Domain name policy configuration method, domain name policy matching method and related device

Abstract

The application provides a domain name policy configuration method, a domain name policy matching method and related devices, and relates to the technical field of information security. The domain name policy configuration method comprises the following steps: obtaining destination attribute information in a target access request, wherein the destination attribute information is attribute information related to a domain name; updating a corresponding relationship between the destination attribute information and a target domain name policy in a preset dynamic policy condition matching table based on the destination attribute information, to obtain an updated dynamic policy condition matching table; and the dynamic policy condition matching table is used to represent the corresponding relationship between the domain name policy and the attribute information. By obtaining the destination attribute information corresponding to the target domain name from the target access request accessing the target domain name, the dynamic policy condition matching table can be updated according to the destination attribute information and the corresponding target domain name, without the need for communication with an external server.

Description

Technical Field

[0001] This application relates to the technical field of information security, and more specifically, to a domain name policy configuration method, a domain name policy matching method, and related apparatus. Background Technology

[0002] To ensure network information security, firewall devices are increasingly being used for network security protection. Firewall devices require the configuration of numerous policies, such as routing policies, security policies, and QoS (Quality of Service). These policies enable firewall devices to perform functions such as data routing, traffic control, and service communication quality control.

[0003] Currently, domain names are typically configured in the policy, and the configured domain name is used as the condition for whether the policy is hit, so as to realize domain name-based traffic scheduling, as well as functions such as scheduling access to certain websites to specific lines and security control for access to certain domain names.

[0004] like Figure 1 As shown, the existing method of configuring domain names in a policy involves configuring the policy through the control layer of the firewall device; then the control layer communicates with an external server to obtain the attribute information corresponding to the policy to be configured; then the control layer constructs a policy matching table based on the obtained attribute information; finally, the data forwarding layer of the firewall device uses this domain name policy matching table to match the access request initiated by the user, and if the match is successful, the access request initiated by the user is blocked.

[0005] However, when attribute information changes, the firewall's control layer needs to communicate with the external server again to obtain the changed attribute information and rebuild the policy matching table based on it. This reduces the efficiency of matching user-initiated access requests. Furthermore, after rebuilding the policy matching table, the control layer needs to send the rebuilt table to the data forwarding layer, interrupting the data forwarding process. The data forwarding layer can only resume forwarding data after receiving the rebuilt table, thus impacting the firewall's performance. Summary of the Invention

[0006] This application provides a domain name policy configuration method, a domain name policy matching method, and related apparatus to solve the problem in the prior art that when attribute information changes, the control layer of the firewall device needs to rebuild the policy matching table, which reduces the efficiency of matching user-initiated access requests. Furthermore, when the rebuilt policy matching table is sent to the data forwarding layer, it interrupts the data forwarding layer's data forwarding action, thereby affecting the performance of the firewall device.

[0007] In a first aspect, this application provides a domain name policy configuration method, comprising: obtaining destination attribute information in a target access request, wherein the destination attribute information is attribute information related to a domain name; updating the correspondence between the destination attribute information and the target domain name policy in a preset dynamic policy condition matching table based on the destination attribute information, thereby obtaining an updated dynamic policy condition matching table; wherein the dynamic policy condition matching table is used to characterize the correspondence between the domain name policy and the attribute information.

[0008] In this embodiment, by obtaining the destination attribute information corresponding to the target domain name from the target access request, the dynamic policy condition matching table can be updated based on the destination attribute information and the corresponding target domain name, without communicating with an external server. Furthermore, this process only requires the participation of the firewall device's forwarding layer, and the forwarding layer's data forwarding action is not interrupted, thus minimizing the impact on the firewall device's performance.

[0009] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, if the dynamic policy condition matching table already contains the destination attribute information corresponding to the target domain name, updating the correspondence between the destination attribute information and the target domain name policy in the preset dynamic policy condition matching table based on the destination attribute information includes: updating the validity period of the destination attribute information corresponding to the target domain name in the dynamic policy condition matching table.

[0010] In this embodiment of the application, when the dynamic policy condition matching table already contains the destination attribute information corresponding to the target domain name, updating the validity period of the destination attribute information corresponding to the target domain name in the dynamic policy condition matching table can facilitate the determination of changes in the attribute information corresponding to the target domain name.

[0011] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, if the dynamic policy condition matching table does not contain the destination attribute information corresponding to the target domain name, updating the correspondence between the destination attribute information and the target domain name policy in the preset dynamic policy condition matching table based on the destination attribute information includes: adding the destination attribute information corresponding to the target domain name to the dynamic policy condition matching table.

[0012] In this embodiment of the application, when the dynamic policy condition matching table does not contain the destination attribute information corresponding to the target domain name, the destination attribute information corresponding to the target domain name is added to the dynamic policy condition matching table. This can improve the attribute information corresponding to the target domain name, prevent omissions when determining the domain name policy based on the dynamic policy condition matching table in the future, and improve the accuracy of this solution.

[0013] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, updating the correspondence between the destination attribute information and the target domain policy in a preset dynamic policy condition matching table based on the destination attribute information includes: updating preset domain configuration information based on the destination attribute information, wherein the domain configuration information includes all attribute information corresponding to the target domain; and obtaining a dynamic policy matching table based on the updated domain configuration information.

[0014] In this embodiment, by setting domain name configuration information, the dynamic policy matching table can be indirectly modified by modifying the domain name configuration information, thus improving the flexibility of this solution.

[0015] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, updating the preset domain name configuration information based on the destination attribute information includes: if the domain name configuration information includes the correspondence between the destination attribute information and the target domain name, updating the validity period of the correspondence between the destination attribute information and the target domain name in the domain name configuration information; if the domain name configuration information does not include the correspondence between the destination attribute information and the target domain name, adding the correspondence between the destination attribute information and the target domain name in the domain name configuration information.

[0016] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, obtaining the target attribute information in the target access request includes: parsing the target access request to obtain a parsing result; and extracting the target attribute information from the parsing result.

[0017] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the dynamic policy condition matching table is stored in the memory of the data forwarding layer.

[0018] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the dynamic policy condition matching table includes the correspondence between domain names and attribute information, and a local preset correspondence between domain names and domain name policies is also provided; the step of updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name includes: updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name.

[0019] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the dynamic policy condition matching table includes the correspondence between domain name policies and attribute information. The step of updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name includes: updating the correspondence between the domain name policies and attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name.

[0020] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the dynamic policy condition matching table includes the correspondence between domain name, attribute information, and domain name policy. Updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table includes: updating the correspondence between the domain name policy and attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name, and updating the attribute information corresponding to the target domain name.

[0021] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the destination attribute information includes an IP (Internet Protocol) address.

[0022] Secondly, this application provides a domain name policy matching method, comprising: the method is used in a domain name system, the domain name system storing: a dynamic policy condition matching table and a static policy condition matching table, wherein the domain name policy in the dynamic policy condition matching table is obtained by the method provided in the first aspect and / or in combination with any of the embodiments of the first aspect, the domain name policy in the static policy condition matching table is pre-configured in the control layer, the static policy condition matching table includes the correspondence between domain name policies and attribute information, the method comprising: obtaining destination attribute information in an access request; matching the destination attribute information with the dynamic policy condition matching table to obtain a first domain name policy; matching the destination attribute information with the static policy condition matching table to obtain a second domain name policy; and determining a target domain name policy based on the first domain name policy and the second domain name policy.

[0023] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, the destination attribute information includes multiple types of attribute information; matching the destination attribute information with a dynamic policy condition matching table to obtain a first domain name policy includes: matching each type of destination attribute information with the dynamic policy condition matching table respectively; if at least one type of attribute information in the destination attribute information matches the attribute information corresponding to any domain name policy in the dynamic policy condition matching table, then the domain name policy is determined to be the first domain name policy; matching the destination attribute information with a static policy condition matching table to obtain a second domain name policy includes: matching each type of destination attribute information with the static policy condition matching table respectively; if at least one type of attribute information in the destination attribute information matches the attribute information corresponding to any domain name policy in the static policy condition matching table, then the domain name policy is determined to be the second domain name policy.

[0024] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, if the dynamic policy condition matching table and the static policy condition matching table have the same domain name policy, determining the target domain name policy based on the first domain name policy and the second domain name policy includes: for any domain name policy: if the domain name policy is simultaneously determined to be both the first domain name policy and the second domain name policy, and each type of attribute information in the destination attribute information is attribute information that matches at least one of the first domain name policy and the second domain name policy, then the domain name policy is determined to be the target domain name policy; if the domain name policy is simultaneously determined to be both the first domain name policy and the second domain name policy, and each type of attribute information in the destination attribute information is not attribute information that matches at least one of the first domain name policy and the second domain name policy, then the domain name policy is determined not to be the target domain name policy.

