range, source security domain threshold range, and destination security domain threshold range; if the comparison result indicates that any information in the source address, destination address, source security domain, or destination security domain in the data flow information does not belong to the preset threshold range, it is determined that the modification of the security policy set has failed.

[0079] In this embodiment of the invention, the first mapping map and the second mapping map can be compared, and the differences can be presented to the administrator. For example, TCP data flow 1 hits security policy 100, while it originally hit security policy 1. The administrator determines whether this is the expected result. If it does not meet the expectations, the policy can be adjusted again, and the data packets can be replayed. The mapping map is compared until the expectations are met (i.e., based on the first mapping map and the second mapping map, it is verified whether the security policies in the security policy set have been successfully modified, and if all security policies have been successfully modified, it is determined that the security policy set has been modified). Specifically, the differences between the first mapping map and the second mapping map can be compared, and then the different security policies hit by the same data flow after the policy change can be determined based on the differences (i.e., based on the differences, the second security policy indicated by the second security policy identifier that is inconsistent with the first security policy identifier is determined. The first security policy indicated by the first security policy identifier is the security policy matched by the target data flow indicated by the target data flow identifier in the first mapping map, and the second security policy is the security policy matched by the target data flow indicated by the target data flow identifier in the second mapping map). Next, analyze whether the data flow matches the security policy as expected (i.e., whether a certain source IP address is allowed or prohibited from accessing a certain destination IP address as preset) (that is, compare the data flow information of the target data flow that matches the second security policy with the preset configuration information to obtain the comparison result. The preset configuration information includes: preset threshold range, which includes: source address threshold range, destination address threshold range, source security domain threshold range, and destination security domain threshold range). If it does not meet the expectations, it indicates that the security policy is configured incorrectly and needs to be reconfigured (i.e., if the comparison result indicates that any information in the source address, destination address, source security domain, or destination security domain in the data flow information does not belong to the preset threshold range, it is determined that the security policy set modification has failed).

[0080] For example, through Figure 4 It can be seen that there is a difference in the mapping diagram before and after the policy change. Specifically, the security policy hits for data flow identifiers 5 and 6 have changed. Analysis shows that data flow 5 meets expectations, but data flow 6 does not. Checking the configuration of security policy 4, an error was found, requiring modification of security policy 4 by changing 10.100.1.30 to 10.100.1.20. Then, packet replay was performed again to generate the mapping diagram after the policy change.

[0081] Figure 5 This is a schematic diagram of a mapping after changing the security policy according to another optional embodiment of the present invention, such as... Figure 5As shown, the data flow is divided into data flow identifier ID, policy ID hit by data packet replay before policy change, policy ID hit by data packet replay after policy change, and whether there is a difference. Specifically, data flow 1 hits security policy 2 before and after the policy change, with no difference in the policy IDs; data flow 2 hits security policy 1 before and after the policy change, with no difference in the policy IDs; data flow 3 hits security policy 4 before and after the policy change, with no difference in the policy IDs; data flow 4 hits security policy 3 before and after the policy change, with no difference in the policy IDs; data flow 5 (source IP: 192.168.1.10, destination IP: 10.100.1.12) in... Before the policy change, security policy 5 (source security domain: Trust, source IP: any, destination security domain: DMZ, destination IP: 10.100.1.0 / 24, service: any, action: deny) was hit. After the policy change, security policy 4 (source security domain: Trust, source IP: 192.168.1.0 / 24, destination security domain: DMZ, destination IP: 10.100.1.1-10.100.1.20, service: any, action: allow) was hit, and the policy IDs were different. Data flow 6 hit security policy 5 before and after the policy change, and the policy IDs were the same. Data flow N hit security policy 6 before and after the policy change, and the policy IDs were the same.

[0082] pass Figure 5 It can be seen that only data stream identifier 5 has a change in security policy. Data stream 5 meets the expectations, and the verification is complete.

[0083] In this embodiment, when modifying, adding, or deleting security policies, the impact of the changed policies on existing services can be verified by comparing the mapping graph.

[0084] Optionally, after determining that the modification of the security policy set has failed, the method further includes: adjusting the security policies in the security policy set to obtain a target security policy set; determining whether there are invalid policies in the target security policy set based on preset policies; and deleting invalid policies if there are invalid policies in the target security policy set.

