Method, device and storage medium for generating access configuration policy

Abstract

The application discloses a method and device for generating an access configuration strategy, an equipment and a storage medium, and relates to the technical field of computers. The technical scheme of the application is as follows: a service access configuration request is acquired. The service access configuration request comprises a source address, a destination address and a destination port. Based on a pre-generated access control relationship, access control data corresponding to the source address and access control data corresponding to the destination address are determined respectively. The access control relationship is used to represent the association relationship between a plurality of access control programs, and the access control data comprises the identification of at least one access control program in the plurality of access control programs. Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, an access configuration strategy is generated. The method for generating the access configuration strategy of the application improves the efficiency of generating the cloud platform access strategy.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for generating access configuration policies. Background Technology

[0002] With the continuous development of cloud computing technology, data center infrastructure is shifting towards cloud platform solutions, resulting in a unified resource pool for server resources that were traditionally distributed across various functional areas of the network. Since these server resources are deployed uniformly within a single area of ​​the cloud, without independent business zones for isolation, the traditional method of deploying firewalls between different business zones in the data center for access control is no longer sufficient to meet the access control requirements between cloud hosts.

[0003] To meet the access control requirements of cloud platforms, cloud platforms provide a variety of access control technologies (such as perimeter firewalls, virtual private clouds (VPCs), network access control lists (ACLs), and security groups) to build a security protection system at different levels, including the cloud platform level, subnet level, and host network interface card level.

[0004] Currently, cloud platform access policies typically require manual configuration. This is because configuring cloud platform access policies often involves configuring multiple levels of security controls, such as perimeter firewalls, network ACLs, and security groups, making the process complex, cumbersome, and inefficient. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for generating access configuration policies to improve the efficiency of generating cloud platform access policies. The technical solution of this application is as follows:

[0006] According to a first aspect of the embodiments of this application, a method for generating an access configuration policy is provided. The method includes: obtaining a service access configuration request. The service access configuration request includes a source address, a destination address, and a destination port. Based on a pre-generated access control relationship, access control data corresponding to the source address and access control data corresponding to the destination address are determined respectively. The access control relationship is used to characterize the association between multiple access control procedures, and the access control data includes the identifier of at least one of the multiple access control procedures. Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, an access configuration policy is generated.

[0007] In one possible implementation, the multiple access control procedures include: a perimeter firewall, a Virtual Private Cloud (VPC), a Network Access Control List (ACL), and a security group. The method further includes: obtaining access control information from the cloud platform, and based on this access control information, associating the identifiers of multiple access control procedures to obtain access control relationships. The access control information includes the identifier of the perimeter firewall and the corresponding cloud platform node identifier, the identifier of the VPC, the corresponding cloud platform node identifier, the identifier of the network ACL, the corresponding VPC identifier and address range, the identifier of the security group, the corresponding VPC identifier and address range.

[0008] In one possible implementation, the aforementioned "associating the identifiers of multiple access control procedures based on access control information to obtain access control relationships" includes: generating a first correspondence relationship based on the identifier of a network ACL and the address range corresponding to the network ACL identifier. The first correspondence relationship is used to characterize the association between the network ACL identifier and the address range. Generating a second correspondence relationship based on the identifier of a security group and the address range corresponding to the security group identifier. The second correspondence relationship is used to characterize the association between the security group identifier and the address range. Generating a third correspondence relationship based on the identifier of a border firewall, the cloud platform node identifier corresponding to the border firewall identifier, the VPC identifier, the cloud platform node identifier corresponding to the VPC identifier, the VPC identifier corresponding to the network ACL identifier, and the VPC identifier corresponding to the security group identifier. The third correspondence relationship is used to characterize the association between the border firewall identifier, the VPC identifier, the network ACL identifier, and the security group identifier. Based on the first, second, and third correspondence relationships, an access control relationship is obtained.

[0009] In one possible implementation, the first correspondence is a first multi-way tree, the second correspondence is a second multi-way tree, and the third correspondence is a third multi-way tree. The aforementioned "generating the first correspondence based on the network ACL identifier and the address range corresponding to the network ACL identifier" includes: generating a first multi-way tree based on the network ACL identifier and the address range corresponding to the network ACL identifier. The parent node of the first multi-way tree is the network ACL identifier, and the child nodes of the first multi-way tree are the address ranges corresponding to the network ACL identifiers. The aforementioned "generating a second correspondence based on the security group identifier and the address range corresponding to the security group identifier" includes: generating a second multi-branch tree based on the security group identifier and the address range corresponding to the security group identifier; the parent node of the second multi-branch tree is the security group identifier, and the child nodes of the second multi-branch tree are the address ranges corresponding to the security group identifier; generating a third multi-branch tree based on the identifier of the boundary firewall, the cloud platform node identifier corresponding to the boundary firewall identifier, the VPC identifier, the cloud platform node identifier corresponding to the VPC identifier, the network ACL identifier, the VPC identifier corresponding to the network ACL identifier, the security group identifier, and the VPC identifier corresponding to the security group identifier; the parent node of the third multi-branch tree is the boundary firewall identifier, the child nodes of the third multi-branch tree are the VPC identifier corresponding to the boundary firewall identifier, and the grandchild nodes of the third multi-branch tree are the network ACL identifier corresponding to the VPC identifier and the security group identifier.

[0010] In one possible implementation, the aforementioned "determining the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship" includes: searching for the identifier of the first network ACL corresponding to the source address from the first correspondence relationship, and searching for the identifier of the first security group corresponding to the source address from the second correspondence relationship. Based on the identifier of the first network ACL or the identifier of the first security group, searching for the identifier of the first VPC and the identifier of the first border firewall corresponding to the source address from the third correspondence relationship. Searching for the identifier of the second network ACL corresponding to the destination address from the first correspondence relationship, and searching for the identifier of the second security group corresponding to the destination address from the second correspondence relationship. Based on the identifier of the second network ACL or the identifier of the second security group, searching for the identifier of the second VPC and the identifier of the second border firewall corresponding to the destination address from the third correspondence relationship.

[0011] In one possible implementation, the aforementioned "generating an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address" includes: determining target access control data based on the access control data corresponding to the source address and the access control data corresponding to the destination address. The target access control data consists of access control program identifiers that differ between the access control data corresponding to the source address and the access control data corresponding to the destination address. Access control program identifiers include perimeter firewall identifiers, VPC identifiers, network ACL identifiers, and security group identifiers. An access configuration policy is then generated based on the target access control data.

[0012] In one possible implementation, the above-mentioned "generating access configuration policies based on target access control data" includes: generating a first access configuration policy when the identifier of the first security group corresponding to the source address and the identifier of the second security group corresponding to the destination address are different security group identifiers. The first access configuration policy is used to indicate the enabling of security group policies. Alternatively, generating a second access configuration policy when the identifier of the first network ACL corresponding to the source address and the identifier of the second network ACL corresponding to the destination address are different network ACL identifiers. The second access configuration policy is used to indicate the enabling of network ACL policies. Alternatively, generating a third access configuration policy when the identifier of the first border firewall corresponding to the source address and the identifier of the second border firewall corresponding to the destination address are different border firewall identifiers, and the identifier of the first VPC corresponding to the source address and the identifier of the second VPC corresponding to the destination address are different VPC identifiers. The third access configuration policy is used to indicate the enabling of border firewall policies.

[0013] In one possible implementation, the method further includes: generating an access configuration policy script based on the access configuration policy, and sending the access configuration policy script to the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address, so that the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address execute the access configuration policy script.

[0014] In one possible implementation, the service access configuration request also includes a port number. After obtaining the service access configuration request, the method further includes: determining whether the source address, destination address, and port number meet a preset format. The aforementioned "determining the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship" further includes: if the source address, destination address, and port number all meet the preset format, determining the access control data corresponding to the source address and the access control data corresponding to the destination address based on the access control relationship.

[0015] According to a second aspect of the embodiments of this application, an access configuration policy generation apparatus is provided. The apparatus includes an acquisition unit, a determination unit, and a generation unit. The acquisition unit is used to acquire a service access configuration request. The service access configuration request includes a source address, a destination address, and a destination port. The determination unit is used to determine access control data corresponding to the source address and access control data corresponding to the destination address based on pre-generated access control relationships. The access control relationships are used to characterize the association between multiple access control procedures, and the access control data includes the identifier of at least one of the multiple access control procedures. The generation unit is used to generate an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0016] In one possible implementation, the multiple access control procedures include: a perimeter firewall, a Virtual Private Cloud (VPC), a network ACL, and a security group. The access configuration policy generation device further includes: a processing unit. The acquisition unit is also used to acquire access control information from the cloud platform. The processing unit is used to associate the identifiers of multiple access control procedures based on the access control information to obtain access control relationships. The access control information includes the identifier of the perimeter firewall and the corresponding cloud platform node identifier, the identifier of the VPC, the corresponding cloud platform node identifier, the identifier of the network ACL, the corresponding VPC identifier and address range, the identifier of the security group, the corresponding VPC identifier and address range.