[0025] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, determining a target domain name strategy based on the first domain name strategy and the second domain name strategy includes: for any domain name strategy: if the domain name strategy is determined only to be the first domain name strategy or only to be the second domain name strategy, and each type of attribute information in the destination attribute information is attribute information that matches the first domain name strategy or the second domain name strategy, then the domain name strategy is determined to be the target domain name strategy; if the domain name strategy is determined only to be the first domain name strategy or only to be the second domain name strategy, and at least one type of attribute information in the destination attribute information is not attribute information that matches the first domain name strategy or the second domain name strategy, then the domain name strategy is determined not to be the target domain name strategy.

[0026] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, determining the target domain name strategy based on the first domain name strategy and the second domain name strategy includes: based on the preset domain name strategy priority, taking the domain name strategy with the highest priority among the first domain name strategy and the second domain name strategy as the target domain name strategy.

[0027] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, the destination attribute information includes an IP address.

[0028] Thirdly, this application provides a method for obtaining destination attribute information from an access request sent by a target user; for any domain policy, if the attribute information set corresponding to the domain policy includes the destination attribute information, then the domain policy is determined to be a target domain policy; wherein, the attribute information set corresponding to the domain policy is the sum of the attribute information corresponding to the domain policy in a preset static policy condition matching table and a preset dynamic policy condition matching table, the dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the method described in any one of claims 1-11, and the static policy condition matching table includes the correspondence between domain policies and attribute information.

[0029] In this embodiment of the application, the dynamic policy condition matching table can be updated according to the access request, thereby making the second matching result more accurate and improving the accuracy of the target domain name policy corresponding to the obtained access request.

[0030] In conjunction with the technical solution provided in the third aspect above, in some possible implementations, the target attribute information includes multiple types of attribute information, and each type of attribute information in each domain name policy corresponds to an attribute information set; the step of determining that a domain name policy is a target domain name policy if the attribute information set corresponding to the domain name policy includes the target attribute information includes: for each type of attribute information in any domain name policy, if the attribute information set corresponding to the type of attribute information includes the type of attribute information in the target attribute information, then the domain name policy is determined to be a target domain name policy.

[0031] In conjunction with the technical solution provided in the third aspect above, in some possible implementations, the destination attribute information includes an IP address.

[0032] In conjunction with the technical solution provided in the third aspect above, in some possible implementations, if the IP address includes a target destination IP address; the attribute information set includes a destination IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; and if the attribute information set corresponding to the domain name policy includes the destination attribute information, then determining the domain name policy as the target domain name policy includes: if the destination IP address set corresponding to the domain name policy includes the target destination IP address, then determining the domain name policy as the target domain name policy.

[0033] In conjunction with the technical solution provided in the third aspect above, in some possible implementations, if the IP address includes a target destination IP address and a target source IP address; the attribute information set includes a destination IP address set and a source IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in a preset static policy condition matching table and a preset dynamic policy condition matching table; the source IP address set is the sum of the source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; and the step of determining the domain name policy as a target domain name policy if the attribute information set corresponding to the domain name policy includes the destination attribute information, includes: if the destination IP address set corresponding to the domain name policy includes the target destination IP address, and the source IP address set corresponding to the domain name policy includes the target source IP address, then the domain name policy is determined as the target domain name policy.

[0034] In conjunction with the technical solution provided in the third aspect above, in some possible implementations, if there are multiple target domain name strategies, the target domain name strategy with the highest priority is determined as the final target domain name strategy based on the preset priority of each target domain name strategy.

[0035] Fourthly, this application provides a domain name policy configuration device, comprising: an acquisition module and a processing module. The acquisition module is used to acquire destination attribute information from a target access request, wherein the destination attribute information is domain name-related attribute information. The processing module is used to update the correspondence between the destination attribute information and the target domain name policy in a preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain name, thereby obtaining an updated dynamic policy condition matching table. The dynamic policy condition matching table is used to represent the correspondence between domain name policies and attribute information.

[0036] Fifthly, this application provides a domain name policy matching device, comprising: an acquisition module, a first matching module, a second matching module, and a processing module. The acquisition module is used to acquire attribute information from an access request; the first matching module is used to match the attribute information with a dynamic policy condition matching table to obtain a first domain name policy, wherein the domain name policy in the dynamic policy condition matching table is obtained by adopting any possible implementation of the first aspect and / or combining the first aspect; the second matching module is used to match the attribute information with a static policy condition matching table to obtain a second domain name policy, wherein the domain name policy in the static policy condition matching table is pre-configured in the control layer, and the static policy condition matching table includes a correspondence between domain name policies and attribute information; the processing module is used to determine a target domain name policy based on the first domain name policy and the second domain name policy.

[0037] Sixthly, this application provides a domain name policy matching device, comprising: an acquisition module and a processing module. The acquisition module is used to acquire destination attribute information from an access request sent by a target user. The processing module is used to determine that a domain name policy is a target domain name policy if the attribute information set corresponding to the domain name policy includes the destination attribute information for any given domain name policy. The attribute information set corresponding to the domain name policy is the sum of the attribute information corresponding to the domain name policy in a preset static policy condition matching table and a preset dynamic policy condition matching table. The dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the technical solutions provided by the first aspect and / or in combination with any possible implementation of the first aspect.

[0038] In a seventh aspect, embodiments of this application provide an electronic device, including a processor and a memory connected to the processor, wherein the memory stores a computer program that, when executed by the processor, causes the electronic device to perform the method described in the first aspect and / or in combination with any embodiment of the first aspect, or causes the electronic device to perform the method described in the second aspect and / or in combination with any embodiment of the second aspect, or causes the electronic device to perform the method described in the third aspect and / or in combination with any embodiment of the third aspect.

[0039] Eighthly, embodiments of this application provide a storage medium storing a computer program that, when run on a computer, causes the computer to perform the method described in the first aspect and / or in combination with any embodiment of the first aspect, or causes the computer to perform the method described in the second aspect and / or in combination with any embodiment of the second aspect, or causes the electronic device to perform the method described in the third aspect and / or in combination with any embodiment of the third aspect. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram of the connection structure between a firewall device and different devices in the prior art;

[0042] Figure 2 This is a flowchart illustrating the first domain name policy configuration method according to an embodiment of this application;

[0043] Figure 3 This is a flowchart illustrating a second domain name policy configuration method according to an embodiment of this application;

[0044] Figure 4 This is a flowchart illustrating a domain name policy matching method according to an embodiment of this application;

[0045] Figure 5 This is a flowchart illustrating a domain name policy matching method according to an embodiment of this application;

[0046] Figure 6 This is a structural block diagram of a domain name policy configuration device shown in an embodiment of this application;

[0047] Figure 7 This is a structural block diagram of a domain name policy matching device shown in an embodiment of this application;

[0048] Figure 8 This is a structural block diagram of a domain name policy matching device shown in an embodiment of this application;

[0049] Figure 9 This is a structural block diagram of an electronic device shown in an embodiment of this application. Detailed Implementation

[0050] The terms “first”, “second”, etc., are used only for distinguishing descriptions and do not indicate a sequence number, nor should they be interpreted as indicating or implying relative importance.

[0051] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0052] It should be noted that similar reference numerals and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, relational terms such as "first," "second," etc., in the description of this application are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0053] Furthermore, the term "and / or" in this application is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0054] The technical solution of this application will now be described in detail with reference to the accompanying drawings.

[0055] Please see Figure 2 , Figure 2 This is a flowchart illustrating a domain name policy configuration method according to an embodiment of this application. The following will be combined with... Figure 2 The steps involved are explained.

[0056] S100: Obtain the destination attribute information from the target access request, where the destination attribute information is attribute information related to the domain name.

[0057] Attribute information is information associated with the domain name. For example, attribute information can be an IP address, etc., as long as the domain name strategy can be determined based on the attribute information.

[0058] When the destination attribute information includes the destination IP address, the destination domain name is the domain name corresponding to the domain policy. For example, when the domain policy is to control traffic to domain A, the destination domain name is domain A. Accordingly, the destination access request is an access request to domain A, and the destination IP address is the IP address corresponding to domain A.

[0059] The specific way to obtain the target attribute information in the target access request is as follows: first, parse the target access request to obtain the parsing result, and then extract the target attribute information from the parsing result.

[0060] For example, when the destination attribute information includes the destination IP address, the specific way to obtain the destination IP address in the target access request can be: first, parse the target access request to obtain the parsing result, and then extract the destination IP address from the parsing result.

[0061] It is understandable that the destination IP address in the target access request can be obtained by the client that sends the target access request. Specifically, the client can communicate with the DNS server to obtain the destination IP address corresponding to the target domain name from the DNS server, and then generate a target access request carrying the destination IP address and send it to the accessed device.