[0085] In this embodiment of the invention, if the current security policy does not meet expectations, the security policies in the security policy set can be adjusted to obtain a target security policy set. Then, based on the preset policy, it is determined whether there is a failed policy in the target security policy set. If there is a failed policy in the target security policy set, the failed policy can be deleted.

[0086] Optionally, the step of determining whether there is an invalid policy in the target security policy set according to a preset strategy includes: based on a preset matching principle, if the policy information of the third security policy contains the policy information of the fourth security policy when the third security policy is located above the fourth security policy, the fourth security policy is determined to be an invalid policy, wherein the preset matching principle is the principle by which the data flow matches security policies in the target security policy set in a top-to-bottom order; or, if the policy information of the third security policy overlaps with the policy information of the fourth security policy, the fourth security policy is determined to be a policy to be confirmed; or, if the policy information of the third security policy does not overlap with the policy information of the fourth security policy, the fourth security policy is determined to be a valid policy; or, if the policy information of the fourth security policy contains the policy information of the third security policy, the fourth security policy is determined to be a policy to be confirmed.

[0087] In this embodiment of the invention, verifying the impact of changing security policies on existing services refers to whether adding, deleting, or modifying policies will cause other existing security policies to become invalid. Since security policies are matched in a top-down order (i.e., a preset matching principle, which is the principle by which data flows are matched according to the top-down order of security policies in the target security policy set), assuming policy A (i.e., the third security policy) is above policy B (i.e., the fourth security policy) (i.e., when the third security policy is above the fourth security policy), the traffic characteristics contained in policies A and B can be categorized into the following situations:

[0088] (1) Strategy A completely includes strategy B: In this case, B is ineffective and cannot achieve the expected purpose, that is, strategy B is an invalid strategy (that is, if the strategy information of the third security strategy includes the strategy information of the fourth security strategy, the fourth security strategy is determined to be an invalid strategy).

[0089] (2) There is some overlap between strategy A and strategy B: In this case, part of B is effective, but it is uncertain whether it can achieve the expected purpose. That is, the effectiveness of strategy B needs to be confirmed (that is, if the strategy information of the third security strategy overlaps with the strategy information of the fourth security strategy, the fourth security strategy is determined to be a strategy to be confirmed).

[0090] (3) Strategy A and Strategy B do not overlap: In this case, B takes effect, that is, strategy B is a valid strategy (that is, if the strategy information of the third security strategy does not overlap with the strategy information of the fourth security strategy, the fourth security strategy is determined to be a valid strategy).

[0091] (4) Strategy B completely includes strategy A: At this time, part of B is effective, but it is uncertain whether it can achieve the expected purpose. That is, the effectiveness of strategy B needs to be confirmed (i.e., if the strategy information of the fourth security strategy includes the strategy information of the third security strategy, the fourth security strategy is determined to be a strategy to be confirmed).

[0092] Therefore, when multiple security policies already exist, it is necessary to determine whether the modified policy meets expectations before modifying policy A or policy B.

[0093] The following describes in detail another optional implementation method.

[0094] Figure 6 This is a schematic diagram of an optional verification system for the impact of changing security policies on business operations, according to an embodiment of the present invention. Figure 6 As shown, it includes: a storage module, a data packet playback module, a virtual security gateway, a statistical analysis module, and a display module.

[0095] By verifying the interactions between modules in the system, we can display traffic hit results and verify whether the changed strategy has an impact on existing business. The specific process is as follows:

[0096] (1) When it is necessary to change the security policy of online devices, start the virtual security gateway, import the configuration of online devices into the virtual security gateway, and complete the offline mapping.

[0097] (2) Capture online business traffic by mirroring and save it to the storage module.

[0098] (3) Play back the business traffic captured by the storage module through the data packet playback module.

[0099] (4) Play back the data packets to the virtual security gateway in units of data streams and obtain the hit security policies. Record the hit security policies of the data streams through the statistical analysis module, save the analysis results to the database, and construct a mapping diagram between data streams and hit policies, which is called the baseline. For example, TCP data stream 1 hits security policy 1, TCP data stream 2 hits security policy 2, etc., which can be displayed through the display module.

[0100] (5) After modifying the security policy, replay the data packets to obtain the mapping diagram of the hit policy. The hit security policy is displayed by the display module through the statistical analysis module and compared with the mapping diagram before the change. The differences are presented to the administrator. For example, TCP data stream 1 hits security policy 100, and originally hit security policy 1. And determine whether it is the expected result.

