Policy processing method, apparatus, device, and storage medium

Abstract

This disclosure provides a policy processing method, apparatus, device, and storage medium, which can be applied to the fields of cybersecurity and fintech. The method includes: in response to receiving policy request information, determining an associated policy library corresponding to the policy request information, and policy configuration information for each associated policy in the associated policy library; determining the policy status of each associated policy in the associated policy library; comparing the policy request information and policy configuration information according to preset comparison rules corresponding to the policy status, and generating comparison results; if multiple comparison results indicate that the policy request information is rejected, generating a target policy based on the multiple comparison results and the policy request information; and updating the associated policy library based on the policy status of the multiple associated policies and the target policy.

Description

Technical Field

[0001] This disclosure relates to the fields of cybersecurity and fintech, and in particular to a strategy processing method, apparatus, device, and storage medium. Background Technology

[0002] Firewall security is achieved through the configuration of security policies; therefore, the correct configuration of firewall security policies plays a crucial role in the firewall's security protection. Related technologies involve enabling and modifying firewall policies based on task requests.

[0003] In realizing the concept disclosed herein, the inventors discovered at least the following problems in the related technology: during the activation and modification of the strategy, the accuracy of the strategy modification is low due to the large amount of data involved in the strategy configuration process. Summary of the Invention

[0004] In view of the above problems, this disclosure provides strategy processing methods, apparatus, devices, media and program products.

[0005] According to a first aspect of this disclosure, a policy processing method is provided, comprising: in response to receiving policy request information, determining an associated policy library corresponding to the policy request information and policy configuration information for each associated policy in the associated policy library; determining the policy status of each associated policy in the associated policy library; comparing the policy request information and the policy configuration information according to a preset comparison rule corresponding to the policy status, and generating a comparison result; if multiple comparison results indicate that the policy request information is rejected, generating a target policy based on the multiple comparison results and the policy request information; and updating the associated policy library based on the policy status of the multiple associated policies and the target policy.

[0006] According to embodiments of this disclosure, the preset comparison rules include a first preset comparison rule and a second preset comparison rule. The process of comparing the policy requirement information and the policy configuration information according to the preset comparison rule corresponding to the policy state to generate a comparison result includes: when the policy state is used to represent an open state, comparing the policy requirement information and the policy configuration information according to the first preset comparison rule to generate a first comparison result, and using the first comparison result as the comparison result; when the policy state is used to represent a reject state, comparing the policy requirement information and the policy configuration information according to the second preset comparison rule to generate a second comparison result, and using the second comparison result as the comparison result.

[0007] According to an embodiment of this disclosure, the process of comparing the strategy requirement information and the strategy configuration information according to the first preset comparison rule to generate a first comparison result includes: sorting multiple associated strategies in the associated strategy library based on the configuration time in the strategy configuration information to generate a strategy sorting list; determining a first target associated strategy from the multiple associated strategies in the associated strategy library according to the sorting result of the strategy sorting list; and comparing the strategy requirement information and the strategy configuration information of the first target associated strategy according to the first preset comparison rule to generate a comparison result corresponding to the first target associated strategy.

[0008] According to an embodiment of this disclosure, the method further includes: deleting the partially approved information in the strategy requirement information when the comparison result corresponding to the first target association strategy indicates that some information in the strategy requirement information is allowed, to obtain the remaining requirement information; determining a second target association strategy from multiple association strategies in the association strategy library according to the sorting result of the strategy sorting list and the sorting position of the first target association strategy; and comparing the remaining requirement information with the strategy configuration information of the second target association strategy to generate a comparison result corresponding to the second target association strategy.

[0009] According to embodiments of this disclosure, the process of comparing the strategy requirement information and the strategy configuration information according to the second preset comparison rule to generate a second comparison result includes: determining a third target associated strategy from multiple associated strategies in the associated strategy library based on the sorting result of the strategy sorting list; comparing the strategy requirement information and the strategy configuration information of the third target associated strategy according to the second preset comparison rule to generate a comparison result corresponding to the third target associated strategy; if the comparison result corresponding to the third target associated strategy indicates that the third target associated strategy has failed, or the third target associated strategy has released the strategy requirement information, determining a fourth target associated strategy from multiple associated strategies in the associated strategy library based on the sorting result of the strategy sorting list and the sorting position of the third target associated strategy; and comparing the strategy requirement information and the strategy configuration information of the fourth target associated strategy to generate a comparison result corresponding to the fourth target associated strategy.

[0010] According to embodiments of this disclosure, when multiple comparison results indicate that the policy requirement information is rejected, generating a target policy based on the multiple comparison results and the policy requirement information includes: when multiple comparison results indicate that the policy requirement information is partially rejected, modifying the associated policy corresponding to the approved portion of the policy requirement information based on the rejected policy requirement information to generate the target policy; and when multiple comparison results indicate that the policy requirement information is completely rejected, generating the target policy based on the policy requirement information.

[0011] According to an embodiment of this disclosure, updating the associated strategy library based on the strategy state of each of the associated strategies and the target strategy includes: determining a target position in the strategy sorting list based on the strategy state of each of the associated strategies; inserting the target strategy into a position before the target position to obtain a new associated strategy library.

[0012] According to embodiments of this disclosure, determining the target position in the strategy sorting list based on the strategy state of each of the aforementioned associated strategies includes: when multiple associated strategies in the associated strategy library have the strategy state of being allowed, the position of the fallback strategy in the strategy sorting list is taken as the target position, wherein the fallback strategy is a preset strategy in the strategy sorting list whose strategy state is rejected; when there is an associated strategy in the associated strategy library whose strategy state is rejected, a target rejection strategy is determined from the associated strategy library according to the sorting result of the strategy sorting list, and the position of the target rejection strategy in the strategy sorting list is taken as the target position, wherein the target rejection strategy is the associated strategy in the strategy sorting list whose configuration time is shortest from the current time and whose strategy state is rejected.