[0062] It can also be understood that the method provided in this application embodiment can be implemented by a device with a firewall installed (i.e., a firewall device), which can intercept the target access request carrying the destination IP address through the firewall, thereby executing the scheme of this application embodiment.

[0063] The methods for parsing access requests are well known to those skilled in the art, and will not be elaborated upon here for the sake of brevity.

[0064] S200: Based on the destination attribute information, update the correspondence between the destination attribute information and the target domain policy in the preset dynamic policy condition matching table to obtain the updated dynamic policy condition matching table.

[0065] The dynamic policy condition matching table is used to represent the correspondence between attribute information and domain policies. Domain policies are policies configured by the administrator for functions such as data redirection, traffic control, and business communication quality control. These policies are related to domain names, or their hit conditions include domain names.

[0066] Optionally, the dynamic policy condition matching table can also be used to represent the correspondence between domain names, attribute information, and domain policies.

[0067] The dynamic strategy condition matching table can be implemented in the following ways.

[0068] In the first implementation, the dynamic policy condition matching table includes the correspondence between domain names and attribute information, and the local preset has a correspondence between domain names and domain policies.

[0069] At this point, the specific process of updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain name can be as follows: based on the destination attribute information and the corresponding target domain name, update the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table.

[0070] Optionally, when the attribute information includes IP addresses, the dynamic policy condition matching table can include the mapping between domain names and IP addresses. Since electronic devices store the mapping between domain policies and domain names, when the dynamic policy condition matching table includes this mapping, the target domain name corresponding to the target IP address included in the access request can be determined based on the dynamic policy condition matching table. Then, based on the mapping between domain names and domain policies, the target domain policy corresponding to the target IP address can be determined.

[0071] The correspondence between domain names and domain name policies includes: the destination domain name (the domain name that the access request needs to access) corresponding to the domain name policy, and / or the source domain name (the domain name of the device that sent the access request) corresponding to the domain name policy.

[0072] For ease of understanding, the dynamic strategy condition matching table can be shown in Table 1:

[0073] Table 1

[0074]

[0075] As shown in Table 1, the dynamic policy condition matching table includes the set of IP addresses corresponding to each of domain name 1, domain name 2, ..., domain name x. The specific implementation of the dynamic policy condition matching table is not limited to the method shown in Table 1.

[0076] In the second implementation, the dynamic policy condition matching table includes the correspondence between domain policy and attribute information.

[0077] At this point, based on the destination attribute information and the corresponding target domain name, the specific way to update the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table can be: based on the destination attribute information and the corresponding target domain name, update the correspondence between the domain policy and attribute information corresponding to the target domain name in the preset dynamic policy condition matching table.

[0078] Optionally, when the attribute information includes the destination IP address and the source IP address, the dynamic policy condition matching table can include the mapping between IP addresses and domain name policies. In this case, the target domain name policy corresponding to the target IP address included in the access request can be determined based on the dynamic policy condition matching table.

[0079] The correspondence between IP addresses and domain name policies includes: the destination IP address corresponding to the domain name policy (the IP address that the access request needs to access), and / or the source IP address corresponding to the domain name policy (the IP address of the device that sent the access request).

[0080] For ease of understanding, the dynamic strategy condition matching table can be shown in Table 2:

[0081] Table 2

[0082]

[0083] As shown in Table 2, the dynamic policy condition matching table includes the destination IP address set and source IP address set corresponding to each of domain policy 1, domain policy 2, ..., domain policy n. The specific implementation of the dynamic policy condition matching table is not limited to the method shown in Table 2.

[0084] The third implementation method includes a dynamic policy condition matching table that includes the correspondence between domain name, attribute information, and domain name policy.

[0085] At this point, the specific way to update the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table can be: based on the target attribute information and the corresponding target domain name, update the correspondence between the domain policy and attribute information corresponding to the target domain name in the preset dynamic policy condition matching table, and update the attribute information corresponding to the target domain name.

[0086] Optionally, when the attribute information includes the destination IP address and the source IP address, the dynamic policy condition matching table can include the mapping relationship between IP address, domain name, and domain name policy. In this case, the target domain name policy corresponding to the target IP address included in the access request can be determined based on the dynamic policy condition matching table.

[0087] For ease of understanding, the dynamic strategy condition matching table can be shown in Table 3:

[0088] Table 3

[0089]

[0090] As shown in Table 3, the dynamic policy condition matching table includes the destination IP address, source IP address, destination domain name, and source domain name for each of Domain Policy 1, Domain Policy 2, ..., Domain Policy n. The specific implementation of the dynamic policy condition matching table is not limited to the method shown in Table 3.

[0091] Specifically, the dynamic policy condition matching table includes at least one hit condition for the destination address of a domain policy. For example, when the hit condition for domain policy A is that the domain name of the access request is domain A, and the hit condition for domain policy B is that the domain name of the access request is domain B, the dynamic policy condition matching table includes the mapping relationship between domain A and IP address, and the mapping relationship between domain B and IP address. When the destination IP address of the access request corresponds to domain A, the access request hits domain policy A; when the destination IP address of the access request corresponds to domain B, the access request hits domain policy B.

[0092] In one implementation, when the target attribute information is obtained, the correspondence between the target domain name and the target attribute information can be directly updated in a preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name.

[0093] If the dynamic policy condition matching table already contains the destination attribute information corresponding to the target domain name, the specific process of updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain name can be: updating the validity period of the destination attribute information corresponding to the target domain name in the dynamic policy condition matching table.

[0094] Taking destination attribute information including destination domain name as an example, when updating the mapping relationship between target domain name and IP address in the dynamic policy condition matching table, if the dynamic policy condition matching table already has the mapping relationship between destination IP address and target domain name, the specific way to update the mapping relationship of target domain name in the preset dynamic policy condition matching table is to update the validity period of the mapping relationship between destination IP address and target domain name in the dynamic policy condition matching table.

[0095] For ease of understanding, taking the mapping between domain name A and IP address 1 and IP address 2 in the dynamic policy condition matching table as an example, when the destination IP address corresponding to the target access request is IP address 1, since the mapping between domain name A and IP address 1 already exists in the dynamic policy condition matching table, the validity period of the mapping between domain name A and IP address 1 in the dynamic policy condition matching table is updated to the current time, or the validity period of the mapping between domain name A and IP address 1 in the dynamic policy condition matching table is updated to the time when the target access request was received. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0096] If the dynamic policy condition matching table does not contain the destination attribute information corresponding to the target domain name, the specific process of updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain name can be as follows: add the destination attribute information corresponding to the target domain name to the dynamic policy condition matching table.

[0097] Taking destination attribute information including destination domain name as an example, when updating the mapping relationship between destination domain name and IP address in the dynamic policy condition matching table, if the dynamic policy condition matching table does not have a mapping relationship between destination IP address and destination domain name, the specific way to update the mapping relationship of destination domain name in the preset dynamic policy condition matching table is: add a mapping relationship between destination IP address and destination domain name in the dynamic policy condition matching table.

[0098] For ease of understanding, let's take the dynamic policy condition matching table, which includes the mapping between domain name A and IP address 1 and IP address 2, as an example. When the destination IP address corresponding to the target access request is IP address 3, since the dynamic policy condition matching table does not currently have a mapping between domain name A and IP address 3, a new mapping between domain name A and IP address 3 is added to the dynamic policy condition matching table. The updated dynamic policy condition matching table then includes the mapping between domain name A and IP address 1, IP address 2, and IP address 3. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0099] In one implementation, after obtaining the target attribute information, the preset domain name configuration information can be updated based on the target attribute information. The domain name configuration information includes all attribute information corresponding to the target domain name. Then, a dynamic policy matching table is obtained based on the updated domain name configuration information.

[0100] Taking destination attribute information including destination domain name as an example, when the destination IP address is obtained, the domain name configuration information can be updated first based on the destination IP address and its corresponding destination IP address, and then the dynamic policy condition matching table can be updated based on the domain name configuration information.

[0101] The specific method for updating the dynamic policy condition matching table based on the destination IP address and its corresponding destination IP address can be as follows: First, update the preset domain name configuration information based on the destination IP address. The domain name configuration information includes all IP addresses corresponding to the target domain name. Then, based on the updated domain name configuration information, obtain the dynamic policy matching table.

[0102] The domain name configuration information can include only one mapping between a domain name and an IP address; or it can include multiple mappings between domain names and IP addresses. There are no restrictions on this.

[0103] Understandably, when the domain name configuration information only includes a mapping between a domain name and an IP address, it can store only the IP address corresponding to the target domain name. In this case, all IP addresses present in the domain name configuration information correspond to the target domain name.

