A method, device and processing equipment for detecting redundant relationship of firewall policies

Abstract

The present application provides a method, apparatus and processing device for detecting redundant relations of firewall policies, which are used to provide a convenient and high-precision detection scheme for redundant firewall policy detection based on the introduced twelve-tuple, thereby helping to better meet the actual needs of high-precision detection of firewall redundant policies.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, device and processing equipment for detecting redundant relations of firewall policies. Background Art

[0002] As the scale of enterprise networks grows, their network security requirements are also relatively high. There are many security devices and switching devices in the network, and the scale of the equipment is huge, ranging from hundreds to thousands or even tens of thousands of devices.

[0003] In this context, firewall policies in the network accumulate over time and gradually affect operational efficiency, so the management and maintenance costs increase year by year. In particular, if ineffective policies and loose policies are not intervened, they will become more and more numerous, increasing network security risks and expanding the exposure of business assets.

[0004] However, the inventors of the present application have discovered that the redundant strategy detection scheme in the prior art still has the problem of insufficient accuracy to a certain extent, and it is difficult to meet the actual demand for high-precision detection of redundant strategies. Summary of the invention

[0005] The present application provides a method, apparatus and processing device for detecting redundant relations of firewall policies, which are used to provide a convenient and high-precision detection scheme for redundant firewall policy detection based on the introduced twelve-tuple, thereby helping to better meet the actual needs of high-precision detection of firewall redundant policies.

[0006] In a first aspect, the present application provides a method for detecting a redundant relationship of firewall policies, the method comprising:

[0007] When each firewall policy is defined as a twelve-tuple map, the target policy is obtained by skipping expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to the action. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection.

[0008] When multiple source domains, destination domains, persistent connections, and security protections included in the policy are combined into a unique key and the policy's octet is used as the value, the key of the current policy in the target policy is matched with the twelve-tuple map;

[0009] If the key of the current policy in the target policy matches the twelve-tuple map, the matched target key and the value corresponding to the target key are defined as the containKeylist set, and the waitFull set is defined to store the eight-tuple data flow information to be covered;

[0010] Based on the octet of the current strategy, the containKeyList set is processed by taking the intersection and the remainder set. During the processing, the remainder set is continuously taken to determine whether it is redundant, and the redundant strategy is obtained;

[0011] When the numbers of the firewall policies are pre-sorted in ascending order according to the row numbers, all policies after the number of the redundant policy are traced back, and the policy with an intersection among all the policies is determined as the effective policy;

[0012] With the current policy as a reference, a twelve-tuple subtraction process is performed on the allowed twelve-tuple set and the denied twelve-tuple set.

[0013] In a second aspect, the present application provides a device for detecting a redundant relationship of firewall policies, the device comprising:

[0014] The skip unit is used to skip expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags when each firewall policy is defined as a twelve-tuple map, and obtain the target policy. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to the action. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection;

[0015] A matching unit, for matching the key of the current policy in the target policy with the twelve-tuple map, when combining multiple source domains, destination domains, long connections, and security protections contained in the policy into a unique key and taking the eight-tuple of the policy as a value;

[0016] A definition unit, used for defining the matched target key and the value corresponding to the target key as a containKeylist set if the key of the current policy in the target policy matches the twelve-tuple map, defining a waitFull set, and storing the eight-tuple data flow information to be covered;

[0017] The redundancy detection unit is used to perform intersection and remainder processing on the containKeyList set based on the octet of the current strategy, and continuously take the remainder to determine whether it is redundant during the processing, so as to obtain the redundancy strategy;

[0018] A determination unit, used for, when the numbers of the firewall policies are pre-sorted in ascending order according to the row numbers, backtracking all the policies after the number of the redundant policy, and determining the policy with an intersection among all the policies as the effective policy;

[0019] The subtraction unit is used to perform twelve-tuple subtraction processing on the allowed twelve-tuple set and the rejected twelve-tuple set with reference to the current policy.

[0020] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0022] From the above content, it can be concluded that the present application has the following beneficial effects:

[0023] For redundant detection of firewall policies, this application introduces twelve-tuples, and takes twelve-tuples as the basis, supplemented by intersection, remainder set processing, and twelve-tuple subtraction processing (subtraction of different actions in the same domain), to achieve the goal of quickly identifying redundant policies, thereby providing a convenient and high-precision detection solution for redundant firewall policy detection, which helps to better meet the actual needs of high-precision detection of firewall redundant policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a method for detecting redundant relationship of firewall policies in this application;

[0025] Figure 2 A schematic diagram of a scenario for applying for a data flow set trafficList;

[0026] Figure 3 A schematic diagram of a scenario for the ascending characteristics of this application strategy;

[0027] Figure 4 A structural schematic diagram of a device for detecting redundant relationship of firewall policies in this application;

[0028] Figure 5 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0029] Before introducing the method for detecting redundant relations of firewall policies provided in the present application, the background content involved in the present application is first introduced.

[0030] The firewall policy redundancy relationship detection method, device and computer-readable storage medium provided in the present application can be applied to processing equipment to provide a convenient and high-precision detection solution for redundant firewall policy detection based on the introduced twelve-tuple, thereby helping to better meet the actual needs of high-precision detection of firewall redundant policies.

[0031] The method for detecting redundant relationship of firewall policies mentioned in the present application can be executed by a detection device for redundant relationship of firewall policies, or a server, a physical host or a user equipment (UE) or other processing devices of different types that integrate the detection device for redundant relationship of firewall policies. The detection device for redundant relationship of firewall policies can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0032] It should be understood that for the processing device that executes the method for detecting redundant relationships of firewall policies in the present application, in actual applications, it can flexibly configure the specific device form while considering connecting to the firewall in the network and extracting its firewall policy. It can be a device node in the network architecture, directly providing redundant policy identification services for the firewall in the network architecture, or it can be a device node outside the network architecture, providing redundant policy identification services for the firewall in the network architecture from the outside. The specific device form is not specifically limited in the present application.