[0013] According to embodiments of this disclosure, determining the associated strategy library corresponding to the aforementioned strategy requirement information includes: matching the aforementioned strategy requirement information with the configuration information of each strategy in the strategy library to generate a matching result; for each strategy in the strategy library, if the matching result indicates that there is information in the configuration information associated with the aforementioned strategy requirement information, adding the aforementioned strategy to the aforementioned initial associated strategy library; and determining the aforementioned initial associated strategy library as the aforementioned associated strategy library when it is determined that all strategies in the aforementioned strategy library have been matched with the aforementioned strategy requirement information.

[0014] A second aspect of this disclosure provides a policy processing apparatus, comprising: an information determination module, configured to, in response to receiving policy requirement information, determine an associated policy library corresponding to the policy requirement information and policy configuration information for each associated policy in the associated policy library; a status determination module, configured to determine the policy status of each associated policy in the associated policy library; an information comparison module, configured to compare the policy requirement information and the policy configuration information according to a preset comparison rule corresponding to the policy status, and generate a comparison result; a policy generation module, configured to, if multiple comparison results indicate that the policy requirement information is rejected, generate a target policy based on multiple comparison results and the policy requirement information; and a policy adjustment module, configured to update the associated policy library based on the policy status of multiple associated policies and the target policy.

[0015] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method described above.

[0016] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0017] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0018] According to the strategy processing method, apparatus, device, medium, and program products provided in this disclosure, strategy requirement information and strategy configuration information are compared according to preset comparison rules corresponding to the strategy status. If multiple comparison results indicate that the strategy requirement information is rejected, the associated strategy library is updated based on the strategy status of multiple associated strategies and the target strategy. Because the update of the associated strategy library incorporates the strategy status of multiple associated strategies, the update of the associated strategy library is more accurate, and the effectiveness of strategy adjustments in the associated strategy library is enhanced, thus improving adjustment efficiency. Attached Figure Description

[0019] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustrations depict application scenarios of strategy processing methods, apparatus, devices, media, and program products according to embodiments of the present disclosure.

[0021] Figure 2A flowchart illustrating a strategy processing method according to an embodiment of this disclosure is shown schematically.

[0022] Figure 3 A flowchart illustrating the comparison of policy requirement information in a policy processing method according to an embodiment of the present disclosure is shown schematically.

[0023] Figure 4 This schematically illustrates a comparison flowchart of a policy processing method according to an embodiment of the present disclosure, where the policy state is in the open state.

[0024] Figure 5 This schematically illustrates a comparison flowchart of a policy processing method according to an embodiment of the present disclosure when the policy state is in a rejection state;

[0025] Figure 6 A schematic block diagram of a strategy processing apparatus according to an embodiment of the present disclosure is shown; and

[0026] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a policy processing method according to an embodiment of the present disclosure. Detailed Implementation

[0027] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0028] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0029] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0030] When using expressions such as "at least one of A, B, and C", the expression should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0031] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0032] Firewall security is achieved through the configuration of security policies. In related technologies, firewall policies are enabled and modified based on task requests. After enabling or modifying, the firewall policy is verified, and manual processing is performed based on the verification results. However, currently, the configuration of access denial policies in the firewall policy configuration is not considered when enabling firewall policies. Therefore, it is possible that a newly generated policy may be inserted after the access denial policy, causing the new policy to fail and disrupting business operations.

[0033] In view of the above, embodiments of this disclosure provide a policy processing method, a policy processing apparatus, an electronic device, a readable storage medium, and a computer program product. The policy processing method includes: in response to receiving policy request information, determining an associated policy library corresponding to the policy request information and policy configuration information for each associated policy in the associated policy library; determining the policy state of each associated policy in the associated policy library; comparing the policy request information and the policy configuration information according to a preset comparison rule corresponding to the policy state, and generating a comparison result; if multiple comparison results indicate that the policy request information is rejected, generating a target policy based on the multiple comparison results and the policy request information; and updating the associated policy library based on the policy states of the multiple associated policies and the target policy.

[0034] Figure 1 The illustrations depict application scenarios of strategy processing methods, apparatus, devices, media, and program products according to embodiments of the present disclosure.

[0035] like Figure 1As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0038] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0039] It should be noted that the policy processing method provided in this embodiment can generally be executed by server 105. Correspondingly, the policy processing device provided in this embodiment can generally be located in server 105. The policy processing method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the policy processing device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0040] It should be understood that Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] The following will be based on Figure 1 The described scene, through Figures 2-5 The strategy processing method of the disclosed embodiments will be described in detail.

[0042] Figure 2 A flowchart illustrating a strategy processing method according to an embodiment of the present disclosure is shown schematically.

[0043] like Figure 2 As shown, the strategy processing method of this embodiment includes operations S210 to S250.

[0044] In operation S210, in response to receiving policy requirement information, the associated policy library corresponding to the policy requirement information and the policy configuration information of each associated policy in the associated policy library are determined.

[0045] In operation S220, determine the policy status of each associated policy in the associated policy library.

[0046] In operation S230, the policy requirement information and policy configuration information are compared according to the preset comparison rules corresponding to the policy status, and the comparison results are generated.

[0047] In operation S240, if multiple comparison results indicate that the policy requirement information is rejected, a target policy is generated based on the multiple comparison results and the policy requirement information.

[0048] In operation S250, the associated policy library is updated based on the policy status and target policy of multiple associated policies.