[0104] Optionally, if the domain configuration information includes the correspondence between destination attribute information and target domain name, update the validity period of the correspondence between destination attribute information and target domain name in the domain configuration information.

[0105] Taking the destination domain name as an example, if the domain name configuration information includes the correspondence between the destination IP address and the target domain name, the way to update the preset domain name configuration information based on the destination IP address can be: update the validity period of the correspondence between the destination IP address and the target domain name in the domain name configuration information.

[0106] For ease of understanding, let's take the example of a domain name configuration information that includes the mapping between domain name A and IP address 1 and IP address 2. When the destination IP address corresponding to the target access request is IP address 1, since the mapping between domain name A and IP address 1 already exists in the domain name configuration information, the validity period of the mapping between domain name A and IP address 1 in the domain name configuration information is updated to the current time, or the validity period of the mapping between domain name A and IP address 1 in the domain name configuration information is updated to the time when the target access request was received. This example is only for ease of understanding and should not be construed as a limitation of this application.

[0107] Optionally, if the domain configuration information does not include the correspondence between destination attribute information and target domain name, the correspondence between destination attribute information and target domain name can be added to the domain configuration information.

[0108] Taking the destination domain name as an example, if the domain name configuration information does not include the correspondence between the destination IP address and the target domain name, the way to update the preset domain name configuration information based on the destination IP address and its corresponding destination IP address is to add the correspondence between the destination IP address and the target domain name in the domain name configuration information.

[0109] For ease of understanding, let's take an example where the domain name configuration information includes the mapping between domain name A and IP address 1 and IP address 2. When the destination IP address corresponding to the target access request is IP address 3, since the mapping between domain name A and IP address 3 does not exist in the domain name configuration information, a new mapping between domain name A and IP address 3 is added to the domain name configuration information. The updated domain name configuration information includes the mapping between domain name A and IP address 1, IP address 2, and IP address 3. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0110] When the domain name configuration information includes only one mapping between a domain name and an IP address, the specific method for obtaining the dynamic policy matching table based on the updated domain name configuration information can be as follows: The dynamic policy matching table is obtained based on the mapping between the target domain name and all IP addresses included in the domain name configuration information. The resulting dynamic policy matching table then includes the mapping between the target domain name and all its corresponding IP addresses.

[0111] When the domain name configuration information includes multiple mappings between domain names and IP addresses, the specific method for obtaining the dynamic policy matching table based on the updated domain name configuration information can be as follows: determine the mapping between the target domain name and IP address from the domain name configuration information, and then obtain the dynamic policy matching table based on the mapping between the target domain name and IP address. The target domain name is determined according to the domain name policy. For example, if the domain name policy is to control traffic to domain name A, then the target domain name is domain name A. In this case, the mapping between domain name A and IP address is determined from the domain name configuration information. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0112] To further understand the domain policy configuration method described above, please refer to [link / reference]. Figure 3 It is important to note that... Figure 3 This is merely one specific implementation of the domain name policy configuration method provided in this application and should not be taken as a limitation of this application.

[0113] like Figure 3 As shown, the target access request is first parsed to obtain the parsing result. Then, the destination IP address is extracted from the parsing result. Next, it is determined whether a mapping exists between the target domain name and the destination IP address in the domain name record information, where the target domain name is the domain name corresponding to the target access request.

[0114] The domain name record information includes the mapping between the destination IP address and the target domain name, and the validity period for updating the mapping between the destination IP address and the target domain name in the domain name configuration information.

[0115] The domain name configuration information does not include the mapping between the destination IP address and the target domain name. Please add the mapping between the destination IP address and the target domain name in the domain name configuration information.

[0116] Finally, a dynamic policy matching table is obtained based on the updated domain name configuration information.

[0117] Figure 3 The specific implementation methods and principles of each step in the domain name policy configuration method shown have been clearly described above, and will not be repeated here for the sake of brevity.

[0118] After configuring the dynamic policy matching table according to the above-described domain name policy configuration method, it can be determined whether the received access request matches the domain name policy based on this dynamic policy condition matching table and the policy condition matching table. The policy condition matching table is based on existing technology. However, even if the IP address of the target domain name corresponding to this domain name policy condition matching table changes, it is not necessary to communicate with the DNS server to rebuild the domain name policy condition matching table. Instead, the change in the IP address of the target domain name is reflected through the dynamic policy condition matching table. This ensures that the forwarding layer's data forwarding action is not interrupted while maintaining the accuracy of the target domain name policy corresponding to the access request, thus minimizing the impact on the firewall device's performance.

[0119] Please see Figure 4 , Figure 4 This is a flowchart illustrating a domain name policy matching method according to an embodiment of this application. This method is applied to a domain name system, which stores a dynamic policy condition matching table and a static policy condition matching table. The domain name policies in the dynamic policy condition matching table are obtained using the aforementioned domain name policy configuration method. The domain name policies in the static policy condition matching table are pre-configured at the control layer. The static policy condition matching table includes the correspondence between domain name policies and attribute information. The following will describe the process in conjunction with... Figure 4 The steps involved are explained.

[0120] S300: Retrieve attribute information from the access request.

[0121] The specific methods for obtaining attribute information from access requests are well known to those skilled in the art, and will not be elaborated here for the sake of brevity.

[0122] S400: Match the attribute information with the dynamic policy condition matching table to obtain the first domain policy.

[0123] The first domain policy can be obtained by matching attribute information with the dynamic policy condition matching table in the following two ways.

[0124] In the first implementation, the attribute information is matched with the dynamic policy condition matching table, and the domain policy in which the attribute information matches all the matching conditions in the dynamic policy condition matching table is taken as the first domain policy.

[0125] Optionally, when the destination attribute information includes multiple types of attribute information, the specific process of matching the destination attribute information with the dynamic policy condition matching table to obtain the first domain name policy may be: matching each type of destination attribute information with the dynamic policy condition matching table respectively; if at least one type of attribute information in the destination attribute information matches the attribute information corresponding to any domain name policy in the dynamic policy condition matching table, then the domain name policy is determined to be the first domain name policy.

[0126] For example, when the attribute information includes the source IP address, destination IP address, and security domain, for each domain policy in the dynamic policy condition matching table, if the source IP address included in the attribute information matches the source IP address corresponding to the domain policy, the destination IP address included in the attribute information matches the destination IP address corresponding to the domain policy, and the security domain included in the attribute information meets the security domain condition corresponding to the domain policy, then the domain policy is used as the first domain policy.

[0127] In the second implementation method, the attribute information is matched with the dynamic policy condition matching table, and the domain policy that successfully matches some of the matching conditions in the dynamic policy condition matching table is taken as the first domain policy.

[0128] Optionally, when the target attribute information includes multiple types of attribute information, the specific process of matching the target attribute information with the dynamic policy condition matching table to obtain the first domain name policy can be as follows: if each type of attribute information of the target attribute information matches one-to-one with each type of attribute information of the domain name policy in the dynamic policy condition matching table, the domain name policy is determined to be the first domain name policy.

[0129] The destination attribute information may include the source IP address and the destination IP address. It may also include the security domain.

[0130] For example, when the attribute information includes the source IP address, destination IP address, and security domain, for each domain policy in the dynamic policy condition matching table, as long as the attribute information satisfies at least one of the following conditions: the source IP address included in the attribute information matches the source IP address corresponding to the domain policy, the destination IP address included in the attribute information matches the destination IP address corresponding to the domain policy, and the security domain included in the attribute information satisfies the security domain condition corresponding to the domain policy, the domain policy can be used as the first domain policy.

[0131] S500: Match the attribute information with the static policy condition matching table to obtain the second domain policy.

[0132] The second domain name policy can be obtained by matching attribute information with the static policy condition matching table in the following two ways.

[0133] In the first implementation, the attribute information is matched with a static policy condition matching table, and the domain policy for which the attribute information matches all the matching conditions in the static policy condition matching table is used as the second domain policy.

[0134] Optionally, when the target attribute information includes multiple types of attribute information, the specific process of matching the target attribute information with the static policy condition matching table to obtain the second domain name policy can be as follows: each type of target attribute information is matched with the static policy condition matching table respectively; if each type of attribute information of the target attribute information matches one-to-one with each type of attribute information of the domain name policy in the static policy condition matching table, the domain name policy is determined to be the target domain name policy.

[0135] In the second implementation, the attribute information is matched with a static policy condition matching table, and the domain policy that successfully matches some of the matching conditions in the static policy condition matching table is taken as the second domain policy.

[0136] Optionally, when the destination attribute information includes multiple types of attribute information, the specific process of matching the destination attribute information with the static policy condition matching table to obtain the second domain name policy can be as follows: if at least one type of attribute information in the destination attribute information matches the attribute information corresponding to any domain name policy in the static policy condition matching table, then the domain name policy is determined to be the second domain name policy.

