Method, device, electronic equipment and computer readable storage medium for network access control

Abstract

The application belongs to the technical field of network security, and discloses a network access control method, device, electronic equipment and medium, the method comprising: analyzing an access message to be processed to obtain message information containing a string address; matching the string address with a character multi-way tree to obtain a target policy chain table matched by the string address; the character multi-way tree contains multiple nodes, and each node points to a respective policy chain table; each node is used to judge a character interval to which a character in the string address belongs; matching the message information with the target policy chain table to obtain a matching result; and performing a corresponding firewall operation according to the matching result. In this way, the matching of the policy chain table is performed through the character multi-way tree, and the efficiency of network access control is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to methods, apparatuses, electronic devices, and computing media for network access control. Background Technology

[0002] A firewall is a device installed between different networks to isolate and protect an internal network. Logically, it acts as a filter; external networks can only access the internal network if the firewall approves it. If the firewall does not approve, it will block the access operation and issue a warning. It effectively monitors activities between the internal and external networks, ensuring the security of the internal network.

[0003] An industrial control system firewall is a network security protection product built on top of a firewall, used to analyze, identify, and detect all data traffic passing through the industrial control network to defend against attacks on industrial control equipment from both internal and external networks. Its main functions include deep parsing of industrial protocols, packet filtering, and industrial control system auditing.

[0004] In the current technology, it is usually necessary to first obtain the access conditions set for the network access packets through string matching, and then perform access control on the packets based on the determined access conditions.

[0005] However, network access control is inefficient because string matching is time-consuming. Summary of the Invention

[0006] The purpose of this application is to provide a method, apparatus, electronic device, and computing medium for network access control, so as to improve the efficiency of network access control.

[0007] On the one hand, a method for network access control is provided, including:

[0008] The access messages to be processed are parsed to obtain message information containing string addresses;

[0009] The string address is matched against the character multi-way tree to obtain the target policy linked list for string address matching; the character multi-way tree contains multiple nodes, each node pointing to its own policy linked list; each node is used to determine the character range to which a character in the string address belongs;

[0010] The message information is matched against the target policy list to obtain the matching result;

[0011] Based on the matching results, perform the corresponding firewall operations.

[0012] In one implementation, before matching the string address with a character multi-way tree to obtain the target strategy list for string address matching, the following steps are included:

[0013] The target characters in the character set are divided into multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches in the character multi-way tree;

[0014] Based on each character range, construct the node parameters of each node, with each node parameter corresponding to a character range;

[0015] Connect each node parameter of each node except the leaf nodes to the next node;

[0016] For each node parameter in each node, set the corresponding strategy linked list to obtain the character multi-way tree.

[0017] In one implementation, the string address is matched against a character multi-way tree to obtain a target strategy linked list for string address matching, including:

[0018] Perform the following steps for each character in the string address, in order from the first character to the last character:

[0019] Determine the target character range in the corresponding node of the target character in the string address; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address;

[0020] Determine the target node parameters corresponding to the target character range;

[0021] If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the strategy list corresponding to the target node parameter is determined as the target strategy list to which it belongs.

[0022] Otherwise, the next node connected to the target node parameter is determined as the node corresponding to the next character of the target character.

[0023] In one implementation, the message information is matched against the target policy linked list to obtain a matching result, including:

[0024] Retrieve the packet matching conditions corresponding to the string address from the target policy chain list;

[0025] If the message parameters in the message information meet the message matching conditions, the match is considered successful; otherwise, the match is considered unsuccessful.

[0026] In one implementation, before parsing the access message to be processed to obtain message information containing a string address, the method further includes:

[0027] Identify the transmission protocol of the message to be processed;

[0028] If the transport protocol is the specified protocol, the message to be processed will be identified as an access message.

[0029] On the one hand, a network access control device is provided, comprising:

[0030] The parsing unit is used to parse the access message to be processed and obtain the message information containing the string address;

[0031] The matching unit is used to match the string address with the character multi-way tree to obtain the target strategy linked list for string address matching; the character multi-way tree contains multiple nodes, each node pointing to its own strategy linked list; each node is used to determine the character range to which a character in the string address belongs;

[0032] The acquisition unit is used to match the message information with the target policy linked list to obtain the matching result;

[0033] The execution unit is used to perform corresponding firewall operations based on the matching results.