[0017] In one possible implementation, the processing unit is specifically configured to: generate a first correspondence based on the identifier of a network ACL and the address range corresponding to the network ACL identifier. The first correspondence is used to characterize the association between the network ACL identifier and the address range. Generate a second correspondence based on the identifier of a security group and the address range corresponding to the security group identifier. The second correspondence is used to characterize the association between the security group identifier and the address range. Generate a third correspondence based on the identifier of a perimeter firewall, the cloud platform node identifier corresponding to the perimeter firewall identifier, the identifier of a VPC, the cloud platform node identifier corresponding to the VPC identifier, the identifier of a network ACL, the VPC identifier corresponding to the network ACL identifier, the identifier of a security group, and the VPC identifier corresponding to the security group identifier. The third correspondence is used to characterize the association between the identifier of the perimeter firewall, the identifier of the VPC, the identifier of the network ACL, and the identifier of the security group. Based on the first, second, and third correspondences, an access control relationship is obtained.

[0018] In one possible implementation, the determining unit is specifically configured to: search for the identifier of a first network ACL corresponding to the source address from a first mapping relationship, and search for the identifier of a first security group corresponding to the source address from a second mapping relationship. Based on the identifier of the first network ACL or the identifier of the first security group, search for the identifier of a first VPC and the identifier of a first border firewall corresponding to the source address from a third mapping relationship. Search for the identifier of a second network ACL corresponding to the destination address from the first mapping relationship, and search for the identifier of a second security group corresponding to the destination address from the second mapping relationship. Based on the identifier of the second network ACL or the identifier of the second security group, search for the identifier of a second VPC and the identifier of a second border firewall corresponding to the destination address from the third mapping relationship.

[0019] In one possible implementation, the generation unit is further configured to: determine target access control data based on the access control data corresponding to the source address and the access control data corresponding to the destination address. The target access control data consists of access control program identifiers that differ between the access control data corresponding to the source address and the access control data corresponding to the destination address. Access control program identifiers include perimeter firewall identifiers, cloud platform VPC identifiers, network ACL identifiers, and security group identifiers. Based on the target access control data, an access configuration policy is generated.

[0020] In one possible implementation, the generation unit is specifically configured to: generate a first access configuration policy when the identifier of the first security group corresponding to the source address is different from the identifier of the second security group corresponding to the destination address. The first access configuration policy is used to instruct the enabling of a security group policy. Alternatively, generate a second access configuration policy when the identifier of the first network ACL corresponding to the source address is different from the identifier of the second network ACL corresponding to the destination address. The second access configuration policy is used to instruct the enabling of a network ACL policy. Alternatively, generate a third access configuration policy when the identifier of the first border firewall corresponding to the source address is different from the identifier of the second border firewall corresponding to the destination address, and the identifier of the first VPC corresponding to the source address is different from the identifier of the second VPC corresponding to the destination address. The third access configuration policy is used to instruct the enabling of a border firewall policy.

[0021] In one possible implementation, the access configuration policy generation apparatus further includes a sending unit. The generation unit is further configured to generate an access configuration policy script based on the access configuration policy. The sending unit is configured to send the access configuration policy script to the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address, so that the border firewall node and cloud platform node corresponding to the source address and the destination address execute the access configuration policy script.

[0022] In one possible implementation, the service access configuration request also includes a port number. After obtaining the service access configuration request, the determining unit is further configured to determine whether the source address, destination address, and port number meet a preset format. Specifically, the determining unit is further configured to: if the source address, destination address, and port number all meet the preset format, determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the access control relationship.

[0023] Thirdly, an electronic device is provided, comprising: a processor and a communication interface; the communication interface and the processor are coupled, the processor being used to run computer programs or instructions to implement the method for generating access configuration policies as described in the first aspect.

[0024] Fourthly, a computer-readable storage medium is provided, wherein when computer-executable instructions stored in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to execute the method for generating an access configuration policy as described in the first aspect.

[0025] Fifthly, a computer program product is provided, comprising computer instructions, which, when executed on an electronic device, cause the electronic device to perform a method for generating an access configuration policy as described in the first aspect.

[0026] This application provides a method for generating access configuration policies, offering the following advantages: Given business access requirements including source and destination addresses, based on pre-generated access control relationships, the method obtains the identifiers of the access control programs (e.g., border firewalls, VPCs, network ACLs, and security groups) corresponding to the source and destination addresses. This allows for the acquisition of secure access paths between the source and destination addresses. Furthermore, based on these access paths, an access configuration policy is generated. This enables automatic generation of access configuration policies upon receiving access requirements, eliminating the need for manual configuration and improving the efficiency of cloud platform access policy configuration.

[0027] It should be noted that the technical effects of any of the implementation methods in aspects two through five can be found in the technical effects of the corresponding implementation methods in aspect one, and will not be repeated here.

[0028] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.

[0030] Figure 1 This application provides a structural diagram of an access configuration policy generation system.

[0031] Figure 2 This is one of the structural diagrams of an electronic device provided in an embodiment of this application;

[0032] Figure 3 One of the flowcharts for a method of generating an access configuration policy provided in an embodiment of this application;

[0033] Figure 4 A schematic diagram of a network ACL multi-way tree provided for an embodiment of this application;

[0034] Figure 5 A schematic diagram of a security group multi-way tree provided for an embodiment of this application;

[0035] Figure 6 A schematic diagram of a boundary firewall, VPC, network ACL, and security group multi-way tree provided for embodiments of this application;

[0036] Figure 7 A structural diagram of a cloud platform architecture system provided in this application embodiment;

[0037] Figure 8 A second flowchart illustrating a method for generating an access configuration policy, provided in an embodiment of this application;

[0038] Figure 9 A schematic diagram of the structure of an access configuration policy generation device provided in an embodiment of this application;

[0039] Figure 10 This is a second structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0041] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0042] Before providing a detailed introduction to the transaction methods provided in this application, let me briefly introduce the relevant elements, application scenarios, and implementation environment involved in this application.

[0043] First, a brief introduction to the relevant elements involved in this application will be given.

[0044] Virtual Private Cloud (VPC): A logically isolated virtual network environment built for cloud resources such as cloud servers, which is configured and managed by the user. It aims to improve the security of user resources and simplify the user's network deployment.

[0045] Security Group (SG): This is a security service for cloud environments that provides network interface card-level protection for cloud hosts.

[0046] Network ACL (access control list): is a security service in cloud environments that provides subnet-level protection for cloud hosts.

[0047] Application Programming Interface (API): Also known as an application programming interface, it is the agreement that connects different components of a software system.

[0048] Boundary firewall: Based on traditional firewalls, it provides protection for north-south access traffic across cloud platforms and is deployed at the boundary of the cloud platform.

[0049] Secondly, a brief introduction to the application scenarios involved in this application will be given.

[0050] With the continuous development of cloud computing technology, data center infrastructure is shifting towards cloud platform solutions, resulting in a unified resource pool for server resources that were traditionally distributed across various functional areas of the network. Since these server resources are deployed uniformly within a single area of ​​the cloud, without independent business zones for isolation, the traditional method of deploying firewalls between different business zones in the data center for access control is no longer sufficient to meet the access control requirements between cloud hosts.

[0051] To meet the access control requirements of cloud platforms, cloud platforms provide a variety of access control technologies (such as perimeter firewalls, virtual private clouds (VPCs), network access control lists (ACLs), and security groups) to build a security protection system at different levels, including the cloud platform level, subnet level, and host network interface card level.

[0052] Currently, cloud platform access policies typically require manual configuration. Since configuring cloud platform access policies often involves configuring multiple levels of security controls such as boundary firewalls, network ACLs, and security groups, it is complex, cumbersome, and inefficient.

[0053] Specifically, with the continuous development and promotion of cloud computing technology in the data center field, large institutions (such as financial institutions) have largely shifted their infrastructure construction to cloud platform solutions. The server resources, originally distributed across various functional areas in traditional networks, have been transformed into a unified resource pool known as "a cloud." Since server resources are uniformly deployed within a single area of ​​the cloud, without independent business areas for isolation, traditional methods of deploying firewalls between different business areas in the data center for access control are no longer sufficient to meet the access control requirements between cloud hosts. Simultaneously, to meet the access control requirements of cloud platforms, cloud platforms provide various access control technologies, such as boundary firewalls, VPC isolation, network ACLs, and security groups, constructing a security protection system at the cloud platform level, subnet level, and host network interface card level. Furthermore, due to the construction of multi-active data centers, to meet disaster recovery and other related requirements, different data centers often use cloud platforms from different vendors with different architectures for deployment, resulting in a complex and diverse range of cloud platform access control technologies.