[0101] (6) If the expected results are not met, the strategy can be adjusted again, the data packets can be replayed, and the mapping diagram before the change can be compared until the expected results are met.

[0102] In this embodiment of the invention, when there are many security gateway policies and the administrator cannot accurately grasp the relationships between the policies, it can determine whether the changed policies will affect existing services when policy changes are needed, effectively reducing network failures. Simultaneously, traffic capture using mirrored traffic has no impact on online device traffic and will not affect existing services. Furthermore, the impact of modification operations on existing policies and services is dynamically determined through packet replay, closely resembling real-world scenarios. Moreover, the verification system proposed in this embodiment can run on a general-purpose computer, eliminating the need to purchase dedicated equipment and thus saving costs.

[0103] The following is a detailed description with reference to another embodiment.

[0104] Example 2

[0105] The security strategy verification device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0106] Figure 7 This is a schematic diagram of an optional security policy verification device according to an embodiment of the present invention, such as... Figure 7 As shown, the verification device may include: an acquisition unit 70, a running unit 71, a modification unit 72, and a verification unit 73, wherein...

[0107] The acquisition unit 70 is used to acquire the set of security policies configured in the target device and import the set of security policies into a preset virtual environment. The set of security policies includes multiple security policies.

[0108] The running unit 71 is used to run a preset data packet in a preset virtual environment based on a set of security policies, obtain the running results, and construct a first mapping map based on the running results. The first mapping map is used to display the security policies matched by the data stream in the preset data packet.

[0109] Modification unit 72 is used to modify the security policy in the security policy set based on the business requirement information of the target business, and to construct a second mapping map based on the modified security policy. The second mapping map is used to display the modified security policy matched by the data flow in the preset data packet.

[0110] The verification unit 73 is used to verify whether the security policies in the security policy set have been successfully modified based on the first mapping map and the second mapping map, and to determine that the modification of the security policy set is complete if all security policies have been successfully modified.

[0111] The aforementioned verification device can acquire the set of security policies configured in the target device through the acquisition unit 70, import the set of security policies into a preset virtual environment, run a preset data packet in the preset virtual environment based on the set of security policies through the running unit 71, obtain the running result, and construct a first mapping map based on the running result. The modification unit 72 modifies the security policies in the set of security policies based on the business requirement information of the target service, and constructs a second mapping map based on the modified security policies. The verification unit 73 verifies whether the security policies in the set of security policies have been successfully modified based on the first mapping map and the second mapping map, and determines that the modification of the set of security policies is complete if all security policies have been successfully modified. In this embodiment of the invention, the set of security policies configured in the target device can be imported into a preset virtual environment first. Then, a preset data packet is run in the preset virtual environment, and a first mapping graph is constructed based on the security policies matched by the data stream. After modifying the security policies, the preset data packet is run again, and a second mapping graph is constructed based on the modified security policies matched by the data stream. Then, based on the first mapping graph and the second mapping graph, the security policies are verified. This allows for timely verification of modified security policies when there are many security policies, thereby avoiding security policies that may affect business operations, reducing network failures, and solving the technical problem in related technologies where modified security policies cannot be verified in a timely manner, leading to network failures.

[0112] Optionally, the verification device further includes: a first determining module, used to determine the operating environment of the target device before acquiring the set of security policies configured in the target device and importing the set of security policies into a preset virtual environment; and a first establishing module, used to establish a preset virtual environment based on the operating environment.

[0113] Optionally, the verification device further includes: a first capture module, used to run a preset data packet in a preset virtual environment based on a set of security policies, and before obtaining the running result, call a port hook associated with the service port to capture the service traffic of the target service and obtain the preset data packet, wherein the service port is a port used to transmit or receive service traffic, and the preset data packet includes: multiple data streams, and the data stream information of each data stream includes at least: source address, destination address, source security domain, and destination security domain.

[0114] Optionally, the running unit includes: a first playback module, used to play back each data stream in the preset data packet to a preset virtual environment; a second determination module, used to determine the security policy matching the data stream; and a first recording module, used to record the data stream and the security policy matching the data stream to the running results.