[0034] In one embodiment, the matching unit is further configured to:

[0035] The target characters in the character set are divided into multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches in the character multi-way tree;

[0036] Based on each character range, construct the node parameters of each node, with each node parameter corresponding to a character range;

[0037] Connect each node parameter of each node except the leaf nodes to the next node;

[0038] For each node parameter in each node, set the corresponding strategy linked list to obtain the character multi-way tree.

[0039] In one implementation, the matching unit is used for:

[0040] Perform the following steps for each character in the string address, in order from the first character to the last character:

[0041] Determine the target character range in the corresponding node of the target character in the string address; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address;

[0042] Determine the target node parameters corresponding to the target character range;

[0043] If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the strategy list corresponding to the target node parameter is determined as the target strategy list to which it belongs.

[0044] Otherwise, the next node connected to the target node parameter is determined as the node corresponding to the next character of the target character.

[0045] In one embodiment, the obtaining unit is used to:

[0046] Retrieve the packet matching conditions corresponding to the string address from the target policy chain list;

[0047] If the message parameters in the message information meet the message matching conditions, the match is considered successful; otherwise, the match is considered unsuccessful.

[0048] In one implementation, the parsing unit is further configured to:

[0049] Identify the transmission protocol of the message to be processed;

[0050] If the transport protocol is the specified protocol, the message to be processed will be identified as an access message.

[0051] On one hand, an electronic device is provided, including a processor and a memory storing computer-readable instructions that, when executed by the processor, perform the steps of the method provided in any of the various alternative implementations of network access control described above.

[0052] On the one hand, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, performs the steps of the methods provided in any of the various alternative implementations of network access control described above.

[0053] On the one hand, a computer program product is provided that, when run on a computer, causes the computer to perform the steps of the methods provided in various alternative implementations of any of the aforementioned network access control.

[0054] The network access control method, apparatus, electronic device, and computing medium provided in this application parsing process access packets to be processed obtains packet information containing string addresses; the string addresses are matched against a character multi-way tree to obtain a target policy list for matching the string addresses; the character multi-way tree contains multiple nodes, each pointing to its respective policy list; each node is used to determine the character range to which a character in the string address belongs; the packet information is matched against the target policy list to obtain a matching result; and based on the matching result, corresponding firewall operations are executed. Thus, matching the policy list using a character multi-way tree improves the efficiency of network access control.

[0055] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0056] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A flowchart illustrating a network access control method provided in this application embodiment;

[0058] Figure 2 A flowchart illustrating a method for establishing a character multi-way tree as provided in an embodiment of this application;

[0059] Figure 3 This is a schematic diagram of a character multi-branch tree provided in an embodiment of this application;

[0060] Figure 4 A structural block diagram of a network access control device provided in an embodiment of this application;

[0061] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0062] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0063] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0064] First, some of the terms used in the embodiments of this application will be explained to facilitate understanding by those skilled in the art.

[0065] Terminal devices can be mobile terminals, fixed terminals, or portable terminals, such as mobile phones, sites, units, devices, multimedia computers, multimedia tablets, internet nodes, communicators, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, personal communication system devices, personal navigation devices, personal digital assistants, audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination thereof, including accessories and peripherals of these devices, or any combination thereof. It is also foreseeable that terminal devices can support any type of user-facing interface (e.g., wearable devices).

[0066] Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0067] In order to improve the efficiency of network access control, embodiments of this application provide a method, apparatus, electronic device, and computing medium for network access control.

[0068] In this embodiment, the technology is applied to a firewall device, which can be a server or a terminal device.

[0069] See Figure 1 The diagram shown is a flowchart of a network access control method provided in an embodiment of this application. The specific implementation process of this method is as follows:

[0070] Step 100: Parse the access packet to be processed to obtain packet information containing the string address; Step 101: Match the string address with the character multi-way tree to obtain the target policy linked list for matching the string address; The character multi-way tree is generated based on the character set; The character multi-way tree contains multiple nodes, each node pointing to its own policy linked list; Each node is used to determine the character range to which a character in the string address belongs; Step 102: Match the packet information with the target policy linked list to obtain the matching result; Step 103: Execute the corresponding firewall operation based on the matching result.

[0071] In one embodiment, to filter out access messages, the implementation process of step 100 may further include: identifying the transmission protocol of the message to be processed; if the transmission protocol is a specified protocol, then the message to be processed is determined to be an access message.

[0072] For example, the protocol can be specified as the OPCUA protocol. In practice, the specified protocol can be set according to the actual application scenario, and there are no restrictions here.

