A non-IP firewall control method, device, electronic device and storage medium

Abstract

The embodiment of the present application provides a method, device, electronic device and storage medium for controlling a non-IP firewall, and belongs to the field of network security technology. The method includes: when multiple non-IP firewalls communicate with a management center, the management center uses a queue or polling method to limit the flow; obtains a policy synchronization mode; if the policy synchronization mode is an upload and download mode, obtains a pre-stored policy through the non-IP firewall and generates a current unique identification code according to the policy, sends the current unique identification code to the management center, obtains policy data in the database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, sends the policy data to the non-IP firewall through the management center, and applies the policy data through the non-IP firewall. The embodiment of the present application can maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a non-IP firewall management and control method, device, electronic device and storage medium. Background Art

[0002] At present, when managing and controlling non-IP firewalls, when a large number of non-IP firewalls communicate with the management center at the same time, the system will be overloaded due to too many communication requests. In particular, the problem of on-site network bandwidth occupation needs to be considered. The policy configuration synchronization of non-IP firewalls is usually complicated and requires professional IT personnel to complete. At the same time, the configuration and management of non-IP firewalls need to be adjusted frequently. Considering the complexity of the on-site network and environment, not all non-IP firewalls may be able to communicate in any time period, and the center may also be affected by equipment offline, network jitter, failures, etc., it is easy for the policy information in the non-IP firewall to be inconsistent with the policy information in the management center.

[0003] Therefore, the above technical problems need to be solved urgently in the industry. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a non-IP firewall management method, device, electronic device and storage medium to overcome the deficiencies in the prior art.

[0005] The embodiments of the present application disclose the following technical solutions:

[0006] On the one hand, an embodiment of the present application provides a non-IP firewall management and control method, the method comprising:

[0007] Acquire a policy synchronization mode, wherein the policy synchronization mode includes an upload and download mode;

[0008] If the policy synchronization mode is the upload and download mode, the pre-stored policy is obtained through the non-IP firewall and a current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data in the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data is sent to the non-IP firewall through the management center, and the policy data is applied through the non-IP firewall;

[0009] When multiple non-IP firewalls communicate with the management center, the management center uses a queue or polling method to limit the flow.

[0010] In some embodiments, the policy synchronization mode further includes a downlink mode and an uplink mode, and the method further includes:

[0011] If the policy synchronization mode is the uplink mode, the pre-stored policy is obtained through the non-IP firewall and a current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data of the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data of the management center database is updated according to the current unique identification code, and confirmation information is returned through the management center, and the confirmation information is received through the non-IP firewall, and the confirmation information is used to confirm that the data has been correctly received;

[0012] If the policy synchronization mode is the downlink mode, the policy data in the database is obtained through the management center, the policy data is sent to the non-IP firewall, the policy data is applied by the non-IP firewall and confirmation information is returned, and the confirmation information is received by the management center.

[0013] In some embodiments, limiting the flow by a queue through the management center includes:

[0014] If the policy synchronization mode is the uplink mode, receiving the request through the management center, adding the request to the uplink queue; dynamically adjusting the length of the uplink queue by monitoring the load conditions, wherein the load conditions include the number of requests, response time, CPU utilization, memory utilization, hard disk utilization, and CPU temperature;

[0015] If the policy synchronization mode is the downlink mode, a request is created through the management center, and the request is added to a downlink queue; and the length of the downlink queue is dynamically adjusted by monitoring the load condition.

[0016] In some embodiments, the method of limiting the flow by a queue or polling method through the management center includes:

[0017] If the policy synchronization mode is the uplink mode or the upload and issue mode, and the management center is offline, the request is added to the upload queue of the no-IP firewall through the no-IP firewall, and the upload queue of the no-IP firewall is optimized by polling once every preset time, and the no-IP firewall continues to run according to the last stored communicative configuration until the management center is online, and the request in the upload queue of the no-IP firewall is uploaded;

[0018] If the policy synchronization mode is the downlink mode and the non-IP firewall is offline, the request is added to the downlink queue through the management center, and the downlink queue is optimized by polling once every preset time until the non-IP firewall is online and the requests in the downlink queue are sent down.

[0019] In some embodiments, limiting the flow by a queue through the management center further includes:

[0020] Before the uplink queue or the downlink queue submits the request, predicting whether the request will time out;

[0021] If the prediction result is that the request will time out, the request is abandoned.

[0022] In some embodiments, the management center includes a center status page, a terminal status page, and a historical policy page, the center status page includes a center operation status area, the terminal status page includes a terminal operation status area, the historical policy page includes a policy list area, a list template area, and a blacklist area, and the method further includes:

[0023] In response to the first instruction, the CPU utilization, memory utilization, hard disk utilization and CPU temperature of the management center are displayed in the center operation status area;

[0024] In response to the second instruction, displaying the CPU utilization, memory utilization, number of effective policies and policy interception of the non-IP firewall through the terminal operation status area;

[0025] In response to the third instruction, displaying the historical policies of the non-IP firewall in the policy list area, the historical policies including policy size, creation user and creation time;

[0026] In response to the fourth instruction, the list name, list IP address and list activation status of the current historical strategy are displayed in the list template area, and the blacklist name, list name, asset access status, access asset status and blacklist activation status are displayed in the blacklist area.

[0027] In some embodiments, the method further comprises:

[0028] Establish a connection with the management center by using the IP-free firewall of the protected device;

[0029] Log data is generated and processed through a non-IP firewall, and the log data is sent to the management center.