[0033] Next, the method for detecting redundant relations of firewall policies provided by the present application is introduced.

[0034] Here, we will first briefly explain some of the terms involved below:

[0035] Seven-tuple: source domain, destination domain, source address, destination address, protocol, source port, destination port, a combination of seven elements.

[0036] Twelve-tuple: source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection.

[0037] Map: A collection of key-value pairs (key=value). Each key corresponds to a corresponding value, and the corresponding value can be obtained through the key.

[0038] trafficList: The policy is formatted and converted into a set of uniform number + string range formats.

[0039] Intersection: Take the common part of two sets.

[0040] Union: Take all the elements of two sets.

[0041] Residue: The remainder of one set minus another.

[0042] Array: A queue consisting of multiple elements of the same type, usually represented by [].

[0043] Invalid policy: The policy is ineffective in the firewall configuration and is hidden or redundant by other policies.

[0044] Effective policy: The policy that works on the firewall and that the data flow will hit.

[0045] Displacement, weighting: mathematical terms.

[0046] Domain matching: refers to the source domain and destination domain of one policy completely containing or being equal to the source domain and destination domain of another policy.

[0047] Domain: If the source domain and destination domain are not specified during the description, it means that they are judged or used simultaneously.

[0048] Long connection matching: refers to the long connection configurations of 2 or N policies being exactly the same.

[0049] Security protection matching: refers to the security protection configurations of two or N policies being exactly the same.

[0050] Reverse action: If the current policy action is to allow, then the reverse action refers to a deny policy. Combined with the context, if the operation is an allow twelve-tuple set, then the reverse action refers to a deny twelve-tuple set; if the operation is a deny twelve-tuple set, similarly, the reverse action refers to the allow set.

[0051] Mixed IP: Both IPv4 and IPv6 addresses are configured in the source IP or destination IP of the policy.

[0052] Next, see Figure 1 , Figure 1 A flowchart of a method for detecting redundant relationship of firewall policies of the present application is shown. The method for detecting redundant relationship of firewall policies provided by the present application may specifically include the following steps S101 to S106:

[0053] Step S101, when each firewall policy is defined as a twelve-tuple map, skip expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags to obtain a target policy. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to actions. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection.

[0054] It can be seen that this application involves the definition and setting of a firewall, in which the application of twelve-tuples is specifically introduced to lay a good foundation for subsequent data processing.

[0055] In specific operations, for firewall policies that need to identify redundant policies, or firewall policies to be checked, you can also format them, as follows:

[0056] 1. Filter NAT policies based on policy type, that is, NAT policies are not included in the inspection;

[0057] 2. In actual application scenarios, a policy configuration source IP can reference multiple objects or object groups, where IP object groups can be identified according to formats such as single IP, IP+mask, IP range, IP+wildcard, domain name, etc. Different IP address object groups can be referenced, and different IP address object groups may have duplication, overlap, etc.; other tuples of the policy, such as: destination IP, protocol, port, may also have similar phenomena; the destination user configured by the policy is not supported by every brand manufacturer. During the policy conversion process, those that do not support it are defaulted to empty, and the source user configuration is supported, and can be multiple users or multiple user groups during the configuration process.

[0058] Based on this situation, some tool classes need to be provided to expand the referenced objects in these tuples, remove overlaps, merge them, and convert them into a unified standard numeric range or string.

[0059] Example 1: The source IP is 192.168.1.0 / 24, which can be converted into the standard digital range 3232235776-3232236031 based on the displacement and weighted algorithm;

[0060] Example 2: The destination IP is 192.168.1.5-192.168.1.45 and 192.168.1.30-192.168.1.60. These are two ranges. The tool must first remove the overlap of these two IP ranges and convert them into 192.168.1.5-192.168.1.60, and then convert them into the standard digital range of 3232235781-3232235836.

[0061] Example 3: The users are user1, uGroup1, where user1 is a specific user and uGroup1 is a user group. The tool class should first expand the user group, take all the users under the group, and then combine them with user1. If there are duplicates, it is necessary to deduplicate the users and finally form a user set, such as user1, user2, and user3.

[0062] 3. Convert the source IP, destination IP, protocol, source port, destination port, source user, destination user, and application octets into a number + character range format, split them into a data flow set (trafficList) based on the protocol as the minimum granularity, and refer to the example. Figure 2 A schematic diagram of a scenario of the data flow set trafficList of the present application is shown.

[0063] 4. Sort the strategies by row number in ascending order;

[0064] It should be understood that the above description of the object format of the tuple in the policy and how to convert it can be understood as a preparatory work, that is, a preparatory work for entering the subsequent redundant policy checking process.

[0065] In the process of defining the strategy as a twelve-tuple map (twelve-tuple variable map), the following contents may be specifically involved:

[0066] 1. The policy has source domain and destination domain. If there is no source domain or destination domain, the default is any (maximum range). If there is a long connection in the policy, it is empty (maximum range) if it is not configured. The same is true for security protection. If there is no configuration, it is empty. If it is configured, it will be identified, such as ips, av, etc.

[0067] 2. Combine the above four tuples of source domain + destination domain + long connection + security protection as the key, and use the formatted eight-tuple as the value;

[0068] 3. According to the policy action, it is divided into two map sets: the allowed twelve-tuple set and the rejected twelve-tuple set;

[0069] 4. The format examples of the definitions are as follows:

[0070] Map <FourMemberObject<String[],String[],Long,String[]> ,List <trafficelement>>

[0071] tuplePermitMap=new linkedHashMap<>();

[0072] Map<FourMemberObject<String[],String[],Long,String[]>,List <trafficelement>>

[0073] tupleDenyMap=new linkedHashMap<>()

[0074] When the twelve-tuple map is defined, the flashback loop strategy involved in the present application can be started, and the strategy that meets the skipping conditions can be skipped first. Specifically, the strategy that meets the conditions means that there is no need to perform redundant detection.