[0073] Optionally, the message information may also include, but is not limited to, at least one of the following parameters: function code, data type, and value.

[0074] In practical applications, the parameters in the message information can be set according to the actual application scenario, and there are no restrictions here.

[0075] In one implementation, to determine the target strategy list for string addresses, a character multi-way tree needs to be built first. The following section combines... Figure 2 The method for constructing a character multi-way tree is explained. (See also...) Figure 2 The diagram shown is a flowchart of a method for constructing a character multi-way tree. The specific steps of this method are as follows:

[0076] Step 200: Divide the target characters in the character set to obtain multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches of the character multi-way tree.

[0077] The target character can be any character or a valid character selected based on user instructions.

[0078] In one implementation, the characters are sorted in ascending or descending order, and the sorted characters are divided into multiple character ranges.

[0079] Optionally, each character can be divided into equal parts, or divided according to user instructions, or divided according to the actual application scenario; no restrictions are imposed here.

[0080] For example, if each character is divided into n parts, resulting in n character intervals, then the tree structure of the character multi-way tree is an n-ary tree. n is a positive integer.

[0081] Step 201: Based on each character range, construct the node parameters of each node, with each node parameter corresponding to a character range.

[0082] Step 202: Connect each node parameter of each node except the leaf nodes to the next node.

[0083] Optionally, the depth (i.e., number of levels) of the character multi-way tree can be a specified number of levels set according to user instructions, or it can be the total number of characters in the character set plus one, or it can be the length of the string address to be matched plus one. For example, if the string address is m, the depth is m+1. In one implementation, the depth of the character multi-way tree is no higher than m+1.

[0084] Step 203: For each node parameter in each node, set the corresponding strategy linked list to obtain the character multi-way tree.

[0085] It should be noted that each node contains three elements: node parameters, their corresponding values, and a pointer to the next node. The node parameter value is the policy list corresponding to that parameter. Each node parameter corresponds to a pointer to the next node. For example, if there are n node parameters, there are n pointers to the next node, and each pointer points to the node following it. Since the overall structure of the character multi-way tree is static, the tree structure will not change due to the addition or modification of the policy list; therefore, adjusting the policy list is simple.

[0086] In this way, we can obtain a character multi-way tree.

[0087] In one implementation, to quickly determine the target strategy linked list for string address matching, step 101 may include:

[0088] Perform the following steps sequentially for each character in the string address, from the first character to the last character:

[0089] S1011: Determine the target character range in the corresponding node to which the target character in the string address belongs; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address.

[0090] It should be noted that if the message contains multiple string addresses, one of them is selected for matching. If the character multi-way tree has many branches and all character ranges of each node are ordered, a binary search method can be used to determine the target character range.

[0091] S1012: Determine the target node parameters corresponding to the target character range.

[0092] S1013: If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the policy linked list corresponding to the target node parameter is determined to be the target policy linked list; otherwise, the next node connected to the target node parameter is determined to be the node corresponding to the next character of the target character.

[0093] The following is combined with Figure 3 This section provides an example illustrating the method for determining the target policy linked list. (See also...) Figure 3 The diagram shown is a schematic of a character multi-branch tree structure. Figure 3 The character multi-way tree contains four nodes: node 1, node 2, node 3, and node 4. Assuming the character set is the set of 26 English letters and divided into three equal parts, the character multi-way tree has three branches, with three nodes at each level. Each node contains node parameters corresponding to three character ranges and a strategy linked list (e.g., linked list 11, linked list 12, linked list 13, etc.). The node parameters can be represented as parameter 1, parameter 2, and parameter 3. The next node pointers corresponding to each node parameter are Left, Middle, and Right, respectively. The first character range is [a, h], the second is (h, q), and the third is [q, z]. The nodes pointed to by Left, Middle, and Right are node 2, node 3, and node 4, respectively. Optionally, the node parameters can also be replaced by the two characters h and q used to divide the character ranges.

[0094] As an example, given the string address "abcd", first determine that the character range corresponding to the first character 'a' is [a, h] in node 1, then the pointer of the next node points to that node. Then, determine that the character range corresponding to the second character 'b' is [a, h] in node 2, then obtain the policy linked list corresponding to [a, h], and use it as the target policy linked list.

[0095] In one implementation, to quickly perform packet filtering, the implementation process of step 102 may include: obtaining the packet matching conditions corresponding to the string address from the target policy chain list; if each packet parameter in the packet information meets the packet matching conditions, then the matching is determined to be successful; otherwise, the matching is determined to be unsuccessful.