[0054] Currently, cloud platform access policies are typically configured manually. Manual configuration of cloud platform access policies presents the following problems: 1. It involves a large workload and long activation time, impacting development, testing, and production deployment efficiency. 2. As network scale expands, applications in different data centers need to access each other, significantly increasing the demand for policy activation. 3. Cloud platform configuration operations are inconsistent; different operations personnel may configure according to personal habits, making standardization difficult. 4. Policy activation often involves multi-level security controls such as boundary firewalls, network ACLs, and security groups, requiring configuration through multiple modules and pages, making policy configuration cumbersome and prone to errors and omissions during manual configuration. 5. Cloud platforms vary widely in type, version, and deployment method, resulting in significant differences in configuration methods and high learning and maintenance costs. Therefore, current cloud platform access policy configuration is complex, cumbersome, and inefficient.

[0055] To address the aforementioned issues, this application provides a method for generating access configuration policies. The method includes: obtaining a service access configuration request. The service access configuration request includes a source address, a destination address, and a destination port. Based on pre-generated access control relationships, the access control data corresponding to the source address and the access control data corresponding to the destination address are determined. The pre-generated access control relationships characterize the association between multiple access control procedures, and the access control data includes the identifier of at least one of the multiple access control procedures. Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, an access configuration policy is generated.

[0056] In this way, upon receiving business access requests including source and destination addresses, the system obtains the identifiers of the access control programs (e.g., border firewalls, VPCs, network ACLs, and security groups) corresponding to the source and destination addresses, based on pre-generated access control relationships. This allows for the acquisition of secure access paths between the source and destination addresses. Furthermore, based on these access paths, access configuration policies are generated. This enables the automatic generation of access configuration policies upon receiving access requests, eliminating the need for manual configuration and improving the efficiency of cloud platform access policy configuration.

[0057] Finally, a brief introduction is given to the implementation environment (implementation architecture) involved in the method provided in this application.

[0058] Figure 1 This is the implementation architecture diagram of this application. Figure 1 This illustration shows a structural diagram of an access configuration policy generation system provided in an embodiment of this application. The access configuration policy generation system 100 may include: an electronic device 101, a data center (in... Figure 1 The example shows data center 1 and data center 2 (in actual applications, there may be more or fewer data centers) and a cloud platform (in... Figure 1 The example illustrates cloud platform 1, cloud platform 2, cloud platform 3, and cloud platform 4. Cloud platform 1 and cloud platform 2 are located in data center 1, and cloud platform 3 and cloud platform 4 are located in data center 2. In practical applications, a data center may include more or fewer cloud platforms. Terminal device 101 is connected to data center 1 and data center 2 respectively.

[0059] Electronic device 101 is used to acquire service access configuration requests including source and destination addresses, and based on pre-generated access control relationships, determine the access control data corresponding to the source address and the access control data corresponding to the destination address, respectively. Electronic device 101 is also used to generate access configuration policies based on the access control data corresponding to the source and destination addresses.

[0060] In some embodiments, the electronic device 101 generates a service access configuration request in response to a service access configuration operation, provided that the user has input service access configuration data. In other embodiments, the electronic device 101 receives a service access configuration request sent by a terminal device and obtains the service access configuration request.

[0061] Electronic device 101 is also used to determine the configuration node based on the access control data corresponding to the source address and the access control data corresponding to the destination address, and to send the access configuration policy to the configuration node.

[0062] For example, electronic device 101 determines the configuration nodes as the first cloud platform node in cloud platform 1 and the second cloud platform node in cloud platform 2, and sends access configuration policies to the first cloud platform node and the second cloud platform node.

[0063] Electronic device 101 is equipped with multiple configuration resolvers. Each configuration resolver is used for a specific brand of firewall and cloud platform node.

[0064] The electronic device 101 is also used to determine the configuration resolver corresponding to the configuration node when generating an access configuration policy, and to generate an access configuration policy script corresponding to the access configuration policy based on the configuration resolver. Furthermore, the electronic device 101 is also used to display the access configuration policy script and, in response to a configuration confirmation operation, to send the access configuration policy script to the configuration node.

[0065] In some embodiments, the electronic device 101 sends an access configuration policy script to the administrator device to push the access configuration policy script to the operation and maintenance personnel, and sends the access configuration policy script to the configuration node upon receiving a configuration confirmation message from the administrator device.

[0066] In some embodiments, when the electronic device 101 sends an access configuration policy script to the configuration node, it collects the execution process and results of the access configuration policy script in real time or periodically, and saves the execution process and results. If the access configuration policy script is sent successfully, a script sending success message is generated; if the access configuration policy script is sent abnormally, the configuration of the access configuration policy script is terminated. Reasons for sending abnormalities include, but are not limited to, cloud platform unreachability or device login authentication failure.

[0067] In some embodiments, the electronic device 101 includes a storage unit. The storage unit is used to store access control information of the cloud platform.

[0068] For example, the storage unit of electronic device 101 stores all access control information in cloud platform 1, cloud platform 2, cloud platform 3 and cloud platform 4.

[0069] In some implementations, the access configuration policy generation system 100 can be an application system of one organization or multiple organizations.

[0070] The electronic device 101 can be a standalone server or a server cluster consisting of multiple servers. This application embodiment does not limit the scope of the electronic device 101.

[0071] In some embodiments, such as Figure 2 As shown, an electronic device 101 is illustrated. The electronic device 101 includes a requirement input unit 201, a configuration acquisition unit 202, a requirement analysis unit 203, a configuration generation unit 204, and a configuration distribution unit 205. The configuration acquisition unit 202 is connected to both the requirement input unit 201 and the requirement analysis unit 203. The configuration generation unit 204 is connected to both the requirement analysis unit 203 and the configuration distribution unit 205.

[0072] The demand input unit 201 is used to obtain service access configuration requests including source address, destination address and port information, and to perform format compliance checks on the source address, destination address and port information.

[0073] The data acquisition unit 202 is configured to collect information on the border firewall, cloud platform VPC, network ACL, and security groups. Access control information includes border firewall information, cloud platform VPC information, network ACL information, and security group information. Border firewall information includes the border firewall identifier and the corresponding cloud platform node identifier. VPC information includes the VPC identifier and the corresponding cloud platform node identifier. Network ACL information includes the network ACL identifier and the corresponding VPC identifier and address range (or address segment). Security group information includes the security group identifier and the corresponding VPC identifier and address range.

[0074] The configuration acquisition unit 202 is also used to generate pre-generated access control relationships based on the cloud platform's boundary firewall information, VPC information, network ACL information, and security group information. These pre-generated access control relationships represent the associations between the cloud platform's VPCs, network ACLs, security groups, and boundary firewalls. The pre-generated access control relationships can be in tabular or multi-branch tree form; this embodiment does not limit the specific form.

[0075] In some embodiments, the configuration acquisition unit 202 generates a first multi-way tree based on the network ACL identifier and the address range corresponding to the network ACL identifier, and generates a second multi-way tree based on the security group identifier and the address range corresponding to the security group identifier. The configuration acquisition unit 202 generates a third multi-way tree based on the perimeter firewall information, VPC information, network ACL information, and security group information, and obtains the pre-generated access control relationship based on the first multi-way tree, the second multi-way tree, and the third multi-way tree.

[0076] In some embodiments, security group information can be security group information. Network ACL information can be network ACL information.

[0077] The requirements analysis unit 203 is used to determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship.

[0078] In some embodiments, the requirements analysis unit 203 determines the network ACL identifiers corresponding to the source address and the destination address based on a first multi-way tree, and determines the security group identifiers corresponding to the source address and the destination address based on a second multi-way tree. Further, the requirements analysis unit 203 determines the border firewall and VPC corresponding to the source address and the destination address based on the network ACL identifiers and group identifiers corresponding to the source address and the destination address, respectively, and the third multi-way tree.

[0079] The configuration generation unit 204 is used to generate an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address, and to determine the configuration node based on the access configuration policy.

[0080] Configuration distribution unit 205 is used to send access configuration policies to configuration nodes.

[0081] Specifically, configuration distribution unit 205 is used to send access configuration policies to the target boundary firewall, the target network ACL configuration module, and the target host group configuration module.

[0082] For ease of understanding, the method for generating access configuration policies provided in this application will be described in detail below with reference to the accompanying drawings.

[0083] Figure 3 This is a flowchart illustrating a method for generating an access configuration policy according to an exemplary embodiment. Figure 3 As shown, the method for generating this access configuration policy includes the following steps: S301-S303.