[0049] According to embodiments of this disclosure, the policy requirement information includes a timestamp, persistent connection, source address, destination address, and protocol port. This policy requirement information is determined based on the business attribute information of the service to be developed or the service under development. The business attribute information includes the transmission address, protocol port, and transmission method involved in the service's processing. By determining the policy requirement information based on the business attribute information, the firewall policy can be configured and adjusted accordingly, ensuring that task requests corresponding to the relevant service can successfully pass through the firewall, thereby enabling the service to operate normally.

[0050] According to embodiments of this disclosure, a corresponding associated policy library is determined based on policy requirement information. The associated policy library includes multiple associated policies. Each associated policy has corresponding policy configuration information. Specifically, the policy configuration information also includes a timestamp, persistent connection, source address, destination address, and protocol port. The policy state of each associated policy is determined, where the policy state includes an allowed state and a denied state. An associated policy with an allowed state represents a policy that allows access in the firewall configuration and can be named a permit policy. An associated policy with a denied state represents a policy that denies access in the firewall configuration and can be named a deny policy.

[0051] According to embodiments of this disclosure, each policy state has a corresponding preset comparison rule. Specifically, the preset comparison rule corresponding to an associated policy in the "allow" state is the first preset comparison rule. The preset comparison rule corresponding to an associated policy in the "deny" state is the second preset comparison rule. The first preset comparison rule includes comparing the timestamp, persistent connection, source address, destination address, and protocol port in the policy requirement information. The second preset comparison rule also includes comparing the timestamp, source address, destination address, and protocol port in the policy requirement information.

[0052] According to embodiments of this disclosure, policy requirement information and policy configuration information are compared to generate comparison results. If multiple comparison results indicate that the policy requirement information is rejected, it means that the task request corresponding to the current policy requirement information cannot pass through the firewall. Based on multiple comparison results and policy requirement information, a target policy is generated so that the task request can pass through the firewall through the target policy. Based on the policy state of the associated policy and the target policy, the target policy is added to an appropriate location in the associated policy library to avoid inserting the target policy after a denial policy, which would render the target policy ineffective.

[0053] According to embodiments of this disclosure, strategy requirement information and strategy configuration information are compared based on preset comparison rules corresponding to strategy states. If multiple comparison results indicate that the strategy requirement information is rejected, the associated strategy library is updated based on the strategy states of multiple associated strategies and the target strategy. Because the update of the associated strategy library incorporates the strategy states of multiple associated strategies, the update is more accurate, the effectiveness of strategy adjustments in the associated strategy library is enhanced, and adjustment efficiency is improved.

[0054] Figure 3 A flowchart illustrating the comparison of policy requirement information in a policy processing method according to an embodiment of the present disclosure is shown.

[0055] According to embodiments of this disclosure, the preset comparison rules include a first preset comparison rule and a second preset comparison rule. The strategy requirement information and strategy configuration information are compared according to the preset comparison rule corresponding to the strategy state to generate a comparison result, which may include the following operations:

[0056] When the policy state is used to represent the open state, the policy requirement information and the policy configuration information are compared according to the first preset comparison rule to generate a first comparison result, which is then used as the comparison result. When the policy state is used to represent the reject state, the policy requirement information and the policy configuration information are compared according to the second preset comparison rule to generate a second comparison result, which is then used as the comparison result.

[0057] According to embodiments of this disclosure, such as Figure 3 As shown, the policy status of the associated policy in the associated policy library is determined. If the policy status is "allowed," then the associated policy is a permit policy. For process 310, the comparison logic corresponding to the permit policy is followed, which means comparing the five-tuple information of the policy requirement information with the policy configuration information based on the first preset comparison rule.

[0058] According to embodiments of this disclosure, if it is determined that the associated policy fully satisfies the policy requirement information, it means that the task request corresponding to the policy requirement information can pass through the firewall, the comparison ends, and no further processing of the associated policy library is required. If it is determined that the associated policy cannot fully satisfy the policy requirement information, it means that the task request corresponding to the policy requirement information cannot pass through the firewall. Further, if the associated policy partially satisfies the policy requirement information, the satisfied policy requirement information is removed, and the comparison continues. If, after all comparisons, it is determined that there is no associated policy in the associated policy library that fully satisfies the policy requirement information, a new policy needs to be added or modified and inserted into the associated policy library so that the corresponding task request can pass through the firewall.

[0059] According to embodiments of this disclosure, such as Figure 3 As shown, if the policy status is "deny," it indicates that the associated policy is a "deny" policy. For process 320, the comparison logic corresponding to the "deny" policy is followed, which involves comparing the four-tuple information of the policy requirement information with the policy configuration information based on the second preset comparison rule. If it is determined that the associated policy is invalid and does not require attention, the comparison continues. If, after all comparisons, it is determined that the associated policy denies the policy requirement information, it means that the task request corresponding to the policy requirement information cannot pass through the firewall. A new policy needs to be added or modified and inserted into the associated policy library so that the corresponding task request can pass through the firewall.

[0060] According to embodiments of this disclosure, policy requirement information is compared based on different policy states. Since multiple factors are considered during the comparison process, the comparison results are more accurate. Furthermore, when adding or modifying policies based on the comparison results, the insertion position is more precise, ensuring that task requests corresponding to the policy requirement information can pass through the firewall normally.

[0061] Figure 4 The illustration shows a flowchart of the comparison process when the policy state is in the open state in the policy processing method according to an embodiment of the present disclosure.

[0062] According to embodiments of this disclosure, comparing strategy requirement information and strategy configuration information according to a first preset comparison rule to generate a first comparison result may include the following operations:

[0063] Based on the configuration time in the policy configuration information, multiple related policies in the related policy library are sorted to generate a policy sorting list; according to the sorting result of the policy sorting list, a first target related policy is determined from multiple related policies in the related policy library; according to the first preset comparison rule, the policy requirement information and the policy configuration information of the first target related policy are compared to generate a comparison result corresponding to the first target related policy.