[0030] On the other hand, an embodiment of the present application provides a distributed management and control device, the device comprising:

[0031] A policy synchronization module, used to obtain a policy synchronization mode, wherein the policy synchronization mode includes an upload and download mode;

[0032] An upload and download module, which is used to obtain a pre-stored policy through a non-IP firewall and generate a current unique identification code according to the policy if the policy synchronization mode is the upload and download mode, send the current unique identification code to the management center, obtain policy data in a database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, send the policy data to the non-IP firewall through the management center, and apply the policy data through the non-IP firewall;

[0033] The flow limiting module is used to limit the flow by using a queue or polling method through the management center when multiple non-IP firewalls communicate with the management center.

[0034] On the other hand, an embodiment of the present application provides an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned non-IP firewall management and control method when executing the computer program.

[0035] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned non-IP firewall management and control method.

[0036] The non-IP firewall management and control method, device, electronic device and storage medium proposed in the present application, when multiple non-IP firewalls communicate with the management center, the management center uses a queue or polling method to limit the flow, ensuring the rational use and stability of resources; obtaining a policy synchronization mode; if the policy synchronization mode is an upload and download mode, the non-IP firewall obtains the pre-stored policy and generates a current unique identification code according to the policy, sends the current unique identification code to the management center, obtains the policy data in the database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, sends the policy data to the non-IP firewall through the management center, and applies the policy data through the non-IP firewall to realize automatic policy data application, thereby improving the efficiency and accuracy of network security management. The embodiments of the present application can maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of a non-IP firewall management and control method provided in an embodiment of the present application;

[0038] Figure 2 It is a further flow chart of a non-IP firewall management and control method provided in an embodiment of the present application;

[0039] Figure 3It is a further flow chart of a non-IP firewall management and control method provided in an embodiment of the present application;

[0040] Figure 4 yes Figure 1 Flow chart of step S103 in FIG.

[0041] Figure 5 yes Figure 1 Flow chart of step S103 in FIG.

[0042] Figure 6 This is a schematic diagram of an application scenario of the non-IP firewall control method provided in an embodiment of the present application;

[0043] Figure 7 It is a schematic diagram of a strategy synchronization mode provided in an embodiment of the present application;

[0044] Figure 8 This is a schematic diagram of a center status page provided in an embodiment of the present application;

[0045] Fig. 9 This is a schematic diagram of a terminal status page provided in an embodiment of the present application;

[0046] Fig.10 This is another terminal status page schematic diagram provided in an embodiment of the present application;

[0047] Fig.11 This is a schematic diagram of a historical strategy page provided in an embodiment of the present application;

[0048] Fig.12 It is a structural diagram of a non-IP firewall control device provided in an embodiment of the present application;

[0049] Fig.13 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0053] First, some nouns involved in this application are analyzed:

[0054] CPU utilization: refers to the ratio between the workload of the computer's central processing unit and its available processing power, indicating the situation of the machine running programs at a certain point in time.

[0055] Memory utilization: refers to the ratio of the physical memory currently being used by the system to the total available memory. It is one of the indicators to measure the utilization of system memory resources.

[0056] Hard disk utilization: refers to the degree to which the hard disk space stored in the computer system is occupied. It is an important parameter to measure the utilization of the file system capacity.

[0057] Policy: refers to a strategy that controls the device to forward traffic and conducts integrated content security detection on the traffic. The policy verifies the data flow through the firewall, and only the legitimate data flow that complies with the security policy can pass through the firewall.

[0058] At present, when managing and controlling non-IP firewalls, when a large number of non-IP firewalls communicate with the management center at the same time, the system will be overloaded due to too many communication requests. In particular, the problem of on-site network bandwidth occupation needs to be considered. The policy configuration synchronization of non-IP firewalls is usually complicated and requires professional IT personnel to complete. At the same time, the configuration and management of non-IP firewalls need to be adjusted frequently. Considering the complexity of the on-site network and environment, not all non-IP firewalls may be able to communicate in any time period, and the center may also have offline equipment, network jitter, failures, etc., it is easy for the policy information in the non-IP firewall to be inconsistent with the policy information in the management center.

[0059] Therefore, the above technical problems need to be solved urgently in the industry.

[0060] Based on this, the embodiments of the present application provide a non-IP firewall management and control method, device, electronic device and storage medium, which aim to maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system.

[0061] The non-IP firewall control method, device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the non-IP firewall control method in the embodiments of the present application is described.

[0062] The non-IP firewall control method provided in the embodiment of the present application relates to the field of equipment control technology. The non-IP firewall control method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the non-IP firewall control method, etc., but is not limited to the above forms.

[0063] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0064] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0065] Figure 1 This is an optional flowchart of the non-IP firewall management method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S103.

[0066] Step S101, obtaining a policy synchronization mode;

[0067] Specifically, the policy synchronization mode includes an upload and download mode, a downlink mode, and an uplink mode.

[0068] In some embodiments, the policy synchronization mode is configured through a policy synchronization configuration page of the management center.

[0069] In some embodiments, the policy synchronization mode is stored by a database of the management center.

[0070] In step S101, the policy synchronization mode may be obtained from a database of a management center.

[0071] In some embodiments, policy synchronization mode may be achieved through a no-IP firewall.

[0072] In step S101, the policy synchronization mode may also be obtained from a database without an IP firewall.

[0073] It is understandable that the application does not specifically limit the control scope of the policy synchronization mode, and can be flexibly selected in combination with actual control needs. For example, the policy synchronization mode can control all online non-IP firewalls, and the policy synchronization mode can also control some online non-IP firewalls.

[0074] It is understandable that different non-IP firewalls can use different policy synchronization modes. For example, the non-IP firewall located in the school uses the downlink mode, and the non-IP firewall located in the hospital uses the uplink and downlink mode.