[0084] S301, Obtain the business access configuration request.

[0085] The business access configuration request includes the source address, destination address, and destination port.

[0086] In some embodiments, an electronic device receives a service access configuration request sent by a terminal device to obtain the service access configuration request.

[0087] In other embodiments, the electronic device displays a first interface and, in response to a request operation following user input of service access configuration data, obtains a service access configuration request.

[0088] S302. Based on the pre-generated access control relationship, determine the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0089] The access control relationship is used to characterize the association between multiple access control procedures, and the access control data includes the identifier of at least one of the multiple access control procedures.

[0090] As one possible approach, the electronic device performs a format check on the source and destination addresses to determine whether their formats meet a preset format. If the source and destination addresses meet the preset format, the electronic device determines the access control data corresponding to the source address and the access control data corresponding to the destination address, based on pre-generated access control relationships.

[0091] In some embodiments, the formatting check includes the format of the destination address and source address, as well as the address range. If the format or address range of the destination address and source address is abnormal, the generation of the service access configuration policy is terminated. If the service access configuration request also includes port information, then the port information is formatted.

[0092] As another possible approach, the electronic device, upon obtaining the source address and destination address, determines the access control data corresponding to the source address and the access control data corresponding to the destination address based on a pre-generated access control relationship.

[0093] In some embodiments, the pre-generated access control relationship is in the form of a preset control information relationship table. The electronic device searches for the first access control data corresponding to the source address from the preset control information relationship table data based on the source address, and searches for the second access control data corresponding to the destination address from the preset control information relationship table data based on the destination address.

[0094] In some implementations, the pre-generated access control relationships are in the form of a multi-way tree. The electronic device searches for the first access control data corresponding to the source address in the multi-way tree data based on the source address, and searches for the second access control data corresponding to the destination address in the multi-way tree data based on the destination address.

[0095] The specific implementation steps for this step can be found in the subsequent steps, and will not be repeated here.

[0096] S303. Generate an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0097] In some embodiments, target access control data is determined based on the access control data corresponding to the source address and the access control data corresponding to the destination address. The target access control data consists of access control program identifiers that differ between the access control data corresponding to the source address and the access control data corresponding to the destination address. Access control program identifiers include perimeter firewall identifiers, cloud platform VPC identifiers, network ACL identifiers, and security group identifiers. Based on the target access control data, an access configuration policy is generated.

[0098] For example, if the first border firewall corresponding to the source address and the second border firewall corresponding to the destination address are different border firewalls, the first network ACL and the second network ACL are different network ACLs, and the first security group and the second security group are different security groups, an access configuration policy is generated. This access configuration policy is used to instruct the border firewalls, enable the security groups, and configure the network ACLs.

[0099] The access configuration policy in this application embodiment is used to indicate the activation of the target security control function. The target security control function is the security control function corresponding to different access control program identifiers in the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0100] The specific implementation steps for this step can be found in the subsequent steps, and will not be repeated here.

[0101] The access configuration policy generation method provided in this application has the following beneficial effects: When business access requirements, including source and destination addresses, are obtained, based on pre-generated access control relationships, the identifiers of the access control programs (e.g., border firewalls, VPCs, network ACLs, and security groups) corresponding to the source address and the destination address are obtained. Thus, secure access paths between the source and destination addresses are obtained. Furthermore, based on the access paths of the source and destination addresses, an access configuration policy is generated. Therefore, access configuration policies can be automatically generated upon obtaining access requirements, eliminating the need for manual configuration and improving the efficiency of cloud platform access policy configuration.

[0102] In one design, to quickly generate access configuration policies, the access configuration policy generation method provided in this application embodiment further includes: S304-S305.

[0103] S304. Obtain access control information from the cloud platform.

[0104] The access control information includes the identifier of the border firewall, the cloud platform node identifier corresponding to the border firewall identifier, the identifier of the VPC, the cloud platform node identifier corresponding to the VPC identifier, the identifier of the network ACL, the VPC identifier and address range corresponding to the network ACL identifier, the identifier of the security group, the VPC identifier and address range corresponding to the security group identifier.

[0105] In some embodiments, electronic devices obtain access control information from the cloud platform by calling the cloud platform's API interface.

[0106] For example, taking three cloud platforms—Cloud Platform 1, Cloud Platform 2, and Cloud Platform 3—as an example, the electronic device obtains access control information for Cloud Platform 1 by calling its API interface. The electronic device obtains access control information for Cloud Platform 2 by calling its API interface. Finally, the electronic device obtains access control information for Cloud Platform 3 by calling its API interface.

[0107] In other embodiments, the electronic device obtains access control information of the cloud platform from the storage unit.

[0108] It should be noted that in the embodiments of this application, S304 can be before or after S301. The embodiments of this application do not limit this.

[0109] S305. Based on access control information, associate the identifiers of multiple access control procedures to obtain access control relationships.

[0110] In some embodiments, when an electronic device obtains access control information, it associates the identifier of the boundary firewall, the cloud platform node identifier corresponding to the boundary firewall identifier, the VPC identifier, the cloud platform node identifier corresponding to the VPC identifier, the network ACL identifier, the VPC identifier corresponding to the network ACL identifier and its address range, the security group identifier, the VPC identifier corresponding to the security group identifier and its address range, and generates a control information relationship table to obtain a preset control information relationship table. The control information relationship table is used to represent the association relationship between the boundary firewall, VPC, network ACL, security group, and address range.

[0111] In some embodiments, when an electronic device obtains access control information, it associates the identifier of the perimeter firewall, the cloud platform node identifier corresponding to the perimeter firewall identifier, the VPC identifier, the cloud platform node identifier corresponding to the VPC identifier, the network ACL identifier, the VPC identifier corresponding to the network ACL identifier and the address range, the security group identifier, the VPC identifier corresponding to the security group identifier and the address range, to generate an access control multi-way tree. The access control multi-way tree represents the association relationships between the perimeter firewall, VPC, network ACL, security group, and address range. The first-level nodes in the access control multi-way tree are the perimeter firewall, the second-level nodes are the VPC, the third-level nodes are the network ACL and security group, and the fourth-level nodes are the address range.

[0112] In some embodiments, when an electronic device obtains access control information, it generates a first multi-way tree based on the identifier of the network ACL and the address range corresponding to the network ACL identifier. The first multi-way tree is used to represent the association between the network ACL and the address range. Then, based on the identifier of the security group and the address range corresponding to the security group identifier, a second multi-way tree is generated. The second multi-way tree is used to represent the association between the security group and the address range. The electronic device generates a third multi-way tree based on the perimeter firewall information, VPC information, network ACL information, and security group information, and obtains the pre-generated access control relationship based on the first, second, and third multi-way trees.

[0113] Understandably, electronic devices collect information from cloud platform VPCs, network ACLs, security groups, and perimeter firewalls, and generate pre-generated access control relationships to obtain the correspondence between VPCs, network ACLs, security groups, and perimeter firewalls. Thus, when it is necessary to generate access configuration policies, based on the pre-generated access control relationships, the access control data corresponding to the source address and destination address can be quickly determined, thereby quickly generating access configuration policies.

[0114] In one design, to quickly generate access configuration policies, the aforementioned S305 includes: S3051-S3054.

[0115] S3051. Generate a first correspondence based on the network ACL identifier and the address range corresponding to the network ACL identifier.

[0116] The first correspondence is used to characterize the association between the network ACL and the address range.

[0117] In some embodiments, the electronic device obtains each network ACL and the address range corresponding to each network ACL, and generates a first multi-way tree.

[0118] For example, Figure 4 This shows a first-order multi-way tree. Figure 4 As shown in the diagram, cloud platform A is the root of the first multi-way tree, and ACL1, ACL12, and ACL13 are the first-level leaf nodes of the first multi-way tree. Address sets A, B, C, D, E, F, G, H, I, J, K, and L are the second-level leaf nodes of the first multi-way tree. Address sets A, B, C, and D are associated with ACL1; address sets E, F, G, and H are associated with ACL12; and address sets I, J, K, and L are associated with ACL13.

[0119] It should be noted that a cloud platform can create one or more network ACLs simultaneously. An address range under a network ACL can be associated with one or more address sets. In practical applications, the number of first-level and second-level leaf nodes in the first multi-way tree can be fewer or even fewer; this embodiment does not limit the number of first-level and second-level leaf nodes in the first multi-way tree.

[0120] In some embodiments, the electronic device obtains each network ACL and the address range corresponding to each network ACL, and generates a first mapping table.