[0064] According to embodiments of this disclosure, each associated policy generates a configuration time when it is configured. Based on the configuration time in the policy configuration information, multiple associated policies in the associated policy library are sorted. Specifically, they can be sorted according to the time elapsed between their configuration time and the current time, placing the shorter ones first, so that policy requirement information can preferentially match the most recently configured policy, effectively improving matching efficiency.

[0065] According to embodiments of this disclosure, a first target association policy is determined from multiple association policies in the association policy library based on the sorting result of the policy sorting list. The first target association policy is an association policy whose policy status is "allowed". For example... Figure 4 As shown, the policy requirement information and the configuration information of the first target associated policy are compared according to the first preset comparison rules. Specifically, this includes comparison of timestamps, comparison of long connections, and comparison of source address / destination address / protocol port.

[0066] According to embodiments of this disclosure, such as Figure 4As shown, for process 410, during the timestamp comparison, if neither the strategy requirement information nor the strategy configuration information contains a time range, then the timestamp in the strategy configuration information is determined to meet the requirement. If the strategy requirement information contains a time range but the strategy configuration information does not, it means the time range in the strategy configuration information is greater than the time range in the strategy requirement information, and the timestamp in the strategy configuration information is determined to meet the requirement. If the strategy requirement information does not contain a time range but the strategy configuration information does, it means the time range in the strategy configuration information is less than the time range in the strategy requirement information, and the timestamp in the strategy configuration information does not meet the requirement.

[0067] According to embodiments of this disclosure, if both the policy requirement information and the policy configuration information contain time ranges, the configuration start time in the policy configuration information is compared with the requirement start time in the policy requirement information, and the configuration end time in the policy configuration information is compared with the requirement end time in the policy requirement information. If, after the comparison, it is determined that the time range in the policy configuration information is greater than the time range in the policy requirement information, the timestamp in the policy configuration information is determined to meet the requirement. In other cases, the timestamp in the policy configuration information is determined not to meet the requirement.

[0068] According to embodiments of this disclosure, such as Figure 4 As shown, for process 420, during the comparison of long connections, if both the policy requirement information and the policy configuration information contain long connection times, then their long connection times are compared. If either the policy requirement information or the policy configuration information contains a long connection time, the side without a defined long connection is assigned a default value of 1800, and then their long connection times are compared. If the long connection time in the policy configuration information is greater than or equal to the long connection time in the policy requirement information, then the long connection in the policy configuration information meets the requirement. If the long connection time in the policy configuration information is less than the long connection time in the policy requirement information, then the long connection in the policy configuration information does not meet the requirement. If neither the policy requirement information nor the policy configuration information contains a long connection time, then there is no requirement for long connection time, and the long connection in the policy configuration information meets the requirement.

[0069] According to embodiments of this disclosure, such as Figure 4As shown, for process 430, the comparison method is the same when comparing the source address, destination address, and protocol port, but each of the three needs to be compared separately. Taking the source address as an example, specifically, if neither the policy requirement information nor the policy configuration information defines a source address, then the source address in the policy configuration information is determined to meet the requirement. If the policy requirement information defines a source address but the policy configuration information does not, then the range of source addresses in the policy configuration information is large, and the source address in the policy configuration information is determined to meet the requirement. If the policy requirement information does not define a source address but the policy configuration information defines a source address, then the range of source address requirements in the policy requirement information is large, and the source address in the policy configuration information does not meet the requirement.

[0070] According to embodiments of this disclosure, if both the policy requirement information and the policy configuration information define source and destination addresses, and the address range in the policy configuration information is greater than the address range in the policy requirement information, then the source and destination addresses in the policy configuration information are determined to meet the requirements. If all five-tuple information is satisfied, it indicates that there exists an associated policy in the associated policy library that satisfies the policy requirement information, and the task request corresponding to the policy requirement information can pass through the firewall.

[0071] According to embodiments of this disclosure, the strategy processing method may further include the following operations:

[0072] If some information in the strategy requirement information corresponding to the first target association strategy is allowed, the allowed information is deleted to obtain the remaining requirement information. Based on the sorting result of the strategy sorting list and the sorting position of the first target association strategy, the second target association strategy is determined from multiple association strategies in the association strategy library. The remaining requirement information is compared with the strategy configuration information of the second target association strategy to generate a comparison result corresponding to the second target association strategy.

[0073] According to embodiments of this disclosure, such as Figure 4 As shown, if the comparison result corresponding to the first target associated strategy indicates that some information in the strategy requirement information is allowed, for example, for process 430, if the source address, destination address, and protocol port in the strategy configuration information only contain a part of the strategy requirement information, then the allowed part of the strategy requirement information is deleted to obtain the remaining requirement information. That is, the source address, destination address, and protocol port that are satisfied are deleted, and the remaining requirement information is used for further comparison.

[0074] According to embodiments of this disclosure, a second target association policy is determined from multiple association policies in the association policy library based on the sorting result of the policy sorting list and the sorting position of the first target association policy. The second target association policy is the next uncompared association policy after the first target association policy, and its policy status is "allowed". The remaining requirement information is compared with the policy configuration information of the second target association policy. If the source address, destination address, and protocol port in the remaining requirement information can be fully satisfied by the policy configuration information, it indicates that the policy requirement information can be satisfied by multiple association policies. If, after all comparisons, no other association policy configuration information satisfies the remaining requirement information, it is determined that the policy configuration information does not meet the requirement. If there is unsatisfied information in the five-tuple information, it indicates that there is no association policy in the association policy library that fully satisfies the policy requirement information, and the task request corresponding to the policy requirement information cannot pass through the firewall.

[0075] Figure 5 The diagram illustrates a comparison flowchart of a policy processing method according to an embodiment of the present disclosure, where the policy state is a rejection state.