[0075] In some embodiments, different policy synchronization modes can be configured for different non-IP firewalls through the policy synchronization configuration page of the management center.

[0076] In this embodiment, a policy synchronization mode is obtained to prepare for subsequent policy synchronization and current limiting.

[0077] Step S102, if the policy synchronization mode is the upload and download mode, obtain the pre-stored policy through the non-IP firewall and generate a current unique identification code according to the policy, send the current unique identification code to the management center, obtain the policy data in the database through the management center, if the unique identification code of the policy data is different from the current unique identification code, send the policy data to the non-IP firewall through the management center, and apply the policy data through the non-IP firewall;

[0078] Specifically, the unique identification code is used to uniquely identify the policy of the non-IP firewall.

[0079] In some embodiments, the present application does not specifically limit the generation of the unique identification code, and can be flexibly selected in combination with actual management and control needs. For example, the unique identification code can be generated according to a preset (policy-unique identification code) form match, or can be generated by a preset generation algorithm.

[0080] It is understandable that the present application does not make any specific limitation on the storage of policies, and can be flexibly selected in combination with actual management and control needs. For example, the policies can be stored in a database or in a local file system.

[0081] In some embodiments, the policy data in the database is obtained through the management center, and a unique identification code can be generated according to the policy data, or the unique identification code can be obtained from the policy data.

[0082] Optionally, the present application also compares the current unique identification code of the non-IP firewall with the unique identification code of the management center.

[0083] In some embodiments, if the current unique identification code of the non-IP firewall is the same as the unique identification code of the management center, it means that the policy data of the non-IP firewall is the same as the policy data of the management center, and policy synchronization is not required.

[0084] In some embodiments, if the current unique identifier of the non-IP firewall is different from the unique identifier of the management center, the policy data is sent to the non-IP firewall through the management center, and the policy data is applied by the non-IP firewall.

[0085] It is understandable that the present application does not make any specific limitation on the policy data, and the policy data can be flexibly selected in combination with the actual control needs. For example, the policy data can be a unique identification code or a complete policy data.

[0086] Optionally, the unique identification code is sent to the non-IP firewall through the management center, and the non-IP firewall obtains and applies policy data based on the unique identification code and the (policy-unique identification code) form.

[0087] In this embodiment, if the policy synchronization mode is the upload and download mode, the pre-stored policy is obtained through the non-IP firewall and the current unique identification code is generated according to the policy, and the current unique identification code is sent to the management center. The policy data in the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data is sent to the non-IP firewall through the management center. The policy data is applied by the non-IP firewall, so that the non-IP firewall can apply the latest policy data, ensure the synchronous update of policy data, respond to threats and attacks in time, and take corresponding protective measures, thereby improving the security of the network, reducing the workload of manual configuration and management, simplifying the policy deployment and maintenance process, improving management efficiency, and improving the scalability and flexibility of the system.

[0088] Step S103, when multiple non-IP firewalls communicate with the management center, the management center uses a queue or polling method to limit the flow.

[0089] In some embodiments, if a non-IP firewall sends too many requests in a short period of time, it is determined to be an abnormal request and corresponding processing measures are taken, such as rejecting or delaying the processing of these requests.

[0090] In some embodiments, a request ID or unique identifier is used for deduplication. Each request is assigned a unique request ID or identifier. When receiving a new request, the management center first checks whether the request ID already exists. If there is a duplicate request ID, it means that it is a duplicate request and can be directly ignored or the previously processed result can be returned.

[0091] In some embodiments, the characteristics of the request are analyzed and judged according to predefined rules and algorithms to identify abnormal requests. For example, illegal parameters, abnormal access behavior or abnormal data traffic in the request can be detected, and corresponding measures can be taken to intercept them.

[0092] In some embodiments, when the number of requests without an IP firewall exceeds a set limit, the requests may be placed in a queue for delayed processing.

[0093] In some embodiments, when multiple non-IP firewalls communicate with the management center, if the policy synchronization mode is the uplink mode, the management center receives the request and adds the request to the uplink queue; the length of the uplink queue is dynamically adjusted by monitoring the load condition, wherein the load condition includes the number of requests, response time, CPU utilization, memory utilization, hard disk utilization, and CPU temperature.

[0094] In some embodiments, the uplink queue may be located at the non-IP firewall end or at the management center end.

[0095] Optionally, after the queue length is adjusted, requests may be taken out from the upstream queue according to a certain strategy (eg, round-robin, random, etc.), and then submitted.

[0096] Furthermore, when submitting a request, the policy data of the management center can be synchronously modified to the policy data of the non-IP firewall through the management center.

[0097] Among them, if the policy synchronization mode is the uplink mode and the management center is offline, the request is added to the non-IP firewall upload queue through the non-IP firewall, and the non-IP firewall upload queue is optimized by polling once every preset time. The non-IP firewall continues to run according to the last stored communicative configuration until the management center is online, and the request in the non-IP firewall upload queue is uploaded.

[0098] In some embodiments, the present application does not specifically limit the preset time, and it can be flexibly selected in combination with actual control needs. For example, the preset time can be set by the user or automatically calculated by the system.

[0099] For example, the preset time can be evaluated based on factors such as system load, network bandwidth, and the size of the upload queue. A shorter preset time can provide faster request processing speed, but may increase system burden and network pressure, while a longer preset time can reduce system burden but may cause delays.

[0100] In some embodiments, when multiple non-IP firewalls communicate with the management center, if the policy synchronization mode is the downlink mode, a request is created through the management center and the request is added to the downlink queue; by monitoring the load situation, the length of the downlink queue is dynamically adjusted.