[0075] For the policies to be skipped by the skip operation, namely expired policies, empty policies, default policies, disabled policies, hidden policies, policies with mixed IP addresses, and policies with unknown application tags, the target policies obtained continue to be checked for redundant policies.

[0076] Among them, for the policy with unknown application mark, it means that all applications configured by this policy are not bound to the application baseline library specially configured by this application, and the application baseline library is used to describe applications with different names but the same meaning in network operation and management.

[0077] Specifically, it can be understood that in actual situations, on network devices, the application is filled in by the user and can be any characters. Different people may fill in differently on the same device or on devices from different manufacturers, but the actual meaning expressed is the same. In order to facilitate subsequent cross-manufacturer and cross-device path calculations, this application can establish an application baseline library to form a standard for reaching consensus, and bind these applications with different names but the same meaning to the baseline library (for example, a unified digital identifier) ​​to form an absolute relationship.

[0078] For example, after TimQQ and QQ applications are bound to the application baseline library, their identifiers are both 1.

[0079] It should be understood that the application of the application baseline library is not necessary, but it can bring more convenient management effects in the complete network operation and maintenance management.

[0080] In this case, there are two points worth noting about the skip operation involved here:

[0081] 1. An unknown application tag means that the policy configures N applications, but none of them are bound to the baseline library. As long as one application is bound, no unknown application tag will be generated;

[0082] 2. Skip means that if a policy meets any of the conditions, it will be skipped and will not be included in the check; for example, an expired policy will not participate in all subsequent calculations.

[0083] Step S102, combining multiple source domains, destination domains, persistent connections, and security protections contained in the policy into a unique key, and using the eight-tuple of the policy as a value, matching the key of the current policy in the target policy with the twelve-tuple map;

[0084] In the specific troubleshooting procedure of redundant strategies, the key processing of the current strategy is involved.

[0085] Specifically, a policy can contain multiple source domains, destination domains, and security protections. It can have a long connection, which is combined into the format of [source domain 1, source domain 2, source domain 3...], [destination domain 1, destination domain 2...] long connection [security protection 1, security protection 2...] as the unique key, and the eight-tuple (trafficList) formatted by the policy as the value.

[0086] When generating a key-value pair, the key of the current policy can be matched with the key in the twelve-tuple map.

[0087] Step S103, if the key of the current policy in the target policy matches the twelve-tuple map, the matched target key and the value corresponding to the target key are defined as a containKeylist set;

[0088] Worthy of note are:

[0089] 1. The domain here is included or equal to the match; long connection and security protection must be equal to the match;

[0090] 2. Multiple matches may be possible.

[0091] In addition, for the case of no match, it is considered that the current policy key appears for the first time, and the key-value of the current policy is added to the twelve-tuple map set of the same action for storage, and twelve-tuple subtraction is performed on the allowed twelve-tuple set and the rejected twelve-tuple set, and the current policy loop is skipped.

[0092] Step S104, based on the octet of the current strategy, the containKeyList set is subjected to intersection and remainder processing, and during the processing, the remainder is continuously taken to determine whether it is redundant, and a redundant strategy is obtained;

[0093] The intersection and remainder processing can be understood as continuously carrying out the judgment of the redundant strategy in the manner of intersection and remainder.

[0094] Specifically, the process of performing intersection and remainder processing on the containKeyList set may include the following processing contents:

[0095] If all the octets of the current policy are any (maximum range), determine whether there are octets of all any in the containKeyList set. If so, it means that the current policy is a redundant policy, and the number of the redundant policy is recorded (which can trigger the subsequent logical judgment of who is redundant);

[0096] If the octet of the current policy is not any, then the value of the current policy is intersected with the value in the containKeyList set;

[0097] Determine whether there are any remaining sets;

[0098] If there is a remnant set, it means non-redundancy. Determine whether the key of the current strategy is completely equal to the key of this loop. If it is completely equal, add the data stream to the waitFull set. If not, do not add it.

[0099] If there is no remainder set, it indicates an inclusion relationship and is a redundant strategy. The redundant strategy number is recorded (which can trigger the subsequent logical judgment of who is redundant).

[0100] Among them, the operations of taking the intersection and the remainder of the value of the current policy and the value in the containKeyList set may specifically include the following processing contents:

[0101] First, determine whether there is an intersection between the two octets. If the eight elements of the two octets overlap, there is an intersection (the octets formatted into numeric / character range format have been obtained, and then determine whether the numeric ranges and character ranges between the two octets overlap).

[0102] If there is an intersection, the overlapping parts of the numbers or character ranges of each element of the two octets are taken as the intersection part, and the non-overlapping parts are taken as the remaining parts (then the remaining part of each element is combined with the other seven tuples in the octet to form the remaining octet, and the overlapping parts of each element are combined to form the intersection part);

[0103] If there is no intersection, the entire octet is the remainder.

[0104] The judgment of overlap here can be as follows:

[0105] 1. How to determine whether two number ranges overlap

[0106] Assume that the interval is represented as [start, end], and there are two intervals A and B. There are two types of relationships between the two intervals: overlapping and non-overlapping;

[0107] There are four types of overlapping situations, two intersections, and two inclusions (complete equality is also a type of inclusion), such as (A: 1-5, B: 3-8), (A: 3-8, B: 1-5), (A: 1-10, B: 3-8), (A: 3-8, B: 1-10);

[0108] There are two cases of non-overlap: A is in front of B, A is behind B, such as (A: 1-5, B: 7-9), (A: 7-9, B: 1-5)

[0109] Therefore, the following methods can be used to determine the overlap of intervals:

[0110] 1) Positive judgment, list four overlapping situations, if one of them is met, then there is overlap;

[0111] 2) Reverse judgment, list two non-overlapping situations, if one of them is met, then there is overlap.