[0137] The specific principles and implementation methods for matching attribute information with static policy condition matching tables are the same as those for matching attribute information with dynamic policy condition matching tables, as described above. For the sake of brevity, they will not be repeated here.

[0138] S600: Determine the target domain strategy based on the first domain strategy and the second domain strategy.

[0139] When a domain policy whose attribute information matches all matching conditions in the dynamic policy condition matching table is selected as the first domain policy, and a domain policy whose attribute information matches all matching conditions in the static policy condition matching table is selected as the second domain policy, the domain policy with the highest priority among the first and second domain policies is selected as the target domain policy based on the preset domain policy priority. Alternatively, a domain policy is randomly selected from the first and second domain policies as the target domain policy.

[0140] When a domain strategy that successfully matches some matching conditions in the dynamic policy condition matching table is designated as the first domain strategy, and a domain strategy that successfully matches some matching conditions in the static policy condition matching table is designated as the second domain strategy, and the first and second domain strategies include the same domain strategy, for any domain strategy: if the domain strategy is simultaneously determined to be both the first and second domain strategies, and each type of attribute information in the target attribute information is an attribute information that matches at least one of the first and second domain strategies, then the domain strategy is determined to be the target domain strategy; if the domain strategy is simultaneously determined to be both the first and second domain strategies, and each type of attribute information in the target attribute information is not an attribute information that matches at least one of the first and second domain strategies, then the domain strategy is determined not to be the target domain strategy.

[0141] For example, when the destination attribute information includes the destination IP address and the source IP address, the destination IP address corresponding to Domain Policy 1 in the static policy condition matching table includes: IP address 1, IP address 2, and the source IP address corresponding to Domain Policy 1 includes: IP address 3, IP address 4; the destination IP address corresponding to Domain Policy 1 in the dynamic policy condition matching table includes: IP address 5, IP address 6, and the source IP address corresponding to Domain Policy 1 includes: IP address 7, IP address 8.

[0142] If the destination IP address in the destination attribute information is IP address 1 and the source IP address is IP address 7, then the destination IP address in the destination attribute information matches policy 1 in the static policy condition matching table. Therefore, policy 1 is the second domain name policy. Since the source IP address in the destination attribute information is IP address 7, which matches policy 1 in the dynamic policy condition matching table, policy 1 is the first domain name policy. Because the source IP address in the destination attribute information matches the dynamic policy condition matching table, and the destination IP address in the destination attribute information matches the static policy condition matching table, that is, each type of attribute information (destination IP address, source IP address) in the destination attribute information matches policy 1 in either the static or dynamic policy condition matching table. Therefore, policy 1 is the target domain name policy. This example is for illustrative purposes only; the attribute information is not limited to the aforementioned source and destination IP addresses and should not be considered a limitation of this application.

[0143] In one implementation, for any domain policy, if the domain policy is determined to be only the first domain policy or only the second domain policy, and each type of attribute information in the destination attribute information is an attribute information that matches the first domain policy or the second domain policy, then the domain policy is determined to be the target domain policy. If the domain policy is determined to be only the first domain policy or only the second domain policy, and at least one type of attribute information in the destination attribute information is not an attribute information that matches the first domain policy or the second domain policy, then the domain policy is determined not to be the target domain policy.

[0144] For example, when the destination attribute information includes the destination IP address and the source IP address, the destination IP address corresponding to Domain Policy 1 in the static policy condition matching table includes: IP address 1, IP address 2, and the source IP address corresponding to Domain Policy 1 includes: IP address 3, IP address 4; the destination IP address corresponding to Domain Policy 1 in the dynamic policy condition matching table includes: IP address 5, IP address 6, and the source IP address corresponding to Domain Policy 1 includes: IP address 7, IP address 8.

[0145] At this point, if the destination IP address in the destination attribute information is IP address 1 and the source IP address is IP address 3, then it can be confirmed that the destination attribute information matches domain policy 1 in the static policy condition matching table, thus confirming that domain policy 1 is the target domain policy. If the source IP address in the destination attribute information is IP address 1 and the destination IP address is IP address 9, then domain policy 1 is not the target domain policy.

[0146] Similarly, if the destination IP address in the destination attribute information is IP address 5 and the source IP address is IP address 8, then it can be confirmed that the destination attribute information matches domain policy 1 in the dynamic policy condition matching table, thus confirming that domain policy 1 is the target domain policy. If the source IP address in the destination attribute information is IP address 8 and the destination IP address is IP address 9, then domain policy 1 is not the target domain policy. This example is provided for ease of understanding only and should not be considered a limitation of this application.

[0147] When there are multiple target domain policies, the highest priority target domain policy can be selected as the final target domain policy based on the preset policy priority.

[0148] Please see Figure 5 , Figure 5 This is a flowchart illustrating a domain name policy matching method according to an embodiment of this application. The following will be combined with... Figure 5 The steps involved are explained.

[0149] S700: Obtain the destination attribute information from the access request sent by the target user.

[0150] Among them, the attribute information is information associated with the domain name. For example, the attribute information may include the IP address. In addition to the IP address, the attribute information may also include information such as the security domain. The types of information included in the attribute information can be set according to actual needs, and there are no restrictions on them here.

[0151] The IP address included in the attribute information may include the destination IP address and / or the source IP address.

[0152] The specific methods for obtaining attribute information from access requests are well known to those skilled in the art, and will not be elaborated here for the sake of brevity.

[0153] S800: For any domain policy, if the attribute information set corresponding to the domain policy includes destination attribute information, then the domain policy is determined to be a target domain policy.

[0154] The set of attribute information corresponding to the domain name policy is the sum of the attribute information corresponding to the domain name policy in the preset static policy condition matching table and the preset dynamic policy condition matching table.

[0155] For example, when the attribute information includes IP addresses, the attribute information set corresponding to the domain name policy includes the IP address set, which is the sum of the IP addresses corresponding to the domain name policy in the preset static policy condition matching table and the preset dynamic policy condition matching table.

[0156] When the target attribute information includes multiple types of attribute information, each type of attribute information in each domain policy corresponds to an attribute information set; for any domain policy, if the attribute information set corresponding to the domain policy includes the target attribute information, the specific way to determine that the domain policy is the target domain policy can be: for each type of attribute information in any domain policy, if the attribute information set corresponding to the type of attribute information includes the type of attribute information in the target attribute information, then the domain policy is determined to be the target domain policy.

[0157] The static policy condition matching table is a policy condition matching table obtained based on existing technology. This static policy condition matching table includes the correspondence between domain policies and attribute information.

[0158] Optionally, when the attribute information includes IP addresses, the static policy condition matching table may include the mapping between domain policies and IP addresses. For example, it may include the mapping between domain policies and destination IP addresses, and / or the mapping between domain policies and source IP addresses. The policy condition matching table may also include security domain hit conditions corresponding to the domain policies, etc. For easier understanding, please refer to Table 4:

[0159] Table 4

[0160]

[0161] As shown in Table 4, the policy condition matching table includes the matching conditions for each of Domain Policy 1, Domain Policy 2, ..., Domain Policy n. If the target domain corresponding to Domain Policy 1 is Domain A, then IP Address 1 is the IP address corresponding to Domain A. The source IP address is the IP address of the client that sent the access request. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0162] The dynamic policy condition matching table is a dynamic policy condition matching table. The specific implementation of the dynamic policy condition matching table has been clearly described above. For the sake of brevity, the content not mentioned here can be referred to the relevant content in the aforementioned domain name policy configuration method embodiment.

[0163] Optionally, when the attribute information includes an IP address and the destination attribute information includes a destination IP address, the attribute information set includes a destination IP address set. The destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table. For any domain name policy, if the IP address set corresponding to the domain name policy includes a target IP address, the specific process of determining that the domain name policy is a target domain name policy can be: if the destination IP address set corresponding to the domain name policy includes a target destination IP address, then the domain name policy is determined to be the target domain name policy.

[0164] For ease of understanding, let's take the example of a static policy condition matching table that corresponds to Domain Policy 1, including IP address 1 and IP address 2, and a dynamic policy condition matching table that corresponds to Domain Policy 1, including IP address 3 and IP address 4. In this case, the set of destination IP addresses includes: IP address 1, IP address 2, IP address 3, and IP address 4.

[0165] If the target IP address is IP address 3, then Domain Policy 1 can be determined as the target domain policy. If the target IP address is IP address 5, since the set of destination IP addresses does not include IP address 5, Domain Policy 1 is not the target domain policy.

[0166] One way to determine whether the target destination IP address is included in the set of destination IP addresses corresponding to the domain name policy is to obtain all destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table, obtain the set of destination IP addresses, and then determine whether the set of destination IP addresses includes the target destination IP address.