[0101] In some embodiments, the downlink queue may be located at the non-IP firewall end or at the management center end.

[0102] Optionally, after the queue length is adjusted, requests may be taken out from the downlink queue according to a certain strategy (eg, round-robin, random, etc.), and then submitted.

[0103] Furthermore, when submitting a request, the policy data of the non-IP firewall can be synchronously modified to the policy data of the management center through the non-IP firewall.

[0104] Among them, if the policy synchronization mode is the downlink mode and no IP firewall is offline, the request will be added to the downlink queue through the management center, and the downlink queue will be optimized by polling every preset time until no IP firewall is online and the request in the downlink queue is sent down.

[0105] In some embodiments, before an upstream queue or a downstream queue submits a request, it is predicted whether a request will time out.

[0106] It can be understood that the uplink queue submission includes uploading the requests in the uplink queue, and the downlink queue submission includes sending the requests in the downlink queue.

[0107] It should be noted that this application does not specifically limit the prediction method, and it can be flexibly selected in combination with actual management and control needs. For example, the prediction can be made by statistical analysis based on historical data, or by machine learning models, or by real-time monitoring and feedback mechanisms.

[0108] Among them, based on the statistical analysis of historical data, according to the previous request records and response times, the average response time, the longest response time and other indicators can be calculated. Then, based on the current request characteristics (such as the type, parameters, target resources, etc. of the request), combined with the statistical analysis results of historical data, the response time of the current request is estimated and compared with the set timeout threshold to determine whether a timeout is possible.

[0109] Using machine learning models for prediction, you can use machine learning algorithms to train various request features and context information to build a prediction model. The prediction model can be trained based on existing data sets, learn the relationship between different request features and timeout situations, and predict whether the current request is likely to time out based on the features of the current request.

[0110] For example, a real-time monitoring and feedback mechanism is used for prediction. Before a request is submitted to the queue, a real-time monitoring system can be set up to detect factors such as the current system load, network latency, and other factors that may cause the request to time out. Based on these monitoring indicators, the prediction results can be adjusted in real time or warnings can be provided to help decide whether to submit the request.

[0111] Furthermore, if the prediction result is that the request will time out, the request processing is abandoned.

[0112] In this embodiment, when multiple non-IP firewalls communicate with the management center, the management center uses queues or polling to limit the flow and balance the load of the management center. This prevents some non-IP firewalls from making excessive requests or occupying too many resources of the management center, causing other non-IP firewalls to be unable to communicate or respond in a timely manner. This prevents system crashes or performance degradation caused by too many requests being sent to the management center at the same time, improves the stability and reliability of the entire system, enables requests to be properly scheduled and processed, improves the performance and response speed of the system, and reduces delays and waiting times caused by too many requests. By setting a flow limiting strategy, abnormal requests, duplicate requests, etc. can be filtered out, thereby improving the security of the management center.

[0113] Steps S101 to S103 shown in the embodiment of the present application, when multiple non-IP firewalls communicate with the management center, the management center uses queues or polling to limit the flow, ensuring the rational use and stability of resources; obtaining the policy synchronization mode; if the policy synchronization mode is the upload and download mode, the non-IP firewall obtains the pre-stored policy and generates the current unique identification code according to the policy, sends the current unique identification code to the management center, obtains the policy data in the database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, sends the policy data to the non-IP firewall through the management center, and applies the policy data through the non-IP firewall to realize the automatic application of policy data, thereby improving the efficiency and accuracy of network security management. The embodiment of the present application can maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system.

[0114] See also Figure 2 In some embodiments, the method of the present application may include but is not limited to steps S201 to S204:

[0115] Step S201, if the policy synchronization mode is the uplink mode, obtain the pre-stored policy through the non-IP firewall and generate the current unique identification code according to the policy, and send the current unique identification code to the management center;

[0116] In some embodiments, the present application does not impose any specific limitation on the generation of the unique identification code, which can be flexibly selected based on actual management and control needs.

[0117] In some embodiments, the unique identification code may be generated based on a preset (policy-unique identification code) form match, or may be generated using a preset generation algorithm.

[0118] Illustratively, the policy-unique identifier form is shown in Table 1.

[0119] Table 1

[0120]

[0121] Optionally, key parameters in the policy are encoded, such as policy type, target resource, effective time, etc. The parameters can be processed using a hash function or encryption algorithm to generate a fixed-length summary or hash value, and the generated unique identification code is saved in correspondence with the policy.

[0122] Furthermore, the policy data corresponding to the current unique identification code is obtained by storing the corresponding unique identification code, the policy and the current unique identification code.

[0123] Step S202, obtaining policy data from the database through the management center;

[0124] In some embodiments, the management center's policy data is stored in a database.

[0125] In some embodiments, the present application does not specifically limit the storage of policy data, and can be flexibly selected in combination with actual management and control needs. For example, policy data can be stored in a database, in a local file system or a network shared file system, or in a memory cache (such as Redis, Memcached).

[0126] It is understandable that the present application does not specifically limit the policy data, and it can be flexibly selected in combination with actual management and control needs. For example, the policy data can use a unique identification code, or can use complete policy data, or can use complete policy data and a unique identification code.

[0127] Exemplarily, when the policy data adopts complete policy data, a unique identification code is obtained according to the policy data.

[0128] Optionally, the unique identification code is sent to the non-IP firewall through the management center, and the non-IP firewall obtains and applies policy data based on the unique identification code and the (policy-unique identification code) form.