[0121] Understandable, such as Figure 4 As shown, cloud platform A has one or more first-level leaf nodes under the root node. Each first-level leaf node represents a network ACL. Each first-level leaf node has one or more second-level leaf nodes. Each second-level leaf node represents an address set associated with this network ACL. By traversing the address sets of the second-level leaf nodes using the source address and destination address respectively, if the source address and destination address are associated with a specific address set, it can be determined that the source address and destination address are subject to access control by the network ACL corresponding to the parent node of this second-level leaf node, which is also the first-level leaf node.

[0122] S3052. Generate a second correspondence based on the security group identifier and the address range corresponding to the security group identifier.

[0123] The second correspondence is used to characterize the association between security groups and address ranges.

[0124] In some embodiments, the electronic device obtains each security group and the address range corresponding to each security group to generate a second multi-branch tree.

[0125] For example, Figure 5 This shows a second multi-way tree. (Example:) Figure 5As shown, cloud platform A is the root of the second multi-way tree, and SG1, SG12, and SG13 are the first-level leaf nodes of the second multi-way tree. Address sets M, N, O, P, R, S, T, U, V, W, X, and Y are the second-level leaf nodes of the second multi-way tree. Among them, address sets M, N, O, and P are associated with SG1; address sets R, S, T, and U are associated with SG12; and address sets V, W, X, and Y are associated with SG13.

[0126] It should be noted that a cloud platform can create one or more security groups simultaneously. An address range within a security group can be associated with one or more address sets. In practical applications, the number of first-level and second-level leaf nodes in the second multi-way tree can be fewer or even fewer; this embodiment does not limit the number of first-level and second-level leaf nodes in the second multi-way tree.

[0127] In other embodiments, the electronic device obtains each security group and the address range corresponding to each security group, and generates a second mapping table.

[0128] Understandable, Figure 5 In the context of cloud platform A, there are one or more first-level leaf nodes under the root node. Each first-level leaf node represents a security group. Each first-level leaf node has one or more second-level leaf nodes. Each second-level leaf node represents an address set associated with the address range of this security group. Using the source address and destination address in the access request, the address sets of the second-level leaf nodes are traversed. If the source address and destination address are associated with a specific address set, it can be determined that the source address and destination address are subject to access control by the security group corresponding to the parent node of this second-level leaf node, which is also the first-level leaf node.

[0129] S3053. Based on the identifier of the boundary firewall, the cloud platform node identifier corresponding to the identifier of the boundary firewall, the identifier of the VPC, the cloud platform node identifier corresponding to the identifier of the VPC, the identifier of the network ACL, the VPC identifier corresponding to the identifier of the network ACL, the identifier of the security group, and the VPC identifier corresponding to the identifier of the security group, a third correspondence relationship is generated.

[0130] The third correspondence is used to characterize the relationship between boundary firewalls, VPCs, network ACLs, and security groups.

[0131] In some embodiments, the electronic device obtains the identifier of the cloud platform from the first boundary firewall information, the identifier of the boundary firewall, and the identifier of the cloud platform and the identifier of the VPC from the first VPC information. If the identifiers of the cloud platforms are the same, it is determined that the identifier of the boundary firewall and the identifier of the VPC are associated, so as to establish an association relationship. The electronic device obtains the VPC, the network ACL and security group corresponding to the VPC from the VPC information, and establishes the association relationship to obtain a third multi-way tree.

[0132] For example, Figure 6 This shows a third multi-way tree. (Example:) Figure 6 As shown, organization A is the root of the third multi-way tree, and border firewalls A and B are the first-level leaf nodes of the third multi-way tree. VPC1, VPC2, VPC3, VPC4, VPC5, and VPC6 are the second-level leaf nodes of the third multi-way tree. ACL1, ACL2, ACL3, ACL4, ACL5, ACL6, ACL7, ACL8, ACL9, ACL10, ACL11, ACL12, SG1, SG2, SG3, SG4, SG5, SG6, SG7, SG8, ​​SG9, SG10, SG11, and SG12 are the third-level leaf nodes of the third multi-way tree.

[0133] Specifically, border firewall A is associated with VPC1, VPC2, and VPC3, while border firewall B is associated with VPC4, VPC5, and VPC6. VPC1 is associated with ACL1, ACL2, SG1, and SG2. VPC2 is associated with ACL3, ACL4, SG3, and SG4. VPC3 is associated with ACL5, ACL6, SG5, and SG6. VPC4 is associated with ACL7, ACL8, SG7, and SG8. VPC5 is associated with ACL9, ACL10, SG9, and SG10. VPC6 is associated with ACL11, ACL12, SG11, and SG12.

[0134] In some embodiments, the electronic device obtains the cloud platform identifier from the border firewall information, and the cloud platform identifier and VPC identifier from the VPC information. If the cloud platform identifiers are the same, it is determined that the border firewall identifier and the VPC identifier are associated, and an association relationship is established. The electronic device obtains the VPC, the corresponding network ACL, and the security group from the VPC information, and establishes the association relationship to obtain a third mapping table.

[0135] It should be noted that the first, second, and third correspondences can be in the form of a mapping table, a multi-branch tree, or other correspondence forms. This application does not limit these forms.

[0136] Understandable, combined Figure 6 Organization A is a root node with one or more first-level leaf nodes. Each first-level leaf node represents a cloud boundary firewall (and also a cloud platform instance). Each first-level leaf node has one or more second-level leaf nodes, each second-level leaf node represents a cloud platform VPC instance. Each second-level leaf node has one or more third-level leaf nodes, each third-level leaf node represents a network ACL or a security group under a cloud platform VPC instance.

[0137] S3054. Based on the first correspondence, the second correspondence, and the third correspondence, the pre-generated access control relationship is obtained.

[0138] In some embodiments, the first multi-way tree, the second multi-way tree, and the third multi-way tree are determined as pre-generated access control relationships.

[0139] In some embodiments, the address ranges in the first and second multi-way trees are associated with the third multi-way tree to obtain a fourth multi-way tree, and the fourth multi-way tree is determined as a pre-generated access control relationship.

[0140] In other embodiments, the first mapping table, the second mapping table, and the third mapping table are integrated to obtain a fourth mapping table, and the fourth mapping table is determined as a pre-generated access control relationship.

[0141] Understandably, by associating the identifiers of the perimeter firewall, VPC, network ACL, security group, and address ranges, pre-generated access control relationships can be obtained, which can then be used to quickly generate access configuration policies.

[0142] In one design, to quickly generate access configuration policies, the above S302 includes: S3021-S3024.

[0143] S3021. Find the identifier of the first network ACL corresponding to the source address from the first correspondence, and find the identifier of the first security group corresponding to the source address from the second correspondence.

[0144] For example, in combination Figure 4 By traversing the address sets of the second-level leaf nodes through the source address, it is confirmed that the source address belongs to the address set A of the second-level leaf nodes, and is therefore subject to access control by ACL1 corresponding to the parent node of this second-level leaf node, which is also the first-level leaf node. Combined with... Figure 5 By traversing the address sets of the second-level leaf nodes through the source address, it is confirmed that the source address belongs to the address set A of the second-level leaf nodes, and is subject to access control by SG1, which is the parent node of this second-level leaf node and the corresponding first-level leaf node.

[0145] Understandable, combined Figure 4 Based on the source address matching in the first multi-way tree, the address set to which the source address belongs is determined, and then the network ACL corresponding to the source address is confirmed. If the input source address is not in any address set within the first multi-way tree of the cloud platform access control, a corresponding prompt is issued and the operation is terminated. The source address matching results include the following scenarios: no matching of any address set, matching of one address set, and matching of multiple address sets.

[0146] S3022. Based on the identifier of the first network ACL or the identifier of the first security group, search from the third correspondence for the identifier of the first VPC and the identifier of the first border firewall corresponding to the source address.

[0147] For example, in combination Figure 6 Based on the source address-determined ACL1 and SG1, the network ACL and security group information of the third-level leaf nodes of the third multi-way tree are traversed respectively, and the ACL1 and SG1 of the third-level leaf nodes under the second-level leaf node VPC1 are matched to confirm the boundary firewall A corresponding to the first-level leaf node.

[0148] In some embodiments, after determining that the first network ACL and the first security group both correspond to the same VPC, the first VPC and the first border firewall corresponding to the source address are searched from the third multi-way tree based on the first network ACL or the first security group.

[0149] In other embodiments, based on the first network ACL and the first security group, the network ACL and security group of the third-level leaf nodes in the third multi-way tree are traversed to determine that the first VPCs corresponding to the first network ACL and the first security group do not belong to the same VPC. Further, first boundary firewalls corresponding to multiple first VPCs are determined.