[0096] In this way, the policy chain can contain multiple message matching conditions. First, the target policy chain is initially filtered out using character multi-way tree matching, thus obtaining multiple message matching conditions. Then, further precise filtering is performed to obtain the message matching conditions corresponding to the access message. Finally, based on the determined corresponding message matching conditions, it can be determined whether the access message passes the detection. This further improves the efficiency of message detection.

[0097] To ensure network security, the implementation process of performing corresponding firewall operations based on the matching results in step 103 may include:

[0098] If a match is found, an access message is sent; otherwise, the access message is discarded.

[0099] As an example, after a firewall device (e.g., a network interface card) receives an OPCUA packet sent from a first device to a second device, it sends the OPCUA packet to the protocol stack. The connection module in the firewall device establishes a connection between the first and second devices based on the source Internet Protocol (IP), source port, destination IP, and destination port in the OPCUA packet. After the connection is established, the industrial control protocol identification module in the firewall device identifies the protocol of the transmitted OPCUA packet based on the port number and protocol feature fields in the OPCUA packet. The industrial control protocol decoding module in the firewall device determines whether it is the OPCUA protocol based on the identified protocol and the protocol identification result. If so, the decoding module in the firewall device parses the packet to obtain the packet information, namely the packet's function code, string address, data type, and value field. Then, it matches each character in the string address sequentially with each node in the character multi-way tree to obtain the matched policy list A (i.e., the target policy list).

[0100] Then, retrieve the message matching conditions corresponding to the string address from the policy chain list A; if each message parameter in the message information meets the message matching conditions, the matching is successful and the access message is sent to the second device; otherwise, the matching is failed and the access message is discarded.

[0101] If the character set contains 26 characters, the string address is 16 long, the matched string is also 16 long, the character multi-way tree has 1 level, and each node contains 3 character intervals, then using traditional string matching techniques would require 16 * 16 * 26 = 6656 matches. However, using the method described in this application, the number of matches required is (416 / (3 * 2)) * 16 + 2 = 1112. In this embodiment, the character multi-way tree matching method simplifies the tedious steps of string address matching, saves time costs, improves network access control, and significantly enhances performance.

[0102] Based on the same inventive concept, this application also provides a network access control device. Since the principle of the above device and equipment in solving the problem is similar to that of a network access control method, the implementation of the above device can refer to the implementation of the method, and the repeated parts will not be described again.

[0103] like Figure 4 The diagram shown is a structural block diagram of a network access control device provided in an embodiment of this application, comprising:

[0104] The parsing unit 401 is used to parse the access message to be processed and obtain message information containing a string address;

[0105] Matching unit 402 is used to match the string address with the character multi-way tree to obtain the target strategy linked list for string address matching; the character multi-way tree contains multiple nodes, each node pointing to its own strategy linked list; each node is used to determine the character range to which a character in the string address belongs;

[0106] The obtaining unit 403 is used to match the message information with the target policy linked list to obtain the matching result;

[0107] Execution unit 404 is used to perform corresponding firewall operations based on the matching results.

[0108] In one embodiment, the matching unit 402 is further configured to:

[0109] The target characters in the character set are divided into multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches in the character multi-way tree;

[0110] Based on each character range, construct the node parameters of each node, with each node parameter corresponding to a character range;

[0111] Connect each node parameter of each node except the leaf nodes to the next node;

[0112] For each node parameter in each node, set the corresponding strategy linked list to obtain the character multi-way tree.

[0113] In one embodiment, the matching unit 402 is used for:

[0114] Perform the following steps sequentially for each character in the string address, from the first character to the last character:

[0115] Determine the target character range in the corresponding node of the target character in the string address; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address;

[0116] Determine the target node parameters corresponding to the target character range;

[0117] If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the strategy list corresponding to the target node parameter is determined as the target strategy list to which it belongs.

[0118] Otherwise, the next node connected to the target node parameter is determined as the node corresponding to the next character of the target character.

[0119] In one embodiment, the obtaining unit 403 is used for:

[0120] Retrieve the packet matching conditions corresponding to the string address from the target policy chain list;

[0121] If the message parameters in the message information meet the message matching conditions, the match is considered successful; otherwise, the match is considered unsuccessful.