[0076] According to embodiments of this disclosure, comparing the strategy requirement information and the strategy configuration information according to a second preset comparison rule to generate a second comparison result may include the following operations:

[0077] Based on the sorting results of the strategy sorting list, a third target associated strategy is determined from multiple associated strategies in the associated strategy library; the strategy requirement information and the strategy configuration information of the third target associated strategy are compared according to the second preset comparison rules to generate a comparison result corresponding to the third target associated strategy; if the comparison result corresponding to the third target associated strategy indicates that the third target associated strategy has failed, or if the third target associated strategy releases the strategy requirement information, a fourth target associated strategy is determined from multiple associated strategies in the associated strategy library based on the sorting results of the strategy sorting list and the sorting position of the third target associated strategy; the strategy requirement information and the strategy configuration information of the fourth target associated strategy are compared to generate a comparison result corresponding to the fourth target associated strategy.

[0078] According to embodiments of this disclosure, a third target association policy is determined from multiple association policies in the association policy library based on the sorting result of the policy sorting list. The third target association policy is an association policy whose policy status is "reject". Figure 5 As shown, the policy requirement information and the configuration information of the third target associated policy are compared according to the second preset comparison rules. Specifically, this includes the comparison of timestamps and the comparison of source address / destination address / protocol port.

[0079] According to embodiments of this disclosure, such as Figure 5As shown, for process 510, the comparison method is the same when comparing the source address, destination address, and protocol port, but each of the three needs to be compared separately. Taking the source address as an example, specifically, if neither the policy requirement information nor the policy configuration information defines a source address, then the source address in the policy requirement information will be rejected. If the policy requirement information does not define a source address, but the policy configuration information defines a source address, it means that the current associated policy will reject a small portion of the information in the policy requirement information. This situation is allowed during the execution of the task request; therefore, in this case, there is no need to pay attention to the associated policy, and the comparison can continue.

[0080] According to embodiments of this disclosure, if a source address is defined in the policy requirement information but not in the policy configuration information, it indicates that the source address range in the policy configuration information is large, and the source address in the policy requirement information will be rejected. If both the policy requirement information and the policy configuration information define source and destination addresses, and the address range in the policy configuration information is greater than or equal to the address range in the policy requirement information, the policy requirement information will be rejected. If the address range in the policy configuration information includes a portion of the address range in the policy requirement information, the policy requirement information will be partially rejected. If the address range in the policy configuration information is smaller than the address range in the policy requirement information, the policy requirement information will not be rejected, and in this case, there is no need to focus on the associated policy; the comparison can continue.

[0081] According to embodiments of this disclosure, such as Figure 5 As shown, for process 520, during the timestamp comparison, if both the policy requirement information and the policy configuration information contain time ranges, and the timestamp in the policy configuration information has expired, there's no need to focus on the associated policy; the comparison can continue. The configuration start time in the policy configuration information is compared with the requirement start time in the policy requirement information, and the configuration end time in the policy configuration information is compared with the requirement end time in the policy requirement information. If, after the comparison, the requirement start time in the policy requirement information is greater than or equal to the configuration end time, it indicates that the timestamp in the policy configuration information has expired, and there's no need to focus on the associated policy; the comparison can continue. If it's determined that the policy requirement information has no time range, but the policy configuration information does, it indicates that the timestamp in the policy configuration information has expired, and there's no need to focus on the associated policy; the comparison can continue. In other cases, the time range determines whether the policy requirement information will be rejected.

[0082] According to embodiments of this disclosure, when the comparison result corresponding to the third target association strategy indicates that the third target association strategy has failed, or when the third target association strategy allows the policy requirement information, a fourth target association strategy is determined from multiple association strategies in the association strategy library based on the ranking result of the policy ranking list and the ranking position of the third target association strategy. The fourth target association strategy is the next association strategy after the third target association strategy that has not been compared and whose policy status is rejected. The policy requirement information is compared with the policy configuration information of the fourth target association strategy to generate a comparison result corresponding to the fourth target association strategy.

[0083] According to embodiments of this disclosure, when multiple comparison results indicate that the strategy requirement information is rejected, generating a target strategy based on the multiple comparison results and the strategy requirement information may include the following operations:

[0084] When multiple comparison results indicate that the strategy requirement information is partially rejected, the associated strategy corresponding to the released strategy requirement information is modified based on the rejected strategy requirement information to generate the target strategy; when multiple comparison results indicate that the strategy requirement information is completely rejected, the target strategy is generated based on the strategy requirement information.

[0085] According to embodiments of this disclosure, for an associated policy in an open state, if multiple comparison results indicate that the policy requirement information is partially open, the associated policy corresponding to the open portion of the policy requirement information is modified based on the rejected policy requirement information to generate a target policy. If multiple comparison results indicate that the policy requirement information is not open, a target policy is generated based on the policy requirement information, allowing the task request corresponding to the policy requirement information to pass through the firewall based on the target policy.

[0086] According to embodiments of this disclosure, for an associated policy whose policy status is "deny," if multiple comparison results indicate that the policy requirement information is partially rejected, the associated policy corresponding to the partially allowed policy requirement information is modified based on the rejected policy requirement information to generate a target policy. If multiple comparison results indicate that the policy requirement information is completely rejected, a target policy is generated based on the policy requirement information, allowing the task request corresponding to the policy requirement information to pass through the firewall based on the target policy.

[0087] According to embodiments of this disclosure, updating the associated policy library based on the policy state and target policy of each associated policy may include the following operations:

[0088] Based on the policy state of each associated policy, the target position is determined in the policy sorting list; the target policy is inserted before the target position to obtain a new associated policy library.