[0129] Step S203, if the unique identification code of the policy data is different from the current unique identification code, update the policy data in the management center database according to the current unique identification code;

[0130] In some embodiments, the unique identification code of the policy data is compared with the current unique identification code. If the unique identification code of the policy data is different from the current unique identification code, the policy data in the management center database is updated according to the current unique identification code.

[0131] Exemplarily, when the policy data in the management center database includes complete policy data, the complete policy data is obtained according to the current unique identification code, and the policy data in the management center database is updated according to the complete policy data and the current unique identification code.

[0132] Step S204, returning confirmation information through the management center, and receiving the confirmation information through the non-IP firewall.

[0133] Specifically, the confirmation information is used to confirm that the data has been correctly received.

[0134] In some embodiments, when the policy data in the management center database is updated according to the current unique identification code, the management center returns a confirmation message, and the non-IP firewall receives the confirmation message.

[0135] In steps S201 to S204 shown in the embodiment of the present application, if the policy synchronization mode is the uplink mode, the pre-stored policy is obtained through the non-IP firewall and the current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data of the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data of the management center database is updated according to the current unique identification code, and the confirmation information is returned through the management center. The confirmation information is received through the non-IP firewall. By automatically generating a unique identification code and interacting with the management center, the configuration management process of the non-IP firewall can be simplified. There is no need to manually make configuration changes on each device. Instead, the policy data is uniformly managed and issued through the management center, and real-time policy updates can be achieved to maintain the consistency of policy data. In addition, the use of unique identification codes for policy synchronization can bring higher security.

[0136] See also Figure 3 In some embodiments, the method of the present application may include but is not limited to steps S301 to S303:

[0137] Step S301, if the policy synchronization mode is the downlink mode, obtain the policy data in the database through the management center and send the policy data to the non-IP firewall;

[0138] It is understandable that the present application does not specifically limit the policy data, and it can be flexibly selected in combination with actual management and control needs. For example, the policy data can use a unique identification code, or can use complete policy data, or can use complete policy data and a unique identification code.

[0139] Step S302, applying the policy data through the non-IP firewall and returning confirmation information;

[0140] In some embodiments, if the policy data in the database does not include complete policy data, the complete policy data is obtained according to the unique identification code in the policy data.

[0141] In some embodiments, policy data is applied through a no-IP firewall and confirmation information is returned.

[0142] Step S303: receiving confirmation information through the management center.

[0143] See also Figure 4 In some embodiments, step S103 may include but is not limited to steps S401 to S404:

[0144] Step S401, if the policy synchronization mode is the uplink mode or the upload and download mode, and the management center is offline, the request is added to the no-IP firewall upload queue through the no-IP firewall;

[0145] Specifically, the non-IP firewall upload queue is a queue located at the non-IP firewall and used to store upload requests.

[0146] In some embodiments, if the policy synchronization mode is an uplink mode or an upload and download mode, and the management center is offline, the request cannot be sent to the management center, and the request is added to the no-IP firewall upload queue through the no-IP firewall.

[0147] Step S402, optimizing the non-IP firewall upload queue by performing polling once every preset time;

[0148] In some embodiments, the present application does not specifically limit the preset time, and it can be flexibly selected in combination with actual control needs. For example, the preset time can be set by the user or automatically calculated by the system.

[0149] For example, the preset time can be evaluated based on factors such as system load, network bandwidth, and the size of the upload queue. A shorter preset time can provide faster request processing speed, but may increase system burden and network pressure, while a longer preset time can reduce system burden but may cause delays.

[0150] In some embodiments, a polling operation is triggered at preset intervals by a timer or a timer, and the timer may be system-level or a separate timer for a non-IP firewall upload queue.

[0151] In some embodiments, the non-IP firewall upload queue can be optimized by setting priorities, and different processing priorities can be assigned to different types of requests to ensure that important requests can be processed as quickly as possible.

[0152] In some embodiments, the no-IP firewall upload queue may be optimized by dynamically adjusting the length of the queue.

[0153] In this embodiment, by adding the request to the upload queue and using the polling mechanism, the utilization of network resources can be optimized. When the management center is offline, the non-IP firewall will not frequently try to connect to the management center, reducing unnecessary network communication overhead.

[0154] Step S403, continue to run according to the last communication configuration stored through the non-IP firewall;

[0155] In some embodiments, the No-IP firewall continues to operate according to stored policy data.

[0156] Step S404, until the management center comes online, the requests in the non-IP firewall upload queue are uploaded.

[0157] In some embodiments, when the management center comes online, the requests in the no-IP firewall upload queue are uploaded to the management center.

[0158] In some embodiments, if no confirmation information is received from the management center, the request is resent.

[0159] In steps S401 to S404 shown in the embodiment of the present application, if the policy synchronization mode is the uplink mode or the upload and download mode, and the management center is offline, the request is added to the upload queue of the non-IP firewall through the non-IP firewall; the upload queue of the non-IP firewall is optimized by polling once at preset intervals; the non-IP firewall continues to operate according to the last stored communicative configuration; until the management center is online, the request in the upload queue of the non-IP firewall is uploaded, so that the management center is offline, the non-IP firewall can still work normally, ensure the continuous operation of the network, and the equipment can still be protected. Optimizing the upload queue of the non-IP firewall can improve network transmission efficiency, reduce transmission delays, improve network performance, ensure the integrity and accuracy of requests, and promptly restore synchronization between the management center and the non-IP firewall to ensure network security and normal operation.

[0160] See also Figure 5 In some embodiments, step S103 may also include but is not limited to steps S501 to S503:

[0161] Step S501, if the policy synchronization mode is the downlink mode and no IP firewall is offline, the request is added to the downlink queue through the management center;

[0162] Specifically, the downlink queue is a queue located in the management center and used to store downlink (sending) requests.