[0122] In one embodiment, the parsing unit 401 is further configured to:

[0123] Identify the transmission protocol of the message to be processed;

[0124] If the transport protocol is the specified protocol, the message to be processed will be identified as an access message.

[0125] The network access control method, apparatus, electronic device, and computing medium provided in this application parsing process access packets to be processed obtains packet information containing string addresses; the string addresses are matched against a character multi-way tree to obtain a target policy list for matching the string addresses; the character multi-way tree contains multiple nodes, each pointing to its respective policy list; each node is used to determine the character range to which a character in the string address belongs; the packet information is matched against the target policy list to obtain a matching result; and based on the matching result, corresponding firewall operations are executed. Thus, matching the policy list using a character multi-way tree improves the efficiency of network access control.

[0126] Figure 5 A schematic diagram of the structure of an electronic device 5000 is shown. (See also...) Figure 5 As shown, the electronic device 5000 includes a processor 5010 and a memory 5020, and optionally may also include a power supply 5030, a display unit 5040, and an input unit 5050.

[0127] The processor 5010 is the control center of the electronic device 5000. It connects various components through various interfaces and lines, and performs various functions of the electronic device 5000 by running or executing software programs and / or data stored in the memory 5020, thereby performing overall monitoring of the electronic device 5000.

[0128] In this embodiment, when the processor 5010 calls the computer program stored in the memory 5020, it executes the steps in the above embodiments.

[0129] Optionally, processor 5010 may include one or more processing units; preferably, processor 5010 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 5010. In some embodiments, the processor and memory may be implemented on a single chip; in some embodiments, they may also be implemented separately on independent chips.

[0130] The memory 5020 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, various applications, etc.; the data storage area may store data created based on the use of the electronic device 5000, etc. Furthermore, the memory 5020 may include high-speed random access memory, and...

[0131] It may include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0132] Electronic device 5000 also includes a power supply 5030 (such as a battery) that supplies power to various components. The power supply can be logically connected to processor 5010 through a power management system, thereby enabling the management of charging, discharging, and power consumption.

[0133] The display unit 5040 can be used to display information input by the user or information provided to the user, as well as various menus of the electronic device 5000, etc. In this embodiment of the invention, it is mainly used to display the electronic device 5000.

[0134] The display unit 5040 includes the display interface for each application and the text, images, and other objects displayed on the display interface. The display unit 5040 may include a display panel 5041. The display panel 5041 may be a Liquid Crystal Display (LCD) or an Organic Light-Emitting Diode (OLED).

[0135] Configure it in the form of, etc.

[0136] 5. Input unit 5050 can be used to receive information such as numbers or characters input by the user. Input unit 5050 may include touch panel 5051 and other input devices 5052. Among them, touch panel 5051, also known as touch screen, can collect touch operations on or near the user (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 5051).

[0137] Specifically, the touch panel 5051 can detect user touch operations and detect touch operation patterns.

[0138] The incoming signals are converted into touch point coordinates and sent to the processor 5010. The processor 5010 is also received and commands are executed. Furthermore, the touch panel 5051 can be implemented using various types of sensors, including resistive, capacitive, infrared, and surface acoustic wave sensors. Other input devices 5052 may include…

[0139] However, it is not limited to one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0140] Of course, the touch panel 5051 can cover the display panel 5041. When the touch panel 5051 detects a touch operation on or near it, it transmits the information to the processor 5010 to determine the type of touch event. Subsequently, the processor 5010 provides corresponding visual output on the display panel 5041 according to the type of touch event. Although in Figure 5 In this configuration, the touch panel 5051 and the display panel 5041 are two independent components.

[0141] The electronic device 5000 uses various components to implement its input and output functions. However, in some embodiments, the touch panel 5051 and the display panel 5041 can be integrated to achieve the input and output of the electronic device 5000.

[0142] Function.

[0143] The electronic device 5000 may also include one or more sensors, such as pressure sensors, gravity acceleration sensors, proximity sensors, etc. Of course, depending on the specific application requirements, the above-mentioned electronic...

[0144] The device 5000 may also include other components such as a camera. Since these components are not the focus of the description in Embodiment 0 of this application, therefore... Figure 5 It is not shown in the text and will not be described in detail here.

[0145] Those skilled in the art will understand that Figure 5This is merely an example of an electronic device and does not constitute a limitation on the electronic device. It may include more or fewer components than shown, or a combination of certain components, or different components.