[0167] Alternatively, determining whether the set of destination IP addresses corresponding to the domain name policy includes the target destination IP address can be done as follows: First, determine whether all destination IP addresses corresponding to the domain name policy in the static policy condition matching table include the target destination IP address, obtaining a first determination result; second, determine whether all destination IP addresses corresponding to the domain name policy in the dynamic policy condition matching table include the target destination IP address, obtaining a second determination result. When at least one of the first and second determination results indicates that the target destination IP address is included, it is determined that the set of destination IP addresses corresponding to the domain name policy includes the target destination IP address.

[0168] Optionally, when the target IP address includes the source IP address, the IP address set includes the source IP address set; the source IP address set is the sum of the source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table. For any domain name policy, if the IP address set corresponding to the domain name policy includes the target IP address, the specific process of determining that the domain name policy is the target domain name policy can be: if the source IP address set corresponding to the domain name policy includes the target source IP address, then the domain name policy is determined to be the target domain name policy.

[0169] For ease of understanding, let's take the example of a static policy condition matching table where the source IP addresses corresponding to domain policy 1 include IP address 1 and IP address 2, and a dynamic policy condition matching table where the source IP addresses corresponding to domain policy 1 include IP address 3 and IP address 4. In this case, the set of source IP addresses includes IP address 1, IP address 2, IP address 3, and IP address 4.

[0170] If the target IP address is IP address 3, then Domain Name Policy 1 can be determined as the target domain name policy. If the target IP address is IP address 5, since the source IP address set does not include IP address 5, Domain Name Policy 1 is not the target domain name policy.

[0171] One way to determine whether the target source IP address is included in the set of source IP addresses corresponding to the domain name policy is to obtain all source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table, obtain the set of source IP addresses, and then determine whether the set of source IP addresses includes the target source IP address.

[0172] Alternatively, determining whether the set of source IP addresses corresponding to the domain name policy includes the target source IP address can be done as follows: First, determine whether all source IP addresses corresponding to the domain name policy in the static policy condition matching table include the target source IP address, obtaining a third determination result; second, determine whether all source IP addresses corresponding to the domain name policy in the dynamic policy condition matching table include the target source IP address, obtaining a fourth determination result. If at least one of the third or fourth determination results indicates that the target source IP address is included, then it is determined that the set of source IP addresses corresponding to the domain name policy includes the target source IP address.

[0173] Optionally, when the target IP address includes both the destination IP address and the source IP address, the IP address set includes both the destination IP address set and the source IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; the source IP address set is the sum of the source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; if the IP address set corresponding to the domain name policy includes the target IP address, then the domain name policy is determined to be a target domain name policy. The specific process can be: if the destination IP address set corresponding to the domain name policy includes the target destination IP address, and the source IP address set corresponding to the domain name policy includes the target source IP address, then the domain name policy is determined to be a target domain name policy.

[0174] The methods for determining whether the set of destination IP addresses corresponding to the domain name policy includes the target destination IP address and the methods for determining whether the set of source IP addresses corresponding to the domain name policy includes the target source IP address are the same as those described above, and will not be repeated here for brevity.

[0175] Optionally, when the attribute information includes a target IP address and a target security domain, the domain policy matching method further includes: for any domain policy, matching the target security domain with the security domain hit condition corresponding to the domain policy in the static policy condition matching table. In this case, if the set of IP addresses corresponding to the domain policy includes the target IP address, and the security domain hit condition corresponding to the domain policy matches the target security domain, then the domain policy is determined to be the target domain policy.

[0176] The specific methods and principles for determining whether the target IP address is included in the set of IP addresses corresponding to the domain name strategy have been clearly described above, and will not be repeated here for the sake of brevity.

[0177] Optionally, if there are multiple target domain name policies, the target domain name policy with the highest priority can be determined as the final target domain name policy based on the preset priority of each target domain name policy, and then executed.

[0178] The priority of each target domain name strategy can be set according to the actual situation, and this application does not impose any restrictions on this.

[0179] Based on the same inventive concept, this application also provides a domain name policy configuration device, such as... Figure 5 As shown, the domain name policy configuration device 100 includes an acquisition module 110 and a processing module 120.

[0180] The acquisition module 110 is used to acquire the destination attribute information in the target access request, wherein the destination attribute information is attribute information related to the domain name.

[0181] The processing module 120 is used to update the correspondence between the destination attribute information and the target domain policy in a preset dynamic policy condition matching table based on the destination attribute information, so as to obtain an updated dynamic policy condition matching table; wherein, the dynamic policy condition matching table is used to represent the correspondence between the domain policy and the attribute information.

[0182] The processing module 120 is specifically used to update the validity period of the destination attribute information corresponding to the target domain name in the dynamic policy condition matching table if the destination attribute information corresponding to the target domain name is already present in the dynamic policy condition matching table.

[0183] The processing module 120 is specifically used to add the destination attribute information corresponding to the target domain name to the dynamic policy condition matching table if the destination attribute information corresponding to the target domain name is not present in the dynamic policy condition matching table.

[0184] The processing module 120 is specifically used to update the preset domain name configuration information based on the target attribute information, wherein the domain name configuration information includes all attribute information corresponding to the target domain name; and to obtain a dynamic policy matching table based on the updated domain name configuration information.

[0185] The processing module 120 is specifically used to update the validity period of the correspondence between the destination attribute information and the target domain name in the domain name configuration information if the domain name configuration information includes the correspondence between the destination attribute information and the target domain name; and to add the correspondence between the destination attribute information and the target domain name in the domain name configuration information if the domain name configuration information does not include the correspondence between the destination attribute information and the target domain name.

[0186] The acquisition module 110 is specifically used to parse the target access request and obtain the parsing result; and extract the target attribute information from the parsing result.

[0187] In one implementation, the dynamic policy condition matching table is stored in the memory of the data forwarding layer.

[0188] The dynamic policy condition matching table includes the correspondence between domain names and attribute information, and the local preset correspondence between domain names and domain policies; the processing module 120 is specifically used to update the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name.

[0189] The dynamic policy condition matching table includes the correspondence between domain policy and attribute information. The processing module 120, based on the destination attribute information and the corresponding target domain, is specifically used to update the correspondence between the domain policy and attribute information corresponding to the target domain in the preset dynamic policy condition matching table.

[0190] The dynamic policy condition matching table includes the correspondence between domain name, attribute information, and domain name policy. The processing module 120 is specifically used to update the correspondence between the domain name policy and attribute information corresponding to the target domain name in the preset dynamic policy condition matching table based on the target attribute information and the corresponding target domain name, and to update the attribute information corresponding to the target domain name.

[0191] In one implementation, the destination attribute information includes an IP address.

[0192] The domain name policy configuration device 100 provided in this application embodiment has the same implementation principle and technical effect as the aforementioned domain name policy configuration method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned domain name policy configuration method embodiment.

[0193] Based on the same inventive concept, this application also provides a domain name policy matching device, such as... Figure 7 As shown, the domain name policy matching device 200 includes an acquisition module 210 and a processing module 220.

[0194] The acquisition module 210 is used to acquire the destination attribute information in the access request sent by the target user.

[0195] Processing module 220 is used to determine a domain policy as a target domain policy if the attribute information set corresponding to the domain policy includes the target attribute information for any given domain policy. The attribute information set corresponding to the domain policy is the sum of the attribute information corresponding to the domain policy in a preset static policy condition matching table and a preset dynamic policy condition matching table. The dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the aforementioned domain policy configuration method. The static policy condition matching table includes the correspondence between domain policies and attribute information.

[0196] In one feasible embodiment, the target attribute information includes multiple types of attribute information, and each type of attribute information in each domain name policy corresponds to an attribute information set; the processing module 220 is specifically used to determine that the domain name policy is a target domain name policy if the attribute information set corresponding to each type of attribute information in any domain name policy includes the attribute information of the target attribute information.

[0197] In one implementation, the destination attribute information includes an IP address.

[0198] In one optional embodiment, the target IP address includes a target destination IP address; the IP address set includes a destination IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; the processing module 220 is specifically used to determine that the domain name policy is the target domain name policy if the destination IP address set corresponding to the domain name policy includes the target destination IP address.

[0199] In one feasible embodiment, the target IP address includes a target destination IP address and a target source IP address; the IP address set includes a destination IP address set and a source IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; the source IP address set is the sum of the source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; the processing module 220 is specifically used to determine that the domain name policy is the target domain name policy if the destination IP address set corresponding to the domain name policy includes the target destination IP address and the source IP address set corresponding to the domain name policy includes the target source IP address.