[0163] Step S502, optimizing the downlink queue by performing polling once every preset time;

[0164] In some embodiments, the present application does not specifically limit the preset time, and it can be flexibly selected in combination with actual control needs. For example, the preset time can be set by the user or automatically calculated by the system.

[0165] Step S503, until no IP firewall comes online, the requests in the downlink queue are sent down.

[0166] In some embodiments, when the non-IP firewall comes online, the requests in the downstream queue are sent down to the non-IP firewall.

[0167] In some embodiments, if no confirmation information is received from the non-IP firewall, the request is resent.

[0168] In steps S501 to S503 shown in the embodiment of the present application, if the policy synchronization mode is the downlink mode and the non-IP firewall is offline, the request is added to the downlink queue through the management center; polling is performed once at preset intervals to optimize the downlink queue; until the non-IP firewall is online, the request in the downlink queue is sent down to ensure the continuous operation of the network. Optimizing the downlink queue can improve network transmission efficiency, reduce transmission delays, improve network performance, ensure the integrity and accuracy of the request, and promptly restore synchronization between the management center and the non-IP firewall to ensure network security and normal operation.

[0169] See also Figure 6 In some embodiments, the present application method is applied to the non-IP firewall 602 and the management center 601, and the present application method includes the following steps:

[0170] Establish a connection with the management center 601 by using the IP-free firewall 602 of the protected device;

[0171] Get the policy synchronization mode;

[0172] The strategy synchronization mode includes an upload and download mode, a downlink mode, and an uplink mode. Figure 7 shown.

[0173] If the policy synchronization mode is the upload and download mode, the non-IP firewall 602 generates a current unique identification code according to the policy, sends the current unique identification code to the management center 601, and obtains the policy data in the database through the management center 601. If the unique identification code of the policy data is different from the current unique identification code, the policy data is sent to the non-IP firewall 602 through the management center 601, and the policy data is applied through the non-IP firewall 602;

[0174] If the policy synchronization mode is the uplink mode, the non-IP firewall 602 generates a current unique identification code according to the policy, sends the current unique identification code to the management center 601, obtains the policy data of the database through the management center 601, if the unique identification code of the policy data is different from the current unique identification code, updates the policy data of the management center 601 database according to the current unique identification code, returns confirmation information through the management center 601, receives the confirmation information through the non-IP firewall 602, and the confirmation information is used to confirm that the data has been correctly received;

[0175] If the policy synchronization mode is the downlink mode, the policy data in the database is obtained through the management center 601, the policy data is sent to the non-IP firewall 602, the policy data is applied through the non-IP firewall 602 and confirmation information is returned, and the confirmation information is received through the management center 601;

[0176] If the policy synchronization mode is the uplink mode, the request is received through the management center 601 and added to the uplink queue; the length of the uplink queue is dynamically adjusted by monitoring the load conditions, which include the number of requests, response time, CPU utilization, memory utilization, hard disk utilization, and CPU temperature;

[0177] If the policy synchronization mode is the downlink mode, a request is created through the management center 601 and the request is added to the downlink queue; the length of the downlink queue is dynamically adjusted by monitoring the load;

[0178] When multiple non-IP firewalls 602 communicate with the management center 601, if the policy synchronization mode is the uplink mode or the upload and download mode, and the management center 601 is offline, the request is added to the upload queue of the non-IP firewall 602 through the non-IP firewall 602, and the upload queue of the non-IP firewall 602 is optimized by polling once every preset time, and the non-IP firewall 602 continues to run according to the last stored communicable configuration until the management center 601 is online, and the request in the upload queue of the non-IP firewall 602 is uploaded;

[0179] When multiple non-IP firewalls 602 communicate with the management center 601, if the policy synchronization mode is the downlink mode and the non-IP firewall 602 is offline, the request is added to the downlink queue through the management center 601, and polling is performed every preset time to optimize the downlink queue until the non-IP firewall 602 is online and the request in the downlink queue is sent down;

[0180] Before the upstream or downstream queue submits the request, predict whether the request will time out;

[0181] If the prediction result is that the request will time out, the request will be abandoned;

[0182] In response to the first instruction, the CPU utilization, memory utilization, hard disk utilization and CPU temperature of the management center 601 are displayed in the center operation status area;

[0183] Among them, the management center 601 includes a center status page, a terminal status page and a historical policy page. The center status page includes a center operation status area, the terminal status page includes a terminal operation status area, the historical policy page includes a policy list area, a list template area and a blacklist area, and the first instruction includes an instruction to open the center status page.

[0184] For example, the center status page diagram is as follows: Figure 8 shown.

[0185] In response to the second instruction, the CPU utilization, memory utilization, number of effective policies and policy interception of the day of the non-IP firewall 602 are displayed through the terminal operation status area;

[0186] The second instruction includes an instruction to open the terminal status page. For example, the terminal status page diagram is as follows: Fig. 9 shown.

[0187] In response to the third instruction, the historical policies of the non-IP firewall 602 are displayed in the policy list area, and the historical policies include policy size, creation user and creation time;

[0188] The policy size is the policy size, which indicates the size of the storage actually occupied by the policy. The third instruction includes an instruction to open the historical policy page. For example, the historical policy page diagram is as follows: Fig.10 shown.

[0189] In response to the fourth instruction, the list name, list reference object, list IP address, list port address and list activation status of the current historical policy are displayed in the list template area.