[0112] You can choose either of the two judgment methods.

[0113] 2. How to determine whether two string sets overlap

[0114] Take "user" as an example:

[0115] Assume that the source user of one strategy forms a character set [user1, user2, user3] after tool class conversion, and the source user of another strategy is [user1]. Then, we traverse to determine whether the characters of each element are equal. If they are equal, they overlap, otherwise, they do not overlap.

[0116] Here, the example shows the overlapping part [user1] and the non-overlapping part [user2, user3].

[0117] For identified redundant policies, the system can also provide a "handling suggestion script" to encourage administrators to repair these invalid policies based on the manual response. It can also make appropriate adjustments or notes to the policies, explaining the reasons. This effectively helps network administrators quickly understand the validity of all policies on the firewall, and effectively helps administrators quickly locate invalid policies with visual means. It is a good auxiliary troubleshooting method to discover, locate and solve problems.

[0118] Step S105, in the case where the numbers of the firewall policies are pre-sorted in ascending order according to the row numbers, all policies after the number of the redundant policy are traced back, and the policy with an intersection among all the policies is determined as the effective policy;

[0119] After the redundancy strategy is determined above, the processing of the strategy that takes effect here can be expanded.

[0120] Specifically, since the strategies are in ascending order, the redundant strategies must be the data redundancy after being numbered. Thus, all strategies after the numbering are traced back, and those with intersections are the effective strategies that can be retained.

[0121] Determine from the redundant strategy Map set whether the above effective strategy appears for the first time. If so, add the above effective strategy and redundant strategy as new elements to the redundant strategy Map set (key = effective strategy, value = redundant strategy); if not, it means that the above effective strategy has been redundant with others before, and a new redundant strategy is generated this time. Append the above redundant strategy to the value of the matched key in the redundant strategy Map set to form a group of effective strategies that redundant multiple redundant strategies at the same time.

[0122] To facilitate understanding of the ascending characteristics of the strategy, you can also use Figure 3 A scenario diagram of the ascending characteristics of the strategy of the present application is shown to present it more intuitively in a graphical way.

[0123] Step S106: Using the current policy as a reference, perform a 12-tuple subtraction process on the allowed 12-tuple set and the rejected 12-tuple set.

[0124] It is worth noting that the effective strategy is the strategy that is retained in the twelve-tuple map, but it is not always unique, because multiple strategies can also be combined to take effect.

[0125] Specifically, the twelve-tuple subtraction process here eliminates redundant strategies in the twelve-tuple map to avoid the subsequent appearance of strategies with the same eight-tuple but different actions / long connections / security protections, and calculates redundant conclusions.

[0126] From an algorithmic perspective, not only will the calculated redundancy be subtracted, but it will also be subtracted when new elements are added to the twelve-tuple map without redundancy. Therefore, the ultimate goal of subtracting twelve-tuples is to avoid calculation errors when there is an octet intersection between two strategies but different actions / long connections / security protections, and then the two strategies are calculated to be redundant.

[0127] Specifically, the twelve-tuple subtraction process mentioned above may include the following processing contents:

[0128] Determine whether the twelve-tuple map is empty. If it is empty, end directly;

[0129] Start looping the set of twelve-tuples to determine whether the source domain and the destination domain in the twelve-tuple at the current index position contain or are equal to the source domain and the destination domain of the policy currently being processed;

[0130] If they are included or equal, continue to determine whether they have the same action, same connection length, and same safety protection;

[0131] If different actions, different long connections, or different security protections are used, determine whether the eight-tuple data flow in the twelve-tuple of the current index position contains the data flow of the currently processed policy, and return the intersection and remainder of the two sets;

[0132] If the remainder set is not empty, the eight-tuple data stream in the twelve-tuple at the current index position is overwritten.

[0133] Among them, when starting to loop the twelve-tuple set, if the source domain and destination domain of the current policy are any, the domain any mark is performed so as to identify whether further domain matching is required in the subsequent twelve-tuple set loop process; if the current policy has the domain any mark, the domain of the current policy must be included or equal to the source domain and destination domain of the subscript position in the loop process, set zoneMatch=true, and no comparison is required; if the current policy does not have the domain any mark, then during the loop process, the source domain and destination domain of the current policy need to be compared with the source domain and destination domain in the twelve-tuple to determine whether they are included or equal. If they are included or equal, zoneMatch=true, otherwise zoneMatch=false.

[0134] In short, no matter whether the current strategy is any or not, it is just marked, and no matter what the conclusion of the mark is, the twelve-tuple set will be looped.

[0135] Specifically, for the content of the twelve-tuple subtraction processing here, it is worth noting that:

[0136] 1. The map subtraction involved in the 12-tuple subtraction process is to subtract both maps, and call the logic process twice. In the previous description, the policy is divided into the allowed 12-tuple set and the rejected 12-tuple set according to the action;

[0137] 2. Loop through the set of twelve-tuples. The element in each loop is called the twelve-tuple of the current index position.

[0138] 3. During the loop, determine whether the long connection of the current strategy is the same as the long connection in the twelve-tuple, and add the timeMatch mark, which is true if they are the same and false if they are different; the judgment of security protection is the same.

[0139] To facilitate understanding of the twelve-tuple subtraction processing specially configured in this application, a more thorough understanding may be obtained with the help of the following set of examples.