[0150] Understandably, based on the first network ACL and the first security group, the network ACL and security group of each of the third-level leaf nodes in the third multi-way tree are traversed. If the first network ACL and the first security group exist, it is determined that the source address is subject to access control by the first network ACL and the first security group of the third-level leaf node. Simultaneously, the first VPC is identified as the parent node (i.e., the second-level leaf node), and the first boundary firewall is identified as the parent node (i.e., the first-level leaf node). Thus, based on the source address, the first, second, and third multi-way trees are traversed to determine whether the source address is subject to security control through the boundary firewall, VPC, network ACL, and security group.

[0151] S3023. Find the identifier of the second network ACL corresponding to the destination address from the first correspondence, and find the identifier of the second security group corresponding to the destination address from the second correspondence.

[0152] For example, in combination Figure 4 By traversing the address sets of the second-level leaf nodes through the destination address, it is confirmed that the destination belongs to the address set E of the second-level leaf nodes, and is therefore subject to access control by ACL7 corresponding to the parent node of this second-level leaf node, which is also the first-level leaf node. Combined with... Figure 5 By traversing the address set of the second-level leaf nodes through the destination address, it is confirmed that the destination belongs to the address set R of the second-level leaf nodes, and is subject to access control by the parent node of this second-level leaf node, which is the SG7 corresponding to the first-level leaf node.

[0153] Understandable, combined Figure 4 Based on the destination address matching in the first multi-way tree, the address set to which the destination address belongs is determined, and then the network ACL corresponding to the destination address is confirmed. If the input destination address is not in any address set within the first multi-way tree of the cloud platform access control, a corresponding prompt is issued and the operation is terminated. Destination address matching results include the following scenarios: no matching of any address set, matching of one address set, and matching of multiple address sets.

[0154] S3024. Based on the identifier of the second network ACL or the identifier of the second security group, find the identifier of the second VPC and the identifier of the second border firewall corresponding to the destination address from the third correspondence.

[0155] For example, in combination Figure 6 Based on the destination address, ACL7 and SG7 are determined, and the network ACL and security group information of the third-level leaf nodes of the third multi-way tree are traversed. The ACL7 and SG7 of the third-level leaf nodes under the second-level leaf node VPC4 are matched, and then the boundary firewall B corresponding to the first-level leaf node is confirmed.

[0156] In some embodiments, if it is determined that the second network ACL and the second security group both correspond to the same VPC, the second VPC and the second boundary firewall corresponding to the source address are searched from the third multi-way tree based on the second network ACL or the second security group.

[0157] In other embodiments, based on the second network ACL and the second security group, the network ACL and security group of the third-level leaf nodes in the third multi-way tree are traversed to determine that the second VPCs corresponding to the second network ACL and the second security group do not belong to the same VPC. Furthermore, second boundary firewalls corresponding to multiple second VPCs are determined.

[0158] Understandably, based on the identifiers of the second network ACL and the second security group, the identifiers of the network ACL and security group of the third-level leaf nodes in the third correspondence are traversed. If there are network ACL and security group identifiers corresponding to the identifiers of the second network ACL and the second security group, it is determined that the source address is subject to access control by the second network ACL and the second security group of the third-level leaf node. Simultaneously, based on the parent node of this third-level leaf node (i.e., the second-level leaf node), access control is confirmed to be through the second VPC, and based on the parent node of this second-level leaf node (i.e., the first-level leaf node), access control is confirmed to be through the corresponding second boundary firewall. Thus, based on the destination address, the first multi-way tree, the second multi-way tree, and the third multi-way tree are traversed to determine that the destination address is subject to security control through the boundary firewall, VPC, network ACL, and security group.

[0159] Furthermore, based on the location relationship of the source address and destination address in the network ACL and security group of the third-level leaf node, the access control procedures passed by the source address and destination address are determined to be network ACL1, security group SG1, VPC1, border firewall A, border firewall B, VPC4, network ACL7, and security group SG7.

[0160] In one design, in order to generate access configuration policies, the above S303 includes: S3031-S3032.

[0161] S3031. Determine the target access control data based on the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0162] Specifically, the target access control data consists of access control program identifiers that differ between the access control data corresponding to the source address and the access control data corresponding to the destination address. Access control program identifiers include perimeter firewall identifiers, cloud platform VPC identifiers, network ACL identifiers, and security group identifiers.

[0163] In some embodiments, the identifiers of the first network ACL, the first security group, the first VPC, and the first border firewall corresponding to the source address are obtained, as well as the identifiers of the second network ACL, the second security group, the second VPC, and the second border firewall corresponding to the destination address, and the target access control data is determined.

[0164] For example, consider a network ACL of ACL2, a security group of SG3, a VPC of VPC2, a border firewall of border firewall 2, a network ACL of ACL3, a security group of SG3, a VPC of VPC2, and a border firewall of border firewall 2. The electronic device determines the target access control data as ACL2 and ACL3.

[0165] S3032. Generate access configuration policies based on target access control data.

[0166] For example, taking ACL2 and ACL3 as the target access control data, the electronic device determines that the first network ACL corresponding to the source address and the second network ACL corresponding to the destination address are different network ACLs, and determines the access configuration policy to enable the network ACLs.

[0167] In one design, in order to generate access configuration policies, the above S3032 includes: S401-S403.

[0168] S401. If the identifier of the first security group corresponding to the source address and the identifier of the second security group corresponding to the destination address are different security group identifiers, generate a first access configuration policy.

[0169] The first access configuration policy is used to indicate whether the security group access configuration policy is enabled.

[0170] S402. If the identifier of the first network ACL corresponding to the source address is different from the identifier of the second network ACL corresponding to the destination address, generate a second access configuration policy.

[0171] The second access configuration policy is used to indicate whether to enable network ACL access configuration policies.

[0172] S403. If the identifier of the first border firewall corresponding to the source address is different from the identifier of the second border firewall corresponding to the destination address, and the identifier of the first VPC is different from the identifier of the second VPC, generate a third access configuration policy.

[0173] The third access configuration policy is used to indicate whether to enable access configuration policies on the border firewall.

[0174] In other embodiments, if the source address and destination address belong to the same network ACL and security group, and the source address and destination address belong to the same network ACL and host security, then no policy needs to be enabled.

[0175] In other embodiments, if the network ACLs and security groups to which the source address and destination address belong are under different VPCs, the identifiers of the first network ACL and the second network ACL are different network ACL identifiers, and the identifiers of the first security group and the second security group are different security group identifiers, then the boundary firewall, network ACLs, and security group policies need to be enabled.

[0176] In other embodiments, if the network ACLs and security groups to which the source address and destination address belong are under the same VPC, and the first security group identifier and the second security group identifier are the same security group identifier, but the identifier of the first network ACL and the identifier of the second network ACL are different network ACL identifiers, then the access configuration policy for enabling the network ACL is determined.

[0177] For example, taking ACL2 and ACL3 as the target access control data, the electronic device determines that the first network ACL corresponding to the source address and the second network ACL corresponding to the destination address are different network ACLs, and determines the access configuration policy to enable the network ACLs.

[0178] In one design, in order to generate an access configuration policy, the method for generating an access configuration policy provided in this application embodiment further includes: S306-S307.

[0179] S306. Generate access configuration policy scripts based on access configuration policies.

[0180] S307. Send access configuration policy scripts to the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address, so that the border firewall node and cloud platform node corresponding to the source address and the destination address execute the access configuration policy scripts.

[0181] In one design, to improve the efficiency of configuring access policies, the method for generating access policies provided in this application embodiment further includes: S308.

[0182] S308. Determine whether the source address, destination address, and port number meet the preset range and preset format requirements.

[0183] The aforementioned S302 also includes: S3025.

[0184] S3025. If the source address, destination address and port number all meet the preset format, determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship.

[0185] In some embodiments, if the format and range of the source address, destination address, and port number all meet the requirements, the access control data corresponding to the source address and the access control data corresponding to the destination address are determined based on the pre-generated access control relationship.

[0186] Understandably, before generating access configuration policies, the source address, destination address, and port number are checked for format. Subsequent configuration actions are only performed if the format check passes. This avoids invalid generation work due to incorrect addresses, thus improving the efficiency of configuring access policies.

[0187] To better understand the method for generating access configuration policies provided in the embodiments of this application, such as... Figure 7 The diagram illustrates a cloud platform architecture system to which an access configuration policy generation method is applied, including data center 1, data center 2, and data center 3. Data center 1 includes cloud platform A, cloud platform B, and cloud platform C. Cloud platform A corresponds to address set A, cloud platform B to address set B, and cloud platform C to address set C. Data center 2 includes cloud platform D and cloud platform E. Cloud platform D corresponds to address set D, and cloud platform E to address set E. Data center 3 includes cloud platform W and cloud platform Y. Cloud platform W corresponds to address set W, and cloud platform Y to address set Y. Cloud platforms A, B, C, D, E, W, and Y are connected via a wide area network (WAN).