[0190] Specifically, the whitelist name, list name, asset access status, access asset status, corresponding non-IP firewall name and whitelist activation status are displayed in the whitelist area; the graylist name, list name, asset access status, access asset status, corresponding non-IP firewall name and graylist activation status are displayed in the graylist area; the blacklist name, list name, asset access status, access asset status, corresponding non-IP firewall name and blacklist activation status are displayed in the blacklist area.

[0191] Among them, the fourth instruction includes the selection instruction of the historical policy in the historical policy page, and the list name column displays the name of the list used by the historical policy. The list name can be a user-defined identifier for identifying different lists. The list IP address column displays the IP address in the list. The IP address can be a specific IP address to be blocked or allowed to pass. The list port address column displays the port address in the list. The port address can be a specific port address to be blocked or allowed to pass. The list enablement status column displays whether the list is enabled or disabled. If the list is enabled, it means that the policy is using the list for access control. If the list is disabled, it means that the policy no longer uses the list, and the corresponding access control rules will no longer take effect. The asset access status column displays the network access status of the protected device to the entities or resources listed in the list. The access asset status column displays the status of the entities or resources listed in the list accessing the protected device. The SA-NAC column displays the name of the non-IP firewall. For example, the schematic diagram of the historical policy page is as follows Fig.11 shown.

[0192] Log data is generated and processed through the non-IP firewall 602 and sent to the management center 601.

[0193] Among them, the log information that needs to be recorded, such as system operation status, user operations, error information, etc., is determined through the non-IP firewall 602; the log recording strategy is configured according to the log information that needs to be recorded through the non-IP firewall 602, such as recording time range, log level, filtering conditions, etc.; the generated log data is stored in the designated storage device through the non-IP firewall 602 and sent to the management center 601.

[0194] The non-IP firewall control method proposed in the present application, when multiple non-IP firewalls communicate with the management center, the management center uses queues or polling to limit the flow, ensuring the rational use and stability of resources; obtaining the policy synchronization mode; if the policy synchronization mode is the upload and download mode, the non-IP firewall obtains the pre-stored policy and generates the current unique identification code according to the policy, sends the current unique identification code to the management center, obtains the policy data in the database through the management center, if the unique identification code of the policy data is different from the current unique identification code, sends the policy data to the non-IP firewall through the management center, applies the policy data through the non-IP firewall, realizes the automatic application of policy data, and improves the efficiency and accuracy of network security management. The embodiment of the present application can maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system.

[0195] See also Fig.12 The embodiment of the present application also provides a non-IP firewall control device, which can implement the above-mentioned non-IP firewall control method, and the device includes:

[0196] The policy synchronization module 1201 is used to obtain a policy synchronization mode, where the policy synchronization mode includes an upload and download mode;

[0197] The upload and download module 1202 is used for obtaining the pre-stored policy through the non-IP firewall and generating a current unique identification code according to the policy if the policy synchronization mode is the upload and download mode, sending the current unique identification code to the management center, obtaining the policy data in the database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, sending the policy data to the non-IP firewall through the management center, and applying the policy data through the non-IP firewall;

[0198] The flow limiting module 1203 is used to limit the flow by using a queue or polling method through the management center when multiple non-IP firewalls communicate with the management center.

[0199] The specific implementation of the non-IP firewall control device is basically the same as the specific implementation example of the above-mentioned non-IP firewall control method, and will not be repeated here.

[0200] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0201] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned non-IP firewall management and control method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0202] The contents of the method embodiments of the present invention are all applicable to the electronic device embodiments. The functions specifically implemented by the electronic device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0203] See also Fig.13 , Fig.13 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0204] The processor 1301 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0205] The memory 1302 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1302 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1302, and the processor 1301 calls and executes the non-IP firewall control method of the embodiment of this application;

[0206] Input / output interface 1303, used to implement information input and output;

[0207] The communication interface 1304 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0208] A bus 1305 that transmits information between the various components of the device (e.g., the processor 1301, the memory 1302, the input / output interface 1303, and the communication interface 1304);

[0209] The processor 1301 , the memory 1302 , the input / output interface 1303 and the communication interface 1304 are connected to each other in communication within the device via a bus 1305 .

[0210] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned non-IP firewall management and control method is implemented.

[0211] The contents of the method embodiments of the present invention are all applicable to the storage medium embodiments. The functions specifically implemented by the storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0212] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0213] The non-IP firewall control method, device, electronic device and storage medium provided by the embodiment of the present application, when multiple non-IP firewalls communicate with the management center, the management center uses queues or polling to limit the flow, ensuring the rational use and stability of resources; obtaining the policy synchronization mode; if the policy synchronization mode is the upload and download mode, the non-IP firewall obtains the pre-stored policy and generates the current unique identification code according to the policy, sends the current unique identification code to the management center, obtains the policy data in the database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, sends the policy data to the non-IP firewall through the management center, and applies the policy data through the non-IP firewall to realize the automatic application of policy data, thereby improving the efficiency and accuracy of network security management. The embodiment of the present application can maintain the consistency of policy information, prevent the system from being overloaded, and improve the stability and reliability of the system.