[0115] Optionally, the verification unit includes: a third determining module, used to compare the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; a fourth determining module, used to determine, based on the difference information, the second security policy indicated by the second security policy identifier that is inconsistent with the first security policy identifier, wherein the first security policy indicated by the first security policy identifier is the security policy matched by the target data stream indicated by the target data stream identifier in the first mapping map, and the second security policy is the security policy matched by the target data stream indicated by the target data stream identifier in the second mapping map; a first comparison module, used to compare the data stream information of the target data stream matched with the second security policy with preset configuration information to obtain a comparison result, wherein the preset configuration information includes: a preset threshold range, the preset threshold range including: a source address threshold range, a destination address threshold range, a source security domain threshold range, and a destination security domain threshold range; and a fifth determining module, used to determine that the security policy set modification has failed if any information in the source address, destination address, source security domain, or destination security domain in the data stream information indicated by the comparison result does not belong to the preset threshold range.

[0116] Optionally, the verification device further includes: a first adjustment module, used to adjust the security policies in the security policy set after determining that the modification of the security policy set has failed, to obtain a target security policy set; a sixth determination module, used to determine whether there are invalid policies in the target security policy set according to a preset strategy; and a first deletion module, used to delete invalid policies if invalid policies exist in the target security policy set.

[0117] Optionally, the sixth determining module includes: a first determining submodule, used to determine the fourth security policy as an invalid policy if the policy information of the third security policy contains the policy information of the fourth security policy, based on a preset matching principle, when the third security policy is located above the fourth security policy; wherein the preset matching principle is the principle by which the data flow matches security policies in the target security policy set in a top-to-bottom order; a second determining submodule, used to determine the fourth security policy as a policy to be confirmed if the policy information of the third security policy overlaps with the policy information of the fourth security policy; a third determining submodule, used to determine the fourth security policy as a valid policy if the policy information of the third security policy does not overlap with the policy information of the fourth security policy; and a fourth determining submodule, used to determine the fourth security policy as a policy to be confirmed if the policy information of the fourth security policy contains the policy information of the third security policy.

[0118] The aforementioned verification device may also include a processor and a memory. The aforementioned acquisition unit 70, execution unit 71, modification unit 72, verification unit 73, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0119] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured. By adjusting kernel parameters, based on the first and second mapping maps, the kernel verifies whether the security policies in the security policy set have been successfully modified. If all security policies have been successfully modified, the modification of the security policy set is considered complete.

[0120] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0121] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: obtaining a set of security policies configured in the target device, importing the set of security policies into a preset virtual environment, running a preset data packet in the preset virtual environment based on the set of security policies, obtaining the running result, constructing a first mapping graph based on the running result, modifying the security policies in the set of security policies based on the business requirement information of the target business, constructing a second mapping graph based on the modified security policies, verifying whether the security policies in the set of security policies have been successfully modified based on the first mapping graph and the second mapping graph, and determining that the modification of the set of security policies is complete if all security policies have been successfully modified.

[0122] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein the computer program controls the device where the computer-readable storage medium is located to execute the above-described security policy verification method when it is running.

[0123] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-described security policy verification method.

[0124] Figure 8 This is a hardware structure block diagram of an electronic device (or mobile device) for a security policy verification method according to an embodiment of the present invention. Figure 8 As shown, an electronic device may include one or more ( Figure 8The processor 802 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 804 for storing data may also be included. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 8 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 8 The more or fewer components shown, or having the same Figure 8 The different configurations shown.

[0125] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0126] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0127] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0128] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0130] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0131] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for verifying a security policy, characterized in that, include: Obtain the set of security policies configured in the target device and import the set of security policies into a preset virtual environment, wherein the set of security policies includes: multiple security policies; Based on the set of security policies, a preset data packet is run in the preset virtual environment to obtain the running result, and a first mapping graph is constructed based on the running result, wherein the first mapping graph is used to display the security policies matched by the data stream in the preset data packet; Based on the business requirements information of the target business, the security policies in the security policy set are modified, and a second mapping graph is constructed based on the modified security policies. The second mapping graph is used to display the modified security policies matched by the data stream in the preset data packet. Based on the first mapping map and the second mapping map, it is verified whether the security policies in the security policy set have been successfully modified, and if all the security policies have been successfully modified, it is determined that the modification of the security policy set is complete. Specifically, verifying whether the security policy in the security policy set has been successfully modified based on the first mapping map and the second mapping map includes: Compare the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; Based on the difference information, a second security policy indicated by a second security policy identifier that is inconsistent with the first security policy identifier is determined; The data stream information of the target data stream that matches the second security policy is compared with the preset configuration information to obtain the comparison result; If the comparison result indicates that any one of the source address, destination address, source security domain, or destination security domain in the data stream information does not fall within the preset threshold range, it is determined that the modification of the security policy set has failed.