[0089] According to embodiments of this disclosure, a target position is determined in the policy sorting list based on the policy state of each associated policy. The target position is the location where a task request corresponding to the policy requirement information can pass through the firewall based on the target policy, without inserting the target policy after a denial policy, thus preventing the target policy from taking effect. The target policy is then inserted before the target position to obtain a new associated policy library.

[0090] According to embodiments of this disclosure, determining the target position in the policy sorting list based on the policy state of each associated policy may include the following operations:

[0091] When multiple associated policies in the associated policy library are all in the "allow" state, the position of the fallback policy in the policy sorting list is taken as the target position. The fallback policy is a preset policy in the policy sorting list whose policy state is "reject". When there are associated policies in the associated policy library whose policy state is "reject", the target rejection policy is determined from the associated policy library according to the sorting result of the policy sorting list, and the position of the target rejection policy in the policy sorting list is taken as the target position. The target rejection policy is the associated policy in the policy sorting list whose configuration time is shortest from the current time and whose policy state is "reject".

[0092] According to embodiments of this disclosure, the associated policy library contains preset policies with a policy status of "deny," also known as fallback policies, to provide protection for the firewall. When multiple associated policies in the associated policy library are all in an "allow" state, the position of the fallback policy in the policy sorting list is used as the target position. The target policy is inserted before the fallback policy to ensure that the target policy is not denied, allowing task requests corresponding to the policy requirement information to pass through the firewall based on the target policy.

[0093] According to embodiments of this disclosure, when an associated policy with a denial status exists in the associated policy library, a target denial policy is determined from the associated policy library based on the sorting result of the policy sorting list. The target denial policy is the associated policy in the policy sorting list whose configuration time is closest to the current time and whose policy status is denial. The position of the target denial policy in the policy sorting list is used as the target position, ensuring that the target policy is not denied and allowing task requests corresponding to the policy requirement information to pass through the firewall based on the target policy.

[0094] According to embodiments of this disclosure, determining the associated policy library corresponding to the policy requirement information may include the following operations:

[0095] The strategy requirement information is matched with the configuration information of each strategy in the strategy library to generate a matching result. For each strategy in the strategy library, if the matching result indicates that there is information in the configuration information that is related to the strategy requirement information, the strategy is added to the initial associated strategy library. If it is determined that all strategies in the strategy library have been matched with the strategy requirement information, the initial associated strategy library is determined as the associated strategy library.

[0096] According to embodiments of this disclosure, policy requirement information is matched with the configuration information of each policy in the policy library. The configuration information includes a timestamp, persistent connection, source address, destination address, and protocol port. If the configuration information and policy requirement information overlap, the policy corresponding to that configuration information is determined to be an associated policy and added to the initial associated policy library. For example, if the source and destination addresses in the policy requirement information constitute a first range, and the source and destination addresses of any policy in the policy library constitute a second range, and the first and second ranges overlap, a matching result is generated, indicating that the policy is an associated policy, and it is added to the initial associated policy library. After matching all policies in the policy library with the policy requirement information, the associated policy library corresponding to the policy requirement information is determined. By adding overlapping policies to the associated policy library, the omission of associated policies during the comparison of policy requirement information is effectively reduced, thus preventing inaccurate comparison results.

[0097] Based on the above-described strategy processing method, this disclosure also provides a strategy processing apparatus. The following will be combined with... Figure 6 The device is described in detail.

[0098] Figure 6 A schematic block diagram of a strategy processing apparatus according to an embodiment of the present disclosure is shown.

[0099] like Figure 6 As shown, the strategy processing device 600 of this embodiment includes an information determination module 610, a state determination module 620, an information comparison module 630, a strategy generation module 640, and a strategy adjustment module 650.

[0100] The information determination module 610 is used to determine, in response to receiving policy requirement information, the associated policy library corresponding to the policy requirement information, and the policy configuration information of each associated policy in the associated policy library. In one embodiment, the information determination module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0101] The state determination module 620 is used to determine the policy state of each associated policy in the associated policy library. In one embodiment, the state determination module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0102] The information comparison module 630 is used to compare the policy requirement information and the policy configuration information according to the preset comparison rules corresponding to the policy state, and generate a comparison result. In one embodiment, the information comparison module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0103] The strategy generation module 640 is used to generate a target strategy based on multiple comparison results and the strategy requirement information when multiple comparison results indicate that the strategy requirement information is rejected. In one embodiment, the strategy generation module 640 can be used to perform the operation S240 described above, which will not be repeated here.

[0104] The strategy adjustment module 650 is used to update the associated strategy library based on the strategy status and target strategy of multiple associated strategies. In one embodiment, the strategy adjustment module 650 can be used to perform the operation S250 described above, which will not be repeated here.

[0105] According to embodiments of this disclosure, strategy requirement information and strategy configuration information are compared based on preset comparison rules corresponding to strategy states. If multiple comparison results indicate that the strategy requirement information is rejected, the associated strategy library is updated based on the strategy states of multiple associated strategies and the target strategy. Because the update of the associated strategy library incorporates the strategy states of multiple associated strategies, the update is more accurate, the effectiveness of strategy adjustments in the associated strategy library is enhanced, and adjustment efficiency is improved.

[0106] According to embodiments of this disclosure, the information comparison module 630 includes a first comparison submodule and a second comparison submodule.

[0107] The first comparison submodule is used to compare the policy requirement information and the policy configuration information according to the first preset comparison rules when the policy state is used to represent the open state, generate the first comparison result, and use the first comparison result as the comparison result.

[0108] The second comparison submodule is used to compare the policy requirement information and the policy configuration information according to the second preset comparison rules when the policy state is used to represent the rejection state, generate a second comparison result, and use the second comparison result as the comparison result.

[0109] According to embodiments of this disclosure, the first comparison submodule includes a list generation unit, a first target determination unit, and a first result determination unit.

[0110] The list generation unit is used to sort multiple associated policies in the associated policy library based on the configuration time in the policy configuration information, and generate a policy sorting list.