[0146] In this embodiment of the application, a computer-readable storage medium stores a computer program thereon. When the computer program is executed by a processor, it enables a communication device to perform the various functions described in the above embodiments.

[0147] step.

[0148] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0149] 0 Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of one or more computer-usable storage media (including but not limited to) containing computer-usable program code.

[0150] The form of computer program products implemented on disk storage, CD-ROM, optical storage, etc.

[0151] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0152] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0154] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0155] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for network access control, characterized in that, include: The access messages to be processed are parsed to obtain message information containing string addresses; The string address is matched with a character multi-way tree to obtain a target policy linked list for matching the string address; the character multi-way tree contains multiple nodes, each node pointing to its own policy linked list; each node is used to determine the character range to which a character in the string address belongs; The message information is matched with the target policy linked list to obtain the matching result; Based on the matching results, perform the corresponding firewall operations; Before matching the string address with a character multi-way tree to obtain the target strategy linked list for matching the string address, the process includes: The target characters in the character set are sorted by size, and the sorted characters are divided into multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches of the character multi-branch tree; Based on each character range, construct the node parameters of the node, with each node parameter corresponding to a character range; each node contains three elements: node parameter, the node parameter value corresponding to the node parameter, and the next node pointer; Connect each node parameter of each node except the leaf nodes to the next node; For each node parameter in each node, a corresponding strategy linked list is set to obtain the character multi-way tree; The step of matching the string address with a character multi-way tree to obtain the target strategy linked list for string address matching includes: Perform the following steps sequentially for each character in the string address, from the first character to the last character: Determine the target character range in the corresponding node to which the target character in the string address belongs; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address; Determine the target node parameters corresponding to the target character range; If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the strategy list corresponding to the target node parameter is determined as the target strategy list to which it belongs. Otherwise, the next node connected to the target node parameter is determined as the node corresponding to the next character of the target character.

2. The method as described in claim 1, characterized in that, The step of matching the message information with the target policy linked list to obtain the matching result includes: Obtain the packet matching condition corresponding to the string address from the target policy chain list; If each message parameter in the message information meets the message matching conditions, then the matching is successful; otherwise, the matching is unsuccessful.

3. The method as described in claim 1, characterized in that, Before parsing the access message to be processed to obtain message information containing the string address, the method further includes: Identify the transmission protocol of the message to be processed; If the transmission protocol is a specified protocol, then the message to be processed is determined to be the access message.

4. A network access control device, characterized in that, include: The parsing unit is used to parse the access message to be processed and obtain the message information containing the string address; A matching unit is used to match the string address with a character multi-way tree to obtain a target policy linked list for matching the string address; the character multi-way tree contains multiple nodes, each node pointing to its own policy linked list; each node is used to determine the character range to which a character in the string address belongs; The obtaining unit is used to match the message information with the target policy linked list to obtain the matching result; An execution unit is used to perform corresponding firewall operations based on the matching results; The matching unit is also used for: The target characters in the character set are sorted by size, and the sorted characters are divided into multiple character intervals; the character set is the set of all target characters, and the number of character intervals is the number of branches of the character multi-branch tree; Based on each character range, construct the node parameters of the node, with each node parameter corresponding to a character range; each node contains three elements: node parameter, the node parameter value corresponding to the node parameter, and the next node pointer; Connect each node parameter of each node except the leaf nodes to the next node; For each node parameter in each node, a corresponding strategy linked list is set to obtain the character multi-way tree; The matching unit is used for: Perform the following steps sequentially for each character in the string address, from the first character to the last character: Determine the target character range in the corresponding node to which the target character in the string address belongs; the node corresponding to the first character of the string address is the root node of the character multi-way tree; the target character is any character in the string address; Determine the target node parameters corresponding to the target character range; If the node corresponding to the target character is a leaf node or the target character is the last character in the string address, then the strategy list corresponding to the target node parameter is determined as the target strategy list to which it belongs. Otherwise, the next node connected to the target node parameter is determined as the node corresponding to the next character of the target character.

5. The apparatus as described in claim 4, characterized in that, The obtaining unit is used for: Obtain the packet matching condition corresponding to the string address from the target policy chain list; If each message parameter in the message information meets the message matching conditions, then the matching is successful; otherwise, the matching is unsuccessful.

6. The apparatus according to any one of claims 4-5, characterized in that, The parsing unit is also used for: Identify the transmission protocol of the message to be processed; If the transmission protocol is a specified protocol, then the message to be processed is determined to be the access message.

7. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-3.

Images