[0200] In one feasible embodiment, if there are multiple target domain name policies, the processing module 220 is further configured to determine the target domain name policy with the highest priority as the final target domain name policy based on the preset priority of each target domain name policy.

[0201] The domain name policy matching device 200 provided in this application embodiment has the same implementation principle and technical effect as the aforementioned domain name policy matching method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned domain name policy matching method embodiment.

[0202] Based on the same inventive concept, this application also provides a domain name policy matching device, such as... Figure 8 As shown, the domain name policy matching device 300 includes an acquisition module 310, a first matching module 320, a second matching module 330, and a processing module 340.

[0203] Module 310 is used to obtain attribute information from the access request;

[0204] The first matching module 320 is used to match the attribute information with the dynamic policy condition matching table to obtain the first domain name policy. The dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the above-mentioned domain name policy configuration method.

[0205] The second matching module 330 is used to match the attribute information with the static policy condition matching table to obtain the second domain name policy. The domain name policies in the static policy condition matching table are pre-configured in the control layer. The static policy condition matching table includes the correspondence between domain name policies and attribute information.

[0206] The processing module 340 is used to determine the target domain name policy based on the first domain name policy and the second domain name policy.

[0207] In one feasible embodiment, the target attribute information includes multiple types of attribute information; the first matching module 320 is specifically used to match each type of target attribute information with the dynamic policy condition matching table respectively; if at least one type of attribute information in the target attribute information matches the attribute information corresponding to any domain name policy in the dynamic policy condition matching table, then the domain name policy is determined to be the first domain name policy.

[0208] The second matching module 330 is specifically used to match each type of the target attribute information with the static policy condition matching table respectively; if at least one type of attribute information in the target attribute information matches the attribute information corresponding to any domain policy in the static policy condition matching table, then the domain policy is determined to be the second domain policy.

[0209] The processing module 340 is specifically configured to, for any domain policy: if the domain policy is simultaneously determined to be both the first domain policy and the second domain policy, and each type of attribute information in the destination attribute information is attribute information that matches at least one of the first domain policy and the second domain policy, then the domain policy is determined to be the target domain policy; if the domain policy is simultaneously determined to be both the first domain policy and the second domain policy, and each type of attribute information in the destination attribute information is not attribute information that matches at least one of the first domain policy and the second domain policy, then the domain policy is determined not to be the target domain policy.

[0210] The processing module 340 is specifically used for any domain name policy: if the domain name policy is determined to be only the first domain name policy or only the second domain name policy, and each type of attribute information in the target attribute information is attribute information that matches the first domain name policy or the second domain name policy, then the domain name policy is determined to be the target domain name policy.

[0211] The processing module 340 is specifically used to select the domain name policy with the highest priority among the first domain name policy and the second domain name policy as the target domain name policy based on the preset domain name policy priority.

[0212] In one feasible embodiment, the destination attribute information includes an IP address.

[0213] The domain name policy matching device 300 provided in this application embodiment has the same implementation principle and technical effect as the aforementioned domain name policy matching method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned domain name policy matching method embodiment.

[0214] Please see Figure 9 This is an electronic device 400 provided in an embodiment of this application. The electronic device 400 includes: a processor 410 and a memory 420 communicatively connected to the processor 410.

[0215] The processor 410 and memory 420 can be connected via a communication bus, or via communication modules such as wireless communication modules, Bluetooth communication modules, and 4G / 5G communication modules. The memory 420 is used to store computer programs, such as... Figure 5 or Figure 6 The software functional modules shown are the domain name policy configuration device 100, the domain name policy matching device 200, and the domain name policy matching device 300. Each of these includes at least one software functional module that can be stored in the memory 420 in the form of software or firmware, or embedded in the operating system (OS) of the electronic device 400.

[0216] The processor 410 is configured to execute executable modules stored in the memory 420, such as software function modules or computer programs included in the device 100. In this case, the processor 410 is configured to obtain destination attribute information from the target access request, wherein the destination attribute information is domain-related attribute information; based on the destination attribute information, update the correspondence between the destination attribute information and the target domain policy in a preset dynamic policy condition matching table to obtain an updated dynamic policy condition matching table; wherein the dynamic policy condition matching table is used to characterize the correspondence between domain policy and attribute information.

[0217] The processor 410 is used to execute executable modules stored in the memory 420, such as software function modules or computer programs included in the domain name policy matching device 200. At this time, the processor 410 is used to obtain the destination attribute information in the access request sent by the target user; for any domain name policy, if the attribute information set corresponding to the domain name policy includes the destination attribute information, then the domain name policy is determined to be the target domain name policy; wherein, the attribute information set corresponding to the domain name policy is the sum of the attribute information corresponding to the domain name policy in a preset static policy condition matching table and a preset dynamic policy condition matching table, the dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the above-described domain name policy configuration method, and the static policy condition matching table includes the correspondence between domain name policies and attribute information.

[0218] The processor 410 is used to execute executable modules stored in the memory 420, such as software function modules or computer programs included in the domain name policy matching device 300. At this time, the processor 410 is used to obtain attribute information from the access request; match the attribute information with a dynamic policy condition matching table to obtain a first domain name policy; match the attribute information with a static policy condition matching table to obtain a second domain name policy; and determine a target domain name policy based on the first domain name policy and the second domain name policy.

[0219] The memory 420 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0220] Processor 410 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or processor 410 can be any conventional processor.

[0221] It is understood that the electronic device 400 may also include more general modules required by itself, which will not be described one by one in the embodiments of this application.

[0222] Among them, the aforementioned electronic devices 400 include, but are not limited to, personal computers, servers, etc.

[0223] This application embodiment also provides a computer-readable storage medium (hereinafter referred to as the storage medium) storing a computer program. When the computer program is executed by a computer, such as the electronic device 400 described above, it performs the image drawing method shown above. The computer-readable storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0224] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A domain name policy configuration method, characterized in that, include: Obtain the destination attribute information from the target access request, wherein the destination attribute information is domain-related attribute information; Based on the target attribute information, the correspondence between the target attribute information and the target domain policy is updated in a preset dynamic policy condition matching table to obtain an updated dynamic policy condition matching table; wherein, the dynamic policy condition matching table is used to represent the correspondence between the domain policy and the attribute information. The step of obtaining the target attribute information in the target access request includes: parsing the target access request to obtain a parsing result; and extracting the target attribute information from the parsing result. If the dynamic policy condition matching table already contains the target attribute information corresponding to the target domain name, the step of updating the correspondence between the target attribute information and the target domain name policy in the preset dynamic policy condition matching table based on the target attribute information includes: updating the validity period of the target attribute information corresponding to the target domain name in the dynamic policy condition matching table. If the dynamic policy condition matching table does not contain the target attribute information corresponding to the target domain name, the step of updating the correspondence between the target attribute information and the target domain name policy in the preset dynamic policy condition matching table based on the target attribute information includes: adding the target attribute information corresponding to the target domain name in the dynamic policy condition matching table. The destination attribute information includes the IP address; the dynamic policy condition matching table is stored in the memory of the data forwarding layer and does not require communication with the DNS server.

2. The method according to claim 1, characterized in that, The step of updating the correspondence between the destination attribute information and the target domain policy in a preset dynamic policy condition matching table based on the destination attribute information further includes: The preset domain name configuration information is updated based on the target attribute information, and the domain name configuration information includes all attribute information corresponding to the target domain name; Based on the updated domain name configuration information, a dynamic policy matching table is obtained.

3. The method according to claim 2, characterized in that, The step of updating the preset domain name configuration information based on the destination attribute information includes: If the domain name configuration information includes the correspondence between the destination attribute information and the target domain name, update the validity period of the correspondence between the destination attribute information and the target domain name in the domain name configuration information; If the domain name configuration information does not include the correspondence between the destination attribute information and the target domain name, the correspondence between the destination attribute information and the target domain name shall be added to the domain name configuration information.

4. The method according to any one of claims 1-3, characterized in that, The dynamic policy condition matching table includes the correspondence between domain names and attribute information, and the correspondence between domain names and domain name policies is preset locally. The step of updating the attribute information corresponding to the target domain name in a preset dynamic strategy condition matching table based on the target attribute information and the corresponding target domain name includes: Based on the target attribute information and the corresponding target domain name, update the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table.

5. The method according to any one of claims 1-3, characterized in that, The dynamic policy condition matching table includes the correspondence between domain policies and attribute information. The step of updating the attribute information corresponding to the target domain in the preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain includes: Based on the target attribute information and the corresponding target domain name, the correspondence between the domain policy and attribute information corresponding to the target domain name is updated in the preset dynamic policy condition matching table.