[0188] like Figure 8 The diagram illustrates a process for generating access configuration policies, including steps S501-S506.

[0189] S501: Obtain source address, destination address, and port information.

[0190] In some embodiments, when the source address, destination address, and port information are obtained, a range and format compliance check is performed on the source address, destination address, and port information.

[0191] S502. Obtain access control information by calling the cloud platform API interface.

[0192] S503. Generate access control relationship data based on access control information.

[0193] This step can be referenced from S305 above.

[0194] S504. Based on the pre-generated access control relationship, determine the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0195] This step can be referenced from S302 above.

[0196] S505. Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, generate an access configuration policy.

[0197] This step can be referenced from S303 above.

[0198] S506. Send the access configuration policy to the target configuration node.

[0199] Specifically, the access policy configuration is automatically pushed to the target configuration node. The target configuration node can be the target perimeter firewall, the target network ACL configuration module, or the target security group configuration module.

[0200] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the access configuration policy generation device or electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0201] This application embodiment can, based on the above method, exemplarily divide the access configuration policy generation device or electronic device into functional modules. For example, the access configuration policy generation device or electronic device may include functional modules corresponding to each functional division, or two or more functions may be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; in actual implementation, there may be other division methods.

[0202] For example, embodiments of this application also provide an apparatus for generating access configuration policies.

[0203] Figure 9 This is a block diagram illustrating an access configuration policy generation apparatus according to an exemplary embodiment. (Refer to...) Figure 9 The access configuration policy generation apparatus 60 is applied to an electronic device. The access configuration policy generation apparatus 60 includes an acquisition unit 601, a determination unit 602, and a generation unit 603.

[0204] The acquisition unit 601 is used to acquire the service access configuration request. The service access configuration request includes the source address, destination address, and destination port.

[0205] The determining unit 602 is used to determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship. The access control relationship is used to characterize the association between multiple access control procedures, and the access control data includes the identifier of at least one of the multiple access control procedures.

[0206] The generation unit 603 is used to generate an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address.

[0207] In one possible implementation, multiple access control mechanisms include: perimeter firewalls, Virtual Private Cloud (VPC), network ACLs, and security groups, such as... Figure 9 As shown, the access configuration policy generation device 60 further includes a processing unit 604.

[0208] The acquisition unit 601 is also used to acquire access control information from the cloud platform.

[0209] Processing unit 604 is used to associate the identifiers of multiple access control programs based on access control information to obtain access control relationships. The access control information includes the identifier of the boundary firewall and the corresponding cloud platform node identifier, the identifier of the VPC, the corresponding cloud platform node identifier of the VPC, the identifier of the network ACL, the corresponding VPC identifier and address range of the network ACL, the identifier of the security group, the corresponding VPC identifier and address range of the security group.

[0210] In one possible implementation, processing unit 604 is specifically configured to: generate a first correspondence based on the identifier of a network ACL and the address range corresponding to the network ACL identifier. The first correspondence is used to characterize the association between the network ACL identifier and the address range. Generate a second correspondence based on the identifier of a security group and the address range corresponding to the security group identifier. The second correspondence is used to characterize the association between the security group identifier and the address range. Generate a third correspondence based on the identifier of a perimeter firewall, the cloud platform node identifier corresponding to the perimeter firewall identifier, the identifier of a VPC, the cloud platform node identifier corresponding to the VPC identifier, the network ACL identifier, the security group identifier, and the VPC identifier corresponding to the network ACL identifier and the security group identifier. The third correspondence is used to characterize the association between the perimeter firewall identifier, the VPC identifier, the network ACL identifier, and the security group identifier. Based on the first, second, and third correspondences, an access control relationship is obtained.

[0211] In one possible implementation, the determining unit 602 is specifically configured to: search for the identifier of the first network ACL corresponding to the source address in the first mapping relationship, and search for the identifier of the first security group corresponding to the source address in the second mapping relationship. Based on the identifier of the first network ACL or the identifier of the first security group, search for the identifier of the first VPC and the identifier of the first border firewall corresponding to the source address in the third mapping relationship. Search for the identifier of the second network ACL corresponding to the destination address in the first mapping relationship, and search for the identifier of the second security group corresponding to the destination address in the second mapping relationship. Based on the identifier of the second network ACL or the identifier of the second security group, search for the identifier of the second VPC and the identifier of the second border firewall corresponding to the destination address in the third mapping relationship.

[0212] In one possible implementation, the generation unit 603 is further configured to: determine target access control data based on the access control data corresponding to the source address and the access control data corresponding to the destination address. The target access control data consists of different access control program identifiers in the access control data corresponding to the source address and the access control data corresponding to the destination address. Access control program identifiers include perimeter firewall identifiers, cloud platform VPC identifiers, network ACL identifiers, and security group identifiers. Based on the target access control data, an access configuration policy is generated.

[0213] In one possible implementation, the generation unit 603 is specifically configured to: generate a first access configuration policy when the identifier of the first security group corresponding to the source address is different from the identifier of the second security group corresponding to the destination address. The first access configuration policy is used to indicate the enabling of a security group policy. Alternatively, generate a second access configuration policy when the identifier of the first network ACL corresponding to the source address is different from the identifier of the second network ACL corresponding to the destination address. The second access configuration policy is used to indicate the enabling of a network ACL policy. Alternatively, generate a third access configuration policy when the identifier of the first border firewall corresponding to the source address is different from the identifier of the second border firewall corresponding to the destination address, and the identifier of the first VPC is different from the identifier of the second VPC. The third access configuration policy is used to indicate the enabling of a border firewall policy.

[0214] In one possible implementation, the access configuration policy generation apparatus further includes a sending unit 605. The generation unit 603 is further configured to generate an access configuration policy script based on the access configuration policy. The sending unit 605 is configured to send the access configuration policy script to the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address, so that the border firewall node and cloud platform node corresponding to the source address and the destination address execute the access configuration policy script.

[0215] In one possible implementation, the service access configuration request also includes a port number. After obtaining the service access configuration request, the determining unit 602 is further configured to determine whether the source address, destination address, and port number meet a preset format. Specifically, the determining unit 602 is further configured to: if the source address, destination address, and port number all meet the preset format, determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the access control relationship.

[0216] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 10 As shown, the electronic device 70 includes a processor 701, a memory 702, and a bus 703. The processor 701 and the memory 702 can be connected via the bus 703.

[0217] Processor 701 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 701 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0218] As one embodiment, processor 701 may include one or more CPUs, for example Figure 10 CPU 0 and CPU 1 are shown in the diagram.

[0219] The memory 702 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0220] As one possible implementation, the memory 702 can exist independently of the processor 701. The memory 702 can be connected to the processor 701 via a bus 703 and is used to store instructions or program code. When the processor 701 calls and executes the instructions or program code stored in the memory 702, it can implement the sensor determination method provided in the embodiments of this application.

[0221] In another possible implementation, the memory 702 can also be integrated with the processor 701.

[0222] Bus 703 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0223] It should be pointed out that, Figure 10 The structure shown does not constitute a limitation on the electronic device 70. Except... Figure 10 In addition to the components shown, the electronic device 70 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0224] Optionally, the electronic device 70 provided in this application embodiment may also include a communication interface 704.

[0225] Communication interface 704 is used to connect to other devices via a communication network. This communication network can be Ethernet. Communication interface 704 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0226] In one design, the communication interface in the electronic device provided in this application embodiment can also be integrated into the processor.

[0227] In another hardware structure of the electronic device provided in this application embodiment, the electronic device may include a processor and a communication interface. The processor is coupled to the communication interface.

[0228] The functions of the processor can be found in the processor description above. In addition, the processor also has storage functions, which can be found in the memory function description above.

[0229] The communication interface is used to provide data to the processor. This communication interface can be an internal interface of the communication device or an external interface of the communication device.

[0230] It should be noted that the above-mentioned alternative hardware structure does not constitute a limitation on the electronic device. In addition to the above-mentioned alternative hardware component, the electronic device may include more or fewer components, or combine certain components, or have different component arrangements.

[0231] When the functions of the integrated modules described above are implemented in hardware, the present application provides a schematic diagram of the electronic device involved in the above embodiments, which can be referred to in the description of electronic device 70, and will not be repeated here.

[0232] This application also provides a computer-readable storage medium storing instructions. When a computer executes these instructions, the computer performs each step of the access configuration policy generation method flow shown in the above method embodiments.

[0233] This application also provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the method for generating access configuration policies described in the above method embodiments.