[0140] An example of a twelve-tuple subtraction process is shown in Table 1 below:

[0141] Table 1 - Example of 12-tuple subtraction processing

[0142]

[0143] As shown in Table 1, strategy IDs 71, 72, 77, and 74 are the processing results obtained by using the seven-tuple subtraction process in the prior art: the strategy in row 7 is redundant with rows 1, 2, and 3 (i.e., strategy IDs 71, 72, and 77 are redundant);

[0144] After the upgrade (the twelve-tuple subtraction processing configured in this application), the strategy in row 7 will subtract the strategy IDs 69, 68, and 36. The data stream after the subtraction will no longer intersect with rows 1, 2, and 3, and no redundancy will be generated. Therefore, rows 1, 2, and 3 are non-redundant strategies, and the calculation results are closer to reality and more accurate.

[0145] The above is because the actions of the strategies in lines 4, 5, and 6 are different from those in line 7, but the octet data streams are intersecting. Similarly, when the actions are the same but the security protections are different or the long connections are different, they will also be subtracted, and the conclusion is the same.

[0146] In the above example, the 6th line policy intersects with the 8-tuple data flow of lines 1, 2, and 3, and the 4th and 5th line policies do not intersect with lines 1, 2, and 3. According to the twelve-tuple subtraction logic configured in this application, if there is no 6th line policy, the 7th line policy will be redundant with lines 1, 2, and 3 (i.e., policy IDs 71, 72, and 77 are redundant), because although the actions of the middle 4 and 5 lines are prohibited and opposite, the 8-tuple data has no intersection. In daily business, even if the 1, 2, and 3 lines of policy are deleted, it will not have any impact on the overall business data flow. If there is a 6th line policy, no redundancy will be generated.

[0147] Specifically, the main differences between the redundancy strategy detection solution based on twelve-tuple in the present application and the seven-tuple based in the prior art can also be referred to the following Table 2:

[0148] Table 2 - Comparison between this application and prior art

[0149]

[0150] In addition, it should be understood that the foregoing content is mainly based on the consideration of redundant strategies identified through response screening. For non-redundant strategies, this application is also configured with specific response content, and it is necessary to determine whether it is newly added or overwritten.

[0151] Specifically, after step S106 performs twelve-tuple subtraction processing on the twelve-tuple map with reference to the current strategy, the method of the present application may further include the following contents:

[0152] For non-redundant strategies, determine whether the waitFull set is empty;

[0153] If the waitFull set is not empty, it means that the policy has equal domain, equal long connection, and equal security protection in the twelve-tuple set of the same action, but the eight-tuple data flow is not included. The waitFull value is overwritten in the twelve-tuple set of the same action;

[0154] At this time, the value corresponding to the key in the twelve-tuple set of the same action has become larger than the original range.

[0155] If the waitFull set is empty, it means that the policy domain is included in the twelve-tuple set of the same action, and the long connection and security protection are equal, but the eight-tuple data flow is not included. The merge operation cannot be performed. The policy is key-value combined and added to the twelve-tuple set of the same action as a new element.

[0156] In addition, it should be understood that the above content is about troubleshooting redundant policies from the perspective of a single-domain policy, that is, the calculations are all related to a single policy domain. If the domain of a policy completely contains or is equal to the domain of another policy, it is necessary to further determine whether the two policies are redundant. This processing is already applicable to most customers.

[0157] In further specific applications, the present application can continue to consider troubleshooting redundant strategies from the perspective of multi-domain strategies. The situation faced is that the domain of a strategy is not completely included, and multiple strategies need to be combined to form an inclusion relationship, so as to obtain a deeper and better redundant strategy troubleshooting effect from the overall level.

[0158] Specifically, the application method may also include:

[0159] If the target policy has multiple domain identifiers, that is, a policy has multiple source domains or destination domains, then multi-domain cross-redundancy detection processing is performed.

[0160] For the multi-domain cross strategy, the 4-tuples are cross-combined to form a set A, and the set B of all matching elements in the same action twelve-tuple map is obtained; if the sizes of set A and set B are exactly equal, it means that the source domain, destination domain, long connection, and security protection cross combination of the strategy have already appeared, and it is necessary to determine whether it is redundant by taking the intersection and residual set of the data stream.

[0161] To facilitate understanding of the multi-domain cross-redundancy detection processing specially configured in this application, a more thorough understanding may be achieved with the help of the following set of examples.

[0162] The main contents include:

[0163] 1. Convert the three policies involved into digital and string range formats. IP is converted through displacement and weighted algorithms, and services are converted based on protocol numbers and ports. The results after conversion are shown in Table 3:

[0164] Table 3 - Conversion results

[0165] Serial number Source Threshold Destination Domain Source IP Destination IP 1 Dmz, trust untrust 3232236544-3232236799 3232262146-3232262148 2 trust Untrust 3232236544-3232236799 3232262144-3232262399 3 dmz untrust 3232236544-3232236799 3232262146-3232262149

[0166] Note: The manufacturer of the sample data does not support the destination user yet, so shielding is described here; and the long connection of the sample data is empty, and the security protection is empty; the service is any, the source user is empty, and the application is empty. The actions of the three policies are the same, which is to allow.

[0167] 2. Loop in reverse order, starting from sequence number 3, which is the first policy. Cross-combining the source domain, destination domain, long connection, and security protection to form the string dmz_untrust_time_safe;

[0168] Note: Since the long connection and safety protection are empty, they are recorded as fixed values ​​here: time and safe.

[0169] 3. Use the string dmz_untrust_time_safe from the previous step as the key to search for the twelve-tuple set of the same action type, and obtain the tupleValue of all elements equal to the key;

[0170] 4. Since it is the first element, the set of twelve tuples is still empty and cannot be retrieved, so after searching, it is empty. Add the key and value octet to the set of twelve tuples of the same action. And since it is the first element, the two sets of twelve tuples are empty, so the two sets of twelve tuples do not need to be subtracted;

[0171] 5. Continue looping to the policy No. 2. Combine the source domain, destination domain, long connection, and security protection of No. 2 into a string key "trust_untrust_time_safe". Use this key to search for an equal pair in the set of twelve tuples of the same action. Conclusion: No, because the domains are different.