[0214] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0215] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0216] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0217] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0218] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0219] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0220] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0221] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0222] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0223] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0224] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for controlling a non-IP firewall, characterized in that: The method comprises: Acquire a policy synchronization mode, wherein the policy synchronization mode includes an upload and download mode, a downlink mode, and an uplink mode; If the policy synchronization mode is the upload and download mode, the pre-stored policy is obtained through the non-IP firewall and a current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data in the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data is sent to the non-IP firewall through the management center, and the policy data is applied through the non-IP firewall; If the policy synchronization mode is the uplink mode, the pre-stored policy is obtained through the non-IP firewall and a current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data of the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data of the management center database is updated according to the current unique identification code, and confirmation information is returned through the management center, and the confirmation information is received through the non-IP firewall, and the confirmation information is used to confirm that the data has been correctly received; If the policy synchronization mode is the downlink mode, the policy data in the database is obtained through the management center, the policy data is sent to the non-IP firewall, the policy data is applied through the non-IP firewall and confirmation information is returned, and the confirmation information is received through the management center; When multiple non-IP firewalls communicate with the management center, the management center uses queues or polling to limit the flow; The method of limiting the flow by a queue or polling method by the management center includes: If the policy synchronization mode is the uplink mode, receiving the request through the management center, adding the request to the uplink queue; dynamically adjusting the length of the uplink queue by monitoring the load conditions, wherein the load conditions include the number of requests, response time, CPU utilization, memory utilization, hard disk utilization, and CPU temperature; If the policy synchronization mode is the downlink mode, creating a request through the management center, adding the request to the downlink queue; dynamically adjusting the length of the downlink queue by monitoring the load condition; If the policy synchronization mode is the uplink mode or the upload and download mode, and the management center is offline, the request is added to the upload queue of the no-IP firewall through the no-IP firewall, and the no-IP firewall upload queue is optimized by polling once every preset time, and the no-IP firewall is operated according to the last stored communicative configuration until the management center is online, and the request in the upload queue of the no-IP firewall is uploaded; If the policy synchronization mode is the downlink mode and the non-IP firewall is offline, the request is added to the downlink queue through the management center, and the downlink queue is optimized by polling once every preset time until the non-IP firewall is online and the requests in the downlink queue are sent down.

2. The method according to claim 1, characterized in that The method of limiting the flow by using a queue or polling method by the management center also includes: Before the uplink queue or the downlink queue submits the request, predicting whether the request will time out; If the prediction result is that the request will time out, the request is abandoned.

3. The method according to claim 1, characterized in that The management center includes a center status page, a terminal status page and a historical policy page, the center status page includes a center operation status area, the terminal status page includes a terminal operation status area, the historical policy page includes a policy list area, a list template area and a blacklist area, and the method further includes: In response to the first instruction, displaying the CPU utilization, memory utilization, hard disk utilization and CPU temperature of the management center through the center operation status area; In response to the second instruction, displaying the CPU utilization, memory utilization, number of effective policies and policy interception of the non-IP firewall through the terminal operation status area; In response to a third instruction, displaying the historical policies of the non-IP firewall in the policy list area, the historical policies including policy size, creation user and creation time; In response to the fourth instruction, the list name, list IP address and list activation status of the current historical policy are displayed in the list template area, and the blacklist name, list name, asset access status, access asset status and blacklist activation status are displayed in the blacklist area.

4. The method according to claim 1, characterized in that: The method further comprises: Establish a connection with the management center by using the IP-free firewall of the protected device; Log data is generated and processed through a non-IP firewall, and the log data is sent to the management center.

5. A distributed control device, characterized in that: The device comprises: A policy synchronization module, used to obtain a policy synchronization mode, wherein the policy synchronization mode includes an upload and download mode, a downlink mode, and an uplink mode; An upload and download module, which is used to obtain a pre-stored policy through a non-IP firewall and generate a current unique identification code according to the policy if the policy synchronization mode is the upload and download mode, send the current unique identification code to a management center, obtain policy data in a database through the management center, and if the unique identification code of the policy data is different from the current unique identification code, send the policy data to the non-IP firewall through the management center, and apply the policy data through the non-IP firewall; A current limiting module, used for limiting the current by using a queue or polling method through the management center when multiple non-IP firewalls communicate with the management center; The device is also used for: If the policy synchronization mode is the uplink mode, the pre-stored policy is obtained through the non-IP firewall and a current unique identification code is generated according to the policy, the current unique identification code is sent to the management center, and the policy data of the database is obtained through the management center. If the unique identification code of the policy data is different from the current unique identification code, the policy data of the management center database is updated according to the current unique identification code, and confirmation information is returned through the management center, and the confirmation information is received through the non-IP firewall, and the confirmation information is used to confirm that the data has been correctly received; If the policy synchronization mode is the downlink mode, the policy data in the database is obtained through the management center, the policy data is sent to the non-IP firewall, the policy data is applied through the non-IP firewall and confirmation information is returned, and the confirmation information is received through the management center; The current limiting module is also used for: If the policy synchronization mode is the uplink mode, receiving the request through the management center, adding the request to the uplink queue; dynamically adjusting the length of the uplink queue by monitoring the load conditions, wherein the load conditions include the number of requests, response time, CPU utilization, memory utilization, hard disk utilization, and CPU temperature; If the policy synchronization mode is the downlink mode, creating a request through the management center, adding the request to the downlink queue; dynamically adjusting the length of the downlink queue by monitoring the load condition; If the policy synchronization mode is the uplink mode or the upload and download mode, and the management center is offline, the request is added to the upload queue of the no-IP firewall through the no-IP firewall, and the no-IP firewall upload queue is optimized by polling once every preset time, and the no-IP firewall is operated according to the last stored communicative configuration until the management center is online, and the request in the upload queue of the no-IP firewall is uploaded; If the policy synchronization mode is the downlink mode and the non-IP firewall is offline, the request is added to the downlink queue through the management center, and the downlink queue is optimized by polling once every preset time until the non-IP firewall is online and the requests in the downlink queue are sent down.

6. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the non-IP firewall management and control method described in any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the non-IP firewall management and control method described in any one of claims 1 to 4 is implemented.

Images