[0234] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0235] Since the server, user equipment, computer-readable storage medium, and computer program product in the embodiments of this application can be applied to the above methods, the technical effects that can be obtained can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0236] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A method for generating an access configuration policy, the method comprising: The method includes: Obtain a service access configuration request; the service access configuration request includes the source address, destination address, and destination port; The system obtains access control information from the cloud platform and, based on this information, associates the identifiers of multiple access control programs to obtain access control relationships. The access control information includes the identifier of the border firewall, the cloud platform node identifier corresponding to the border firewall identifier, the identifier of the Virtual Private Cloud (VPC), the cloud platform node identifier corresponding to the VPC identifier, the identifier of the Network Access Control List (ACL), the VPC identifier and address range corresponding to the network ACL identifier, and the identifier of the security group, as well as the VPC identifier and address range corresponding to the security group identifier. The multiple access control programs include: the border firewall, the Virtual Private Cloud (VPC), the Network Access Control List (ACL), and the security group. Based on the pre-generated access control relationship, access control data corresponding to the source address and access control data corresponding to the destination address are determined respectively; the access control relationship is used to characterize the association between multiple access control programs, and the access control data includes the identifier of at least one of the multiple access control programs. Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, an access configuration policy is generated. The process of associating the identifiers of the multiple access control procedures to obtain the access control relationship includes: Based on the identifier of the network ACL and the address range corresponding to the identifier of the network ACL, a first correspondence is generated; the first correspondence is used to characterize the association between the identifier of the network ACL and the address range. A second correspondence is generated based on the identifier of the security group and the address range corresponding to the identifier of the security group; the second correspondence is used to characterize the association between the identifier of the security group and the address range. A third correspondence is generated based on the identifier of the border firewall, the cloud platform node identifier corresponding to the identifier of the border firewall, the cloud platform node identifier corresponding to the identifier of the VPC, the VPC identifier corresponding to the identifier of the network ACL, and the VPC identifier corresponding to the identifier of the security group; the third correspondence is used to characterize the association between the identifier of the border firewall, the identifier of the VPC, the identifier of the network ACL, and the identifier of the security group. The access control relationship is obtained based on the first correspondence, the second correspondence, and the third correspondence.

2. The generation method of claim 1, wherein, The first correspondence is a first multi-way tree, the second correspondence is a second multi-way tree, and the third correspondence is a third multi-way tree; The step of generating a first correspondence based on the identifier of the network ACL and the address range corresponding to the identifier of the network ACL includes: Based on the identifier of the network ACL and the address range corresponding to the identifier of the network ACL, a first multi-branch tree is generated; the parent node of the first multi-branch tree is the identifier of the network ACL, and the child nodes of the first multi-branch tree are the address ranges corresponding to the identifier of the network ACL. The step of generating a second correspondence based on the identifier of the security group and the address range corresponding to the identifier of the security group includes: Based on the identifier of the security group and the address range corresponding to the identifier of the security group, a second multi-way tree is generated; the parent node of the second multi-way tree is the identifier of the security group, and the child nodes of the second multi-way tree are the address ranges corresponding to the identifier of the security group. A third multi-way tree is generated based on the identifier of the border firewall, the cloud platform node identifier corresponding to the border firewall identifier, the identifier of the VPC, the cloud platform node identifier corresponding to the VPC identifier, the identifier of the network ACL, the VPC identifier corresponding to the network ACL identifier, the identifier of the security group, and the VPC identifier corresponding to the security group identifier. The parent node of the third multi-way tree is the identifier of the border firewall, the child node of the third multi-way tree is the VPC identifier corresponding to the identifier of the border firewall, and the grandchild node of the third multi-way tree is the network ACL identifier corresponding to the VPC identifier and the security group identifier.

3. The generation method of claim 2, wherein, The step of determining the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship includes: Find the identifier of the first network ACL corresponding to the source address in the first multi-way tree, and find the identifier of the first security group corresponding to the source address in the second multi-way tree; Based on the identifier of the first network ACL or the identifier of the first security group, search the third multi-way tree for the identifier of the first VPC and the identifier of the first border firewall corresponding to the source address; Find the identifier of the second network ACL corresponding to the destination address in the first multi-way tree, and find the identifier of the second security group corresponding to the destination address in the second multi-way tree; Based on the identifier of the second network ACL or the identifier of the second security group, the identifier of the second VPC and the identifier of the second border firewall corresponding to the destination address are searched from the third multi-way tree.

4. The generation method of any one of claims 1-3, wherein, The step of generating an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address includes: Based on the access control data corresponding to the source address and the access control data corresponding to the destination address, target access control data is determined; the target access control data is an access control program identifier that is different from the access control data corresponding to the source address and the access control data corresponding to the destination address; the access control program identifier includes a perimeter firewall identifier, a VPC identifier, a network ACL identifier, and a security group identifier. The access configuration policy is generated based on the target access control data.

5. The generation method of claim 4, wherein, The step of generating the access configuration policy based on the target access control data includes: If the identifier of the first security group corresponding to the source address is different from the identifier of the second security group corresponding to the destination address, a first access configuration policy is generated; the first access configuration policy is used to indicate whether the security group policy is enabled; or... If the identifier of the first network ACL corresponding to the source address is a different network ACL identifier than the identifier of the second network ACL corresponding to the destination address, a second access configuration policy is generated; the second access configuration policy is used to indicate whether the network ACL policy is enabled; or, If the identifier of the first border firewall corresponding to the source address is a different border firewall identifier than the identifier of the second border firewall corresponding to the destination address, and the identifier of the first VPC corresponding to the source address is a different VPC identifier than the identifier of the second VPC corresponding to the destination address, a third access configuration policy is generated; the third access configuration policy is used to indicate the enabling of the border firewall policy.

6. The method of generating according to any one of claims 1-3, wherein, The method further includes: Based on the access configuration policy, an access configuration policy script is generated and sent to the border firewall node and cloud platform node corresponding to the source address and the border firewall node and cloud platform node corresponding to the destination address, so that the border firewall node and cloud platform node corresponding to the source address and the destination address execute the access configuration policy script.

7. The method of generating according to any one of claims 1-3, wherein, The service access configuration request also includes a port number. After obtaining the service access configuration request, the method further includes: Determine whether the source address, the destination address, and the port number meet the preset format and preset range; The step of determining the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship includes: If the source address, the destination address, and the port number all satisfy the preset format and preset range, the access control data corresponding to the source address and the access control data corresponding to the destination address are determined based on the access control relationship.

8. An apparatus for generating an access configuration policy, the apparatus comprising: The device includes: an acquisition unit, a determination unit, a generation unit, and a processing unit; The acquisition unit is used to acquire a service access configuration request; the service access configuration request includes a source address, a destination address, and a destination port; The acquisition unit is also used to acquire access control information of the cloud platform; The processing unit is used to associate the identifiers of multiple access control programs based on the access control information to obtain access control relationships. The access control information includes the identifier of a border firewall, the identifier of a cloud platform node corresponding to the identifier of the border firewall, the identifier of a Virtual Private Cloud (VPC), the identifier of a cloud platform node corresponding to the identifier of the VPC, the identifier of a Network Access Control List (ACL), the identifier of the VPC corresponding to the identifier of the Network ACL and its address range, the identifier of a security group, and the identifier of the VPC corresponding to the identifier of the security group and its address range. The multiple access control programs include: a border firewall, a Virtual Private Cloud (VPC), a Network Access Control List (ACL), and a security group. The determining unit is configured to determine the access control data corresponding to the source address and the access control data corresponding to the destination address based on the pre-generated access control relationship; the access control relationship is used to characterize the association between multiple access control programs, and the access control data includes the identifier of at least one of the multiple access control programs. The generation unit is used to generate an access configuration policy based on the access control data corresponding to the source address and the access control data corresponding to the destination address. The processing unit is specifically configured to: generate a first correspondence based on the identifier of the network ACL and the address range corresponding to the identifier of the network ACL; the first correspondence is used to characterize the association between the identifier of the network ACL and the address range; generate a second correspondence based on the identifier of the security group and the address range corresponding to the identifier of the security group; the second correspondence is used to characterize the association between the identifier of the security group and the address range; generate a third correspondence based on the identifier of the perimeter firewall, the cloud platform node identifier corresponding to the identifier of the perimeter firewall, the cloud platform node identifier corresponding to the identifier of the VPC, the VPC identifier corresponding to the identifier of the network ACL, and the VPC identifier corresponding to the identifier of the security group; the third correspondence is used to characterize the association between the identifier of the perimeter firewall, the identifier of the VPC, the identifier of the network ACL, and the identifier of the security group; and obtain the access control relationship based on the first correspondence, the second correspondence, and the third correspondence.

9. An electronic device, comprising: include: A processor and a communication interface; the communication interface is coupled to the processor, the processor being used to run computer programs or instructions to implement the method for generating access configuration policies as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, When the computer-executable instructions stored in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the method for generating the access configuration policy as described in any one of claims 1-7.

Images