[0172] 6. Add strategy 2 to the set of allowed twelve-tuples and perform twelve-tuple subtraction. Since strategy 2 and strategy 3 have different domains and do not meet the subtraction condition, the eight-tuple of strategy 3 is not reduced and remains unchanged.

[0173] 7. Reject the set of twelve tuples, because it is empty, and do not reduce;

[0174] 8. Continue looping to the sequence number 1 policy and find that there are 2 source domains and 1 destination domain. Perform Cartesian product intersection to form 2 keys: "dmz_untrust_time_safe" and "trust_untrust_time_safe";

[0175] 9. Take the two keys from the previous step and query whether they are equal in the set of twelve tuples of the same action. Conclusion: Yes, the key and value eight-tuples put in by strategy 2 and strategy 3 are obtained, size = 2, that is, there are two matching elements in the set;

[0176] 10. The two elements obtained are exactly equal to the size of the cross combination of sequence number 1, indicating that the domain, long connection, and security protection are completely matched. The obtained elements are called the "tunpleValue" set, and the value and octet data streams can be compared;

[0177] 11. Traverse the two keys of sequence number 1, the first key "dmz_untrust_time_safe", and take out the element equal to the key from the "tunpleValue" set, that is, get the sequence number 3 strategy, take the octet of sequence number 1 and the octet of sequence number 3 to perform intersection and remainder set operations. After completion, it is found that there is no remainder set and it is completely contained by sequence number 3. The match flag is increased by 1;

[0178] Note: During the operation, if there are any remaining sets in the octet, it means there is no match and the match mark is not added.

[0179] 12. Continue traversing to the second key "trust_untrust_time_safe", and take out the element equal to the key from the "tunpleValue" set, that is, get the strategy of sequence number 2. As in the previous step, take the intersection of the octet of sequence number 1 and the octet of sequence number 2, and find that there is no remainder set, which is completely contained. Add 1 to the matching mark;

[0180] 13. After the traversal is completed, the matching tags are counted and the tag value is 2, which is exactly equal to the size of the sequence number 1 domain after the intersection, indicating that the sequence number 1 strategy is redundant.

[0181] Regarding the contents of the above embodiments (including the exemplary contents in details), in general, for redundant detection of firewall policies, this application introduces twelve-tuples, and takes twelve-tuples as the basis, supplemented by intersection, remainder set processing, and twelve-tuple subtraction processing (subtraction of different actions in the same domain), to achieve the goal of quickly identifying redundant policies, thereby providing a set of convenient and high-precision detection solutions for redundant firewall policy detection, which helps to better meet the actual needs of high-precision detection of firewall redundant policies.

[0182] The above is an introduction to the firewall policy redundant relationship detection method provided by the present application. In order to facilitate better implementation of the firewall policy redundant relationship detection method provided by the present application, the present application also provides a firewall policy redundant relationship detection device from the perspective of functional modules.

[0183] See also Figure 4 , Figure 4 This is a schematic diagram of a structure of a detection device for firewall policy redundancy relationship of the present application. In the present application, the detection device 400 for firewall policy redundancy relationship may specifically include the following structure:

[0184] The skip unit 401 is used to skip expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags when each firewall policy is defined as a twelve-tuple map, and obtain a target policy. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to actions. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection.

[0185] A matching unit 402 is used to match the key of the current policy in the target policy with the twelve-tuple map when the multiple source domains, destination domains, long connections and security protections included in the policy are combined into a unique key and the eight-tuple of the policy is used as a value;

[0186] A definition unit 403 is used to define the matched target key and the value corresponding to the target key as a containKeylist set if the key of the current policy in the target policy matches the twelve-tuple map, define a waitFull set, and store the eight-tuple data flow information to be covered;

[0187] The redundancy detection unit 404 is used to perform intersection and remainder processing on the containKeyList set based on the octet of the current strategy, and continuously take the remainder to determine whether it is redundant during the processing, so as to obtain a redundancy strategy;

[0188] The determination unit 405 is used to trace back all policies after the number of the redundant policy when the numbers of the firewall policies are pre-sorted in ascending order according to the row number, and determine the policy with an intersection among all the policies as the effective policy;

[0189] The subtraction unit 406 is used to perform a 12-tuple subtraction process on the allowed 12-tuple set and the rejected 12-tuple set with reference to the current policy.

[0190] As an exemplary implementation method, if the key of the current policy in the target policy does not match the twelve-tuple map, the current policy is considered to appear for the first time, and the current policy is added to the twelve-tuple set of the corresponding action, and twelve-tuple subtraction processing is performed on the allowed twelve-tuple set and the rejected twelve-tuple set.

[0191] As another exemplary implementation, the process of taking the intersection and the remainder of the containKeyList set includes the following processing contents:

[0192] If the policy does not have a source domain or a destination domain, the default value is any. If the octets of the current policy are all any, determine whether there are octets of all any in the containKeyList set. If so, it indicates that the current policy is a redundant policy, and the number of the redundant policy is recorded.

[0193] If the octet of the current policy is not any, then the value of the current policy is intersected with the value in the containKeyList set and the remainder is taken to determine whether there is a remainder.

[0194] If there is a remainder, it means non-inclusion, and the remainder is used to match the next one until there is no remainder or the loop is completed;

[0195] If there is a residual set, it means non-redundancy. Determine whether the key of the current strategy is completely equal to the key of this loop. If it is completely equal, add the data stream to the waitFull set. If it is not completely equal, do not add it.

[0196] If there is no residual set, it indicates an inclusion relationship and is a redundant strategy. The redundant strategy number is recorded.