[0111] The first target determination unit is used to determine the first target association strategy from multiple association strategies in the association strategy library based on the sorting result of the strategy sorting list.

[0112] The first result determination unit is used to compare the strategy requirement information and the strategy configuration information of the first target associated strategy according to the first preset comparison rules, and generate a comparison result corresponding to the first target associated strategy.

[0113] According to embodiments of this disclosure, the strategy processing device 600 further includes an information deletion module, a second target determination module, and a second result determination module.

[0114] The information deletion module is used to delete the partially released information in the strategy requirement information when some information in the comparison result characterization strategy requirement information corresponding to the first target association strategy is released, so as to obtain the remaining requirement information.

[0115] The second target determination module is used to determine the second target association strategy from multiple association strategies in the association strategy library based on the sorting result of the strategy sorting list and the sorting position of the first target association strategy.

[0116] The second result determination module is used to compare the remaining demand information with the strategy configuration information of the second target association strategy, and generate a comparison result corresponding to the second target association strategy.

[0117] According to embodiments of this disclosure, the second comparison submodule includes a third target determination unit, a third result determination unit, a fourth target determination unit, and a fourth result determination unit.

[0118] The third target determination unit is used to determine the third target association strategy from multiple association strategies in the association strategy library based on the sorting result of the strategy sorting list.

[0119] The third result determination unit is used to compare the strategy requirement information and the strategy configuration information of the third target associated strategy according to the second preset comparison rules, and generate a comparison result corresponding to the third target associated strategy.

[0120] The fourth target determination unit is used to determine the fourth target association strategy from multiple association strategies in the association strategy library based on the ranking results of the strategy ranking list and the ranking position of the third target association strategy when the comparison result corresponding to the third target association strategy indicates that the third target association strategy has failed or the third target association strategy releases the strategy requirement information.

[0121] The fourth result determination unit is used to compare the strategy requirement information with the strategy configuration information of the strategy associated with the fourth objective, and generate a comparison result corresponding to the strategy associated with the fourth objective.

[0122] According to embodiments of this disclosure, the policy generation module 640 includes a policy modification submodule and a policy generation submodule.

[0123] The strategy modification submodule is used to modify the associated strategy corresponding to the released strategy requirement information based on the rejected strategy requirement information when multiple comparison results indicate that the strategy requirement information is partially rejected, and to generate the target strategy.

[0124] The strategy generation submodule is used to generate a target strategy based on the strategy requirement information when multiple comparison results indicate that the strategy requirement information is completely rejected.

[0125] According to embodiments of this disclosure, the strategy adjustment module 650 includes a location determination submodule and a strategy insertion submodule.

[0126] The location determination submodule is used to determine the target location from the policy sorting list based on the policy state of each associated policy.

[0127] The strategy insertion submodule is used to insert the target strategy into the position before the target position to obtain a new associated strategy library.

[0128] According to embodiments of this disclosure, the position determination submodule includes a first position determination unit and a second position determination unit.

[0129] The first position determination unit is used to determine the position of the fallback strategy in the strategy sorting list as the target position when the strategy status of multiple associated strategies in the associated strategy library is all in the open state. The fallback strategy is a preset strategy in the strategy sorting list whose strategy status is in the reject state.

[0130] The second position determination unit is used to determine the target rejection policy from the associated policy library according to the sorting result of the policy sorting list when there is an associated policy with a policy status of rejection in the associated policy library, and to take the position of the target rejection policy in the policy sorting list as the target position. The target rejection policy is the associated policy in the policy sorting list that has the shortest configuration time from the current time and has a policy status of rejection.

[0131] According to embodiments of this disclosure, the information determination module 610 includes an information matching submodule, a policy adding submodule, and a policy library determination submodule.

[0132] The information matching submodule is used to match the policy requirement information with the configuration information of each policy in the policy library and generate matching results.

[0133] The strategy addition submodule is used to add each strategy in the strategy library to the initial associated strategy library if there is information related to the strategy requirement information in the matching result representation configuration information.

[0134] The strategy library determination submodule is used to determine the initial associated strategy library as the associated strategy library when all strategies in the strategy library are matched with the strategy requirement information.

[0135] According to embodiments of this disclosure, any multiple modules among the information determination module 610, state determination module 620, information comparison module 630, strategy generation module 640, and strategy adjustment module 650 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the information determination module 610, state determination module 620, information comparison module 630, strategy generation module 640, and strategy adjustment module 650 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the information determination module 610, the state determination module 620, the information comparison module 630, the strategy generation module 640, and the strategy adjustment module 650 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0136] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a policy processing method according to an embodiment of the present disclosure.

[0137] like Figure 7As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0138] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0139] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the input / output (I / O) interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0140] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0141] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0142] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the strategy processing methods provided in the embodiments of this disclosure.

[0143] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0144] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0145] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0146] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0147] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0148] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0149] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A strategy processing method, comprising: In response to receiving policy requirement information, determine the associated policy library corresponding to the policy requirement information, and the policy configuration information of each associated policy in the associated policy library; Determine the policy status of each associated policy in the associated policy library; Based on the configuration time in the policy configuration information, multiple associated policies in the associated policy library are sorted to generate a policy sorting list. The policy sorting list is based on the time elapsed between the configuration time and the current time, with shorter policies listed first. The policy requirement information and the policy configuration information are compared according to the sorting result of the policy sorting list and a preset comparison rule corresponding to the policy status to generate a comparison result. If multiple comparison results indicate that the strategy requirement information is rejected, a target strategy is generated based on the multiple comparison results and the strategy requirement information. The associated policy library is updated based on the policy states of multiple associated policies and the target policy. The step of determining the target position in the policy sorting list based on the policy state of each associated policy includes: Based on the policy state of each associated policy, a target position is determined in the policy sorting list; the target policy is then inserted into the position preceding the target position to obtain a new associated policy library; wherein... When multiple associated strategies in the associated strategy library are in the open state, the position of the fallback strategy in the strategy sorting list is taken as the target position, wherein the fallback strategy is a preset strategy in the strategy sorting list whose strategy state is in the reject state. If an associated policy with the policy status of "rejection" exists in the associated policy library, a target rejection policy is determined from the associated policy library according to the sorting result of the policy sorting list, and the position of the target rejection policy in the policy sorting list is taken as the target position. The target rejection policy is the associated policy in the policy sorting list that has the shortest configuration time from the current time and has the policy status of "rejection".