2. The verification method according to claim 1, characterized in that, Before acquiring the set of security policies configured in the target device and importing the set of security policies into the preset virtual environment, the process also includes: Determine the operating environment of the target device; Based on the aforementioned operating environment, the preset virtual environment is established.

3. The verification method according to claim 1, characterized in that, Before running the preset data packet based on the set of security policies in the preset virtual environment and obtaining the running result, the process further includes: The port hook associated with the service port is invoked to capture the service traffic of the target service and obtain the preset data packet. The service port is a port used to transmit or receive the service traffic. The preset data packet includes multiple data streams. The data stream information of each data stream includes at least the following: source address, destination address, source security domain, and destination security domain.

4. The verification method according to claim 1, characterized in that, The steps for running a preset data packet in the preset virtual environment based on the set of security policies and obtaining the running results include: Each data stream in the preset data packet is replayed back into the preset virtual environment; Determine the security policy that matches the data stream; The data stream and the security policy matching the data stream are recorded in the execution result.

5. The verification method according to claim 1, characterized in that, The first security policy indicated by the first security policy identifier is the security policy matched by the target data stream indicated by the target data stream identifier in the first mapping graph, and the second security policy is the security policy matched by the target data stream indicated by the target data stream identifier in the second mapping graph; The preset configuration information includes: preset threshold ranges, which include: source address threshold range, destination address threshold range, source security domain threshold range, and destination security domain threshold range.

6. The verification method according to claim 5, characterized in that, After determining that the modification of the security policy set has failed, the process also includes: Adjust the security policies in the security policy set to obtain the target security policy set; Based on a preset strategy, determine whether there are any invalid strategies in the target security strategy set; If the invalid policy exists in the target security policy set, delete the invalid policy.

7. The verification method according to claim 6, characterized in that, The step of determining whether there is an invalid policy in the target security policy set according to a preset strategy includes: Based on a preset matching principle, when the third security policy is located above the fourth security policy, if the policy information of the third security policy contains the policy information of the fourth security policy, the fourth security policy is determined to be the invalid policy. The preset matching principle is a principle by which the data flow matches the security policies in the target security policy set according to their top-to-bottom order; or... If the policy information of the third security policy overlaps with the policy information of the fourth security policy, the fourth security policy is determined to be a policy to be confirmed; or, If the policy information of the third security policy does not overlap with the policy information of the fourth security policy, the fourth security policy is determined to be a valid policy; or, If the policy information of the fourth security policy includes the policy information of the third security policy, then the fourth security policy is determined to be the policy to be confirmed.

8. A security policy verification device, characterized in that, include: The acquisition unit is used to acquire a set of security policies configured in the target device and import the set of security policies into a preset virtual environment, wherein the set of security policies includes: multiple security policies; The running unit is used to run a preset data packet in the preset virtual environment based on the set of security policies, obtain the running result, and construct a first mapping graph based on the running result, wherein the first mapping graph is used to display the security policies matched by the data stream in the preset data packet; The modification unit is used to modify the security policy in the security policy set based on the business requirement information of the target business, and to construct a second mapping diagram based on the modified security policy, wherein the second mapping diagram is used to display the modified security policy matched by the data stream in the preset data packet; The verification unit is used to verify, based on the first mapping map and the second mapping map, whether the security policies in the security policy set have been successfully modified, and to determine that the security policy set has been modified if all the security policies have been successfully modified. Specifically, verifying whether the security policy in the security policy set has been successfully modified based on the first mapping map and the second mapping map includes: Compare the first mapping map and the second mapping map to determine the difference information between the first mapping map and the second mapping map; Based on the difference information, a second security policy indicated by a second security policy identifier that is inconsistent with the first security policy identifier is determined; The data stream information of the target data stream that matches the second security policy is compared with the preset configuration information to obtain the comparison result; If the comparison result indicates that any one of the source address, destination address, source security domain, or destination security domain in the data stream information does not fall within the preset threshold range, it is determined that the modification of the security policy set has failed.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform a verification method of the security policy according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the verification method of the security policy according to any one of claims 1 to 7.

Images