[0197] As another exemplary implementation, the operations of obtaining the intersection and the remainder set include the following processing contents:

[0198] First, determine whether there is an intersection between the two octets. If the eight elements of the two octets overlap, there is an intersection.

[0199] If there is an intersection, the overlapping part of the number or character range of each element of the two octets is taken as the intersection part, and the non-overlapping part is the remaining part;

[0200] If there is no intersection, the entire octet is the remainder.

[0201] As another exemplary implementation, after performing the twelve-tuple subtraction process on the twelve-tuple map with reference to the current strategy, the processing unit 406 is further configured to:

[0202] For non-redundant strategies, determine whether the waitFull set is empty;

[0203] If the waitFull set is not empty, it means that the policy has equal domain, equal long connection, and equal security protection in the twelve-tuple set of the same action, but the eight-tuple data flow is not included. The waitFull value is overwritten in the twelve-tuple set of the same action;

[0204] If the waitFull set is empty, it means that the policy domain is included in the twelve-tuple set of the same action, and the long connection and security protection are equal, but the eight-tuple data flow is not included. The merge operation cannot be performed. The policy is key-value combined and added to the twelve-tuple set of the same action as a new element.

[0205] As another exemplary implementation, the processing unit 406 is further configured to:

[0206] If the target policy has multiple domain identifiers, perform redundant detection of multiple domain intersections.

[0207] As another exemplary implementation, the twelve-tuple subtraction process includes the following processing contents:

[0208] Determine whether the twelve-tuple map is empty. If it is empty, end directly;

[0209] Then, the set of twelve-tuples is circulated to determine whether the source domain and the destination domain in the twelve-tuple of the current index position contain or are equal to the source domain and the destination domain of the policy currently being processed;

[0210] If they are included or equal, continue to determine whether they have the same action, same connection length, and same safety protection;

[0211] If different actions, different long connections, or different security protections are used, determine whether the eight-tuple data flow in the twelve-tuple of the current index position contains the data flow of the currently processed policy, and return the intersection and remainder of the two sets;

[0212] If the remainder set is not empty, the eight-tuple data stream in the twelve-tuple at the current index position is overwritten.

[0213] This application also provides a processing device from the perspective of hardware structure, see Figure 5 , Figure 5 501, a computer program stored in the memory 502, and an input / output device 503. The processor 501 is used to execute a computer program stored in the memory 502 to implement the following Figure 1 The steps of the method for detecting redundant relationship of firewall policies in the corresponding embodiment; or, the processor 501 is used to execute the computer program stored in the memory 502 to implement the following Figure 4 Corresponding to the functions of each unit in the embodiment, the memory 502 is used to store the processor 501 executing the above Figure 1 The computer program required for the method for detecting the redundant relationship of firewall policies in the corresponding embodiment.

[0214] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 502, and executed by the processor 501 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0215] The processing device may include, but is not limited to, a processor 501, a memory 502, and an input / output device 503. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 501, the memory 502, the input / output device 503, etc. are connected via a bus.

[0216] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0217] The memory 502 can be used to store computer programs and / or modules. The processor 501 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 502 and calling the data stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0218] When the processor 501 is used to execute the computer program stored in the memory 502, the following functions can be implemented:

[0219] When each firewall policy is defined as a twelve-tuple map, the target policy is obtained by skipping expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to the action. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection.

[0220] When multiple source domains, destination domains, persistent connections, and security protections included in the policy are combined into a unique key and the policy's octet is used as the value, the key of the current policy in the target policy is matched with the twelve-tuple map;

[0221] If the key of the current policy in the target policy matches the twelve-tuple map, the matched target key and the value corresponding to the target key are defined as the containKeylist set, and the waitFull set is defined to store the eight-tuple data flow information to be covered;

[0222] Based on the octet of the current strategy, the containKeyList set is processed by taking the intersection and the remainder set. During the processing, the remainder set is continuously taken to determine whether it is redundant, and the redundant strategy is obtained;

[0223] When the numbers of the firewall policies are pre-sorted in ascending order according to the row numbers, all policies after the number of the redundant policy are traced back, and the policy with an intersection among all the policies is determined as the effective policy;

[0224] With the current policy as a reference, a twelve-tuple subtraction process is performed on the allowed twelve-tuple set and the denied twelve-tuple set.

[0225] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the detection device, processing device and corresponding units of the firewall policy redundancy relationship described above can refer to the following. Figure 1 The description of the method for detecting the redundant relationship of firewall policies in the corresponding embodiment will not be repeated here in detail.

[0226] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0227] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the method for detecting the redundant relationship of firewall policies in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the method for detecting the redundant relationship of firewall policies in the corresponding embodiment will not be repeated here.

[0228] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0229] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the method for detecting the redundant relationship of firewall policies in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the method for detecting redundant relations of firewall policies in the corresponding embodiment are detailed in the previous description and will not be repeated here.< / trafficelement> < / trafficelement>