2. The method according to claim 1, wherein, The preset comparison rules include a first preset comparison rule and a second preset comparison rule. The step of comparing the strategy requirement information and the strategy configuration information according to the preset comparison rule corresponding to the strategy state, and generating a comparison result, includes: When the policy state is used to characterize the open state, the policy requirement information and the policy configuration information are compared according to the first preset comparison rule to generate a first comparison result, and the first comparison result is used as the comparison result. When the policy state is used to represent the rejection state, the policy requirement information and the policy configuration information are compared according to the second preset comparison rule to generate a second comparison result, and the second comparison result is used as the comparison result.

3. The method according to claim 2, wherein, The step of comparing the strategy requirement information and the strategy configuration information according to the first preset comparison rule to generate a first comparison result includes: Based on the sorting result of the strategy sorting list, a first target association strategy is determined from multiple association strategies in the association strategy library; The strategy requirement information and the strategy configuration information of the first target associated strategy are compared according to the first preset comparison rule to generate a comparison result corresponding to the first target associated strategy.

4. The method according to claim 3, further comprising: If the comparison result corresponding to the first target-associated strategy indicates that some information in the strategy requirement information is allowed, the allowed information in the strategy requirement information is deleted to obtain the remaining requirement information. Based on the sorting result of the strategy sorting list and the sorting position of the first target associated strategy, a second target associated strategy is determined from multiple associated strategies in the associated strategy library; The remaining demand information is compared with the strategy configuration information of the second target association strategy to generate a comparison result corresponding to the second target association strategy.

5. The method according to claim 3, wherein, The step of comparing the strategy requirement information and the strategy configuration information according to the second preset comparison rule to generate a second comparison result includes: Based on the sorting result of the strategy sorting list, a third target association strategy is determined from multiple association strategies in the association strategy library; The strategy requirement information and the strategy configuration information of the third target associated strategy are compared according to the second preset comparison rule to generate a comparison result corresponding to the third target associated strategy. If the comparison result corresponding to the third target association strategy indicates that the third target association strategy has failed, or if the third target association strategy releases the strategy requirement information, a fourth target association strategy is determined from multiple association strategies in the association strategy library according to the sorting result of the strategy sorting list and the sorting position of the third target association strategy. The strategy requirement information is compared with the strategy configuration information of the fourth target associated strategy to generate a comparison result corresponding to the fourth target associated strategy.

6. The method according to claim 3, wherein, When multiple comparison results indicate that the policy requirement information is rejected, a target policy is generated based on the multiple comparison results and the policy requirement information, including: If multiple comparison results indicate that the policy requirement information is partially rejected, the associated policy corresponding to the approved portion of the policy requirement information is modified based on the rejected policy requirement information to generate the target policy. If multiple comparison results indicate that the strategy requirement information is completely rejected, the target strategy is generated based on the strategy requirement information.

7. The method according to claim 1, wherein, The step of determining the associated strategy library corresponding to the strategy requirement information includes: The strategy requirement information is matched with the configuration information of each strategy in the strategy library to generate a matching result; For each strategy in the strategy library, if the matching result indicates that there is information in the configuration information that is associated with the strategy requirement information, the strategy is added to the initial associated strategy library; If it is determined that all strategies in the strategy library match the strategy requirement information, the initial associated strategy library is determined as the associated strategy library.

8. A strategy processing apparatus, comprising: The information determination module is used to determine, in response to receiving policy requirement information, the associated policy library corresponding to the policy requirement information and the policy configuration information of each associated policy in the associated policy library; The status determination module is used to determine the policy status of each associated policy in the associated policy library; The list generation unit is used to sort multiple associated policies in the associated policy library based on the configuration time in the policy configuration information, and generate a policy sorting list, wherein the sorting is based on the length of time between the configuration time and the current time, so that the shorter time is placed first. The information comparison module is used to compare the strategy requirement information and the strategy configuration information according to the sorting result of the strategy sorting list and the preset comparison rules corresponding to the strategy status, and generate a comparison result. The strategy generation module is used to generate a target strategy based on the multiple comparison results and the strategy requirement information when multiple comparison results indicate that the strategy requirement information is rejected. The strategy adjustment module is used to update the associated strategy library based on the strategy status of multiple associated strategies and the target strategy; The location determination submodule is used to determine the target location in the policy sorting list based on the policy state of each of the associated policies; The strategy insertion submodule is used to insert the target strategy into the position before the target position to obtain a new associated strategy library; The first position determination unit is used to determine the target position by taking the position of the fallback strategy in the strategy sorting list when the strategy status of multiple associated strategies in the associated strategy library is all open, wherein the fallback strategy is a preset strategy in the strategy sorting list whose strategy status is rejected. The second position determination unit is used to determine a target rejection policy from the associated policy library according to the sorting result of the policy sorting list when there is an associated policy in the associated policy library with the policy status being the rejection status, and to take the position of the target rejection policy in the policy sorting list as the target position, wherein the target rejection policy is the associated policy in the policy sorting list with the shortest configuration time from the current time and the policy status being the rejection status.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images