6. The method according to any one of claims 1-3, characterized in that, The dynamic policy condition matching table includes the correspondence between domain names, attribute information, and domain policies. Updating the attribute information corresponding to the target domain name in the preset dynamic policy condition matching table includes: Based on the target attribute information and the corresponding target domain name, the correspondence between the domain policy and attribute information corresponding to the target domain name is updated in the preset dynamic policy condition matching table, and the attribute information corresponding to the target domain name is also updated.

7. A domain name policy matching method, characterized in that, The method is used in a domain name system, which stores a dynamic policy condition matching table and a static policy condition matching table. The domain name policies in the dynamic policy condition matching table are obtained using the method described in any one of claims 1-6. The domain name policies in the static policy condition matching table are pre-configured at the control layer. The static policy condition matching table includes a correspondence between domain name policies and attribute information. The method includes: Retrieve the destination attribute information from the access request; The target attribute information is matched with the dynamic policy condition matching table to obtain the first domain name policy; The target attribute information is matched with the static policy condition matching table to obtain the second domain name policy; Based on the first domain name policy and the second domain name policy, the target domain name policy is determined.

8. The method according to claim 7, characterized in that, The target attribute information includes multiple types of attribute information; the target attribute information is matched with the dynamic policy condition matching table to obtain the first domain name policy, including: Each type of target attribute information is matched with the dynamic strategy condition matching table respectively; If at least one type of attribute information in the target attribute information matches the attribute information corresponding to any domain policy in the dynamic policy condition matching table, then the domain policy is determined to be the first domain policy. The target attribute information is matched with the static policy condition matching table to obtain the second domain name policy, including: Match each type of target attribute information with the static strategy condition matching table respectively; If at least one type of attribute information in the target attribute information matches the attribute information corresponding to any domain policy in the static policy condition matching table, then the domain policy is determined to be the second domain policy.

9. The method according to claim 8, characterized in that, If the dynamic policy condition matching table and the static policy condition matching table have the same domain name policy, the target domain name policy is determined based on the first domain name policy and the second domain name policy, including: Policy for any domain: If the domain policy is determined to be both the first domain policy and the second domain policy, and each type of attribute information in the target attribute information is an attribute information that matches at least one of the first domain policy and the second domain policy, then the domain policy is determined to be the target domain policy. If the domain policy is determined to be both the first domain policy and the second domain policy, and each type of attribute information in the target attribute information is not an attribute information that matches at least one of the first domain policy and the second domain policy, then the domain policy is determined not to be the target domain policy.

10. The method according to claim 8, characterized in that, Based on the first domain name policy and the second domain name policy, the target domain name policy is determined, including: Policy for any domain: If the domain policy is determined to be only the first domain policy or only the second domain policy, and each type of attribute information in the target attribute information is an attribute information that matches the first domain policy or the second domain policy, then the domain policy is determined to be the target domain policy. If the domain policy is determined to be either the first domain policy or the second domain policy, and at least one type of attribute information in the target attribute information is not an attribute information that matches the first domain policy or the second domain policy, then the domain policy is determined not to be the target domain policy.

11. The method according to claim 7, characterized in that, Based on the first domain name policy and the second domain name policy, the target domain name policy is determined, including: Based on the preset domain name policy priority, the domain name policy with the highest priority among the first domain name policy and the second domain name policy is taken as the target domain name policy.

12. A domain name policy matching method, characterized in that, include: Obtain the destination attribute information from the access request sent by the target user; For any domain policy, if the attribute information set corresponding to the domain policy includes the target attribute information, then the domain policy is determined to be a target domain policy; wherein, the attribute information set corresponding to the domain policy is the sum of the attribute information corresponding to the domain policy in a preset static policy condition matching table and a preset dynamic policy condition matching table, the dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the method described in any one of claims 1-6, and the static policy condition matching table includes the correspondence between domain policies and attribute information.

13. The method according to claim 12, characterized in that, The target attribute information includes multiple types of attribute information, and each type of attribute information in each domain name policy corresponds to an attribute information set; for any domain name policy, if the attribute information set corresponding to the domain name policy includes the target attribute information, then the domain name policy is determined to be a target domain name policy, including: For each type of attribute information in any domain name policy, if the attribute information set corresponding to that type of attribute information includes that type of attribute information in the target attribute information, then the domain name policy is determined to be the target domain name policy.

14. The method according to any one of claims 12-13, characterized in that, Its features are, The destination attribute information includes the IP address.

15. The method according to claim 14, characterized in that, If the IP address includes a target IP address; the attribute information set includes a set of destination IP addresses; the set of destination IP addresses is the sum of the destination IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table; If the set of attribute information corresponding to the domain name policy includes the destination attribute information, then determining the domain name policy as the target domain name policy includes: If the set of destination IP addresses corresponding to the domain name policy includes the target destination IP address, then the domain name policy is determined to be the target domain name policy.

16. The method according to claim 14, characterized in that, If the IP address includes a target destination IP address and a target source IP address; the attribute information set includes a destination IP address set and a source IP address set; the destination IP address set is the sum of the destination IP addresses corresponding to the domain name policy in a preset static policy condition matching table and a preset dynamic policy condition matching table; The set of source IP addresses is the sum of the source IP addresses corresponding to the domain name policy in the static policy condition matching table and the dynamic policy condition matching table. If the set of attribute information corresponding to the domain name policy includes the destination attribute information, then determining the domain name policy as the target domain name policy includes: If the set of destination IP addresses corresponding to the domain name policy includes the target destination IP address, and the set of source IP addresses corresponding to the domain name policy includes the target source IP address, then the domain name policy is determined to be the target domain name policy.

17. The method according to any one of claims 12-13, characterized in that, If there are multiple target domain name strategies, the target domain name strategy with the highest priority is determined as the final target domain name strategy based on the preset priority of each target domain name strategy.

18. The method according to claim 14, characterized in that, If there are multiple target domain name strategies, the target domain name strategy with the highest priority is determined as the final target domain name strategy based on the preset priority of each target domain name strategy.

19. The method according to claim 15, characterized in that, If there are multiple target domain name strategies, the target domain name strategy with the highest priority is determined as the final target domain name strategy based on the preset priority of each target domain name strategy.

20. The method according to claim 16, characterized in that, If there are multiple target domain name strategies, the target domain name strategy with the highest priority is determined as the final target domain name strategy based on the preset priority of each target domain name strategy.

21. A domain name policy configuration device, characterized in that, include: The acquisition module is used to acquire the destination attribute information in the target access request, wherein the destination attribute information is domain-related attribute information; The processing module is used to update the correspondence between the destination attribute information and the target domain name policy in a preset dynamic policy condition matching table based on the destination attribute information and the corresponding target domain name, so as to obtain the updated dynamic policy condition matching table; wherein, the dynamic policy condition matching table is used to represent the correspondence between the domain name policy and the attribute information. The acquisition module is specifically used for: parsing the target access request to obtain a parsing result; and extracting the target attribute information from the parsing result. If the dynamic policy condition matching table already contains the destination attribute information corresponding to the target domain name, the processing module is specifically used to: update the validity period of the destination attribute information corresponding to the target domain name in the dynamic policy condition matching table; If the dynamic policy condition matching table does not contain the destination attribute information corresponding to the target domain name, the processing module is specifically used to: add the destination attribute information corresponding to the target domain name to the dynamic policy condition matching table; The destination attribute information includes the IP address; the dynamic policy condition matching table is stored in the memory of the data forwarding layer, and the domain name policy configuration device does not need to communicate with the DNS server.

22. A domain name policy matching device, characterized in that, include: The acquisition module is used to retrieve attribute information from the access request; The first matching module is used to match the attribute information with the dynamic policy condition matching table to obtain the first domain name policy, wherein the domain name policy in the dynamic policy condition matching table is obtained by the method described in any one of claims 1-6. The second matching module is used to match the attribute information with the static policy condition matching table to obtain the second domain name policy. The domain name policies in the static policy condition matching table are pre-configured in the control layer. The static policy condition matching table includes the correspondence between domain name policies and attribute information. The processing module is used to determine the target domain name policy based on the first domain name policy and the second domain name policy.

23. A domain name policy matching device, characterized in that, include: The acquisition module is used to acquire the destination attribute information from the access request sent by the target user; The processing module is configured to, for any given domain policy, determine that the domain policy is a target domain policy if the attribute information set corresponding to the domain policy includes the target attribute information; wherein, the attribute information set corresponding to the domain policy is the sum of the attribute information corresponding to the domain policy in a preset static policy condition matching table and a preset dynamic policy condition matching table, the dynamic policy condition matching table is a dynamic policy condition matching table obtained based on the method described in any one of claims 1-6, and the static policy condition matching table includes the correspondence between domain policies and attribute information.

24. An electronic device, characterized in that, include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is configured to invoke a program stored in the memory to execute the method as described in any one of claims 1-20.

25. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-20.

Images