Claims

1. A method for detecting redundant relations of firewall policies, characterized in that: The method comprises: When each firewall policy is defined as a twelve-tuple map, the target policy is obtained by skipping expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to actions. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection. In the case where the multiple source domains, the destination domains, the persistent connections, and the security protections included in the policy are combined into a unique key, and the eight-tuple of the policy is used as a value, the key of the current policy in the target policy is matched with the twelve-tuple map; If the key of the current policy in the target policy matches the twelve-tuple map, the matched target key and the value corresponding to the target key are defined as a containKeyList set, and a waitFull set is defined to store the eight-tuple data flow information to be covered; Based on the octet of the current strategy, the containKeyList set is processed by taking the intersection and the remainder set, and during the processing, the remainder set is continuously taken to determine whether it is redundant, so as to obtain a redundant strategy; In the case where the serial numbers of the firewall policies are pre-sorted in ascending order according to the row numbers and the policies are circulated in reverse order, all the policies after the serial number of the redundant policy are traced back, and the policy with an intersection among all the policies is determined as the effective policy; Taking the current policy as a reference, performing a twelve-tuple subtraction process on the allowed twelve-tuple set and the rejected twelve-tuple set; The twelve-tuple subtraction process includes the following processing contents: Determine whether the twelve-tuple map is empty. If it is empty, end directly; Start looping the set of twelve-tuples, and determine whether the source domain and the destination domain in the twelve-tuple of the current index position include or are equal to the source domain and the destination domain of the policy currently being processed; If they are included or equal, continue to determine whether they have the same action, same connection length, and same safety protection; If different actions or different long connections or different security protections are used, determine whether the eight-tuple data flow in the twelve-tuple of the current subscript position contains the data flow of the currently processed policy, and return the intersection and remainder of the two sets; If the remainder set is not empty, the eight-tuple data stream in the twelve-tuple of the current index position is overwritten.

2. The method according to claim 1, characterized in that If the key of the current policy in the target policy does not match the twelve-tuple map, the current policy is considered to appear for the first time, and the current policy is added to the twelve-tuple set of the corresponding action, and the twelve-tuple subtraction processing is performed on the allowed twelve-tuple set and the rejected twelve-tuple set.

3. The method according to claim 1, characterized in that The process of taking the intersection and the remainder of the containKeyList set includes the following processing contents: If the policy does not exist in the source domain or the destination domain, the default value is any. If the octets of the current policy are all any, determine whether there are octets of all any in the containKeyList set. If so, it indicates that the current policy is the redundant policy, and the number of the redundant policy is recorded. If the octet of the current policy is not any, then the value of the current policy is intersected with the value in the containKeyList set and the remainder operation is performed; Determine whether there are any remaining sets; If there is a remainder, it means non-inclusion, and the remainder is used to match the next one until there is no remainder or the loop is completed; If there is a residual set, it indicates non-redundancy, and it is determined whether the key of the current strategy is completely equal to the key of this cycle. If it is completely equal, the data flow is added to the waitFull set; if it is not completely equal, it is not added; If there is no residual set, it indicates an inclusion relationship and is the redundant strategy, and the redundant strategy number is recorded.

4. The method according to claim 3, characterized in that The operations of taking the intersection and taking the remainder include the following processing contents: First, determine whether there is an intersection between the two octets. If the eight elements of the two octets overlap, there is an intersection. If there is an intersection, the overlapping parts of the number or character ranges of each element of the two octets are taken as the intersection part, and the non-overlapping parts are taken as the remaining parts; If there is no intersection, the entire octet is the remainder.

5. The method according to claim 3, characterized in that: After performing a twelve-tuple subtraction process on the twelve-tuple map with reference to the current strategy, the method further includes: For a non-redundant strategy, determining whether the waitFull set is empty; If the waitFull set is not empty, it means that the policy has equal domain, equal long connection, and equal security protection in the twelve-tuple set of the same action, but the eight-tuple data flow is not included, and the waitFull value is overwritten in the twelve-tuple set of the same action; If the waitFull set is empty, it means that the domain of the policy is included in the twelve-tuple set of the same action, and the long connection and the security protection are equal, but the eight-tuple data stream is not included. In this case, the merge operation cannot be performed. The policy is key-value combined and added to the twelve-tuple set of the same action as a new element.

6. The method according to claim 4, characterized in that The method further comprises: If the current policy has multiple domain identifiers, redundant detection of multiple domain intersections is performed.

7. A device for detecting redundant relations of firewall policies, characterized in that: The device comprises: A skip unit is used to skip expired policies, empty policies, default policies, disabled policies, hidden policies, mixed IP policies, and policies with unknown application tags to obtain a target policy when each firewall policy is defined as a twelve-tuple map. The twelve-tuple map is divided into an allow twelve-tuple set and a deny twelve-tuple set according to actions. The twelve-tuple map involves source address, destination address, protocol, source port, destination port, source domain, destination domain, application, source user, destination user, security protection, and long connection. a matching unit, configured to match the key of the current policy in the target policy with the twelve-tuple map when the plurality of source domains, the destination domains, the persistent connections and the security protections included in the policy are combined into a unique key and the eight-tuple of the policy is used as a value; A definition unit, configured to define the matched target key and the value corresponding to the target key as a containKeyList set if the key of the current policy in the target policy matches the twelve-tuple map, and to define a waitFull set to store the eight-tuple data flow information to be covered; A redundancy detection unit, used for performing intersection and remainder processing on the containKeyList set based on the octet of the current strategy, and continuously taking the remainder to determine whether it is redundant during the processing, so as to obtain a redundant strategy; A determination unit, configured to, when the numbers of the firewall policies are pre-sorted in ascending order according to the row numbers and the policies are cyclically reversed, trace back all the policies after the number of the redundant policy, and determine the policy with an intersection among all the policies as the effective policy; a subtraction unit, configured to perform a 12-tuple subtraction process on the allowed 12-tuple set and the rejected 12-tuple set with reference to the current policy; The twelve-tuple subtraction process includes the following processing contents: Determine whether the twelve-tuple map is empty. If it is empty, end directly; Start looping the set of twelve-tuples, and determine whether the source domain and the destination domain in the twelve-tuple of the current index position include or are equal to the source domain and the destination domain of the policy currently being processed; If they are included or equal, continue to determine whether they have the same action, same connection length, and same safety protection; If different actions or different long connections or different security protections are used, determine whether the eight-tuple data flow in the twelve-tuple of the current subscript position contains the data flow of the currently processed policy, and return the intersection and remainder of the two sets; If the remainder set is not empty, the eight-tuple data stream in the twelve-tuple of the current index position is overwritten.

8. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 6 is executed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 6.

Images