A method and device for processing IP address set of firewall policy

Abstract

The present application provides a method and device for processing an IP address set of a firewall policy. The method includes: based on the preset attributes of each first-base IP address, converting the first-base IP address into a target IP address in a target form to obtain a corresponding target IP address set, sorting each target IP address in the target IP address set, and merging the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set, calculating the minimum mask of each merged target IP address in the merged target IP address set, and converting each merged target IP address into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set.

Description

Technical Field

[0001] The present application relates to the field of security automation technology, and in particular to a method and device for processing an IP address set of a firewall policy. Background Art

[0002] There are some security threats on the Internet. Due to the network environment and security requirements, it is often necessary to generate firewall policies to effectively protect the network environment.

[0003] Currently, firewall policies are mainly automatically generated by calculating and obtaining IP address sets of firewall policies.

[0004] However, the IP address set of the generated firewall policy has low readability, and sometimes the address set can only be merged manually, which takes a lot of time and makes the range of the merged address very likely to be larger than the range of the actual activation request, thus posing a threat to network security and having low security. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a method and device for processing an IP address set of a firewall policy, by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address to obtain a final merged address set, merging the IP addresses together in a minimal manner, thereby improving the readability of the merged IP address set, and since there is no need to manually merge the IP addresses, human-induced merging errors are avoided, ensuring that the range of the merged IP address set is within the range of the actual activation request, thereby improving network security and achieving both readability and security.

[0006] In a first aspect, an embodiment of the present application provides a method for processing an IP address set of a firewall policy, the processing method comprising:

[0007] Based on the preset attributes of each first-base IP address, convert the first-base IP address into a target IP address in a target form to obtain a corresponding target IP address set; wherein the target form includes a binary single form and a binary list form;

[0008] Sorting each target IP address in the target IP address set, and merging the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set;

[0009] The minimum mask of each merged target IP address in the merged target IP address set is calculated, and each merged target IP address is converted into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set.

[0010] In a possible implementation, the binary list form includes a start value and an end value; and the converting of the first-base IP address into a target IP address in a target form based on the preset attribute of each first-base IP address includes:

[0011] Determine whether the attribute of each first-order IP address is network segment information;

[0012] If yes, converting the first-base IP address into the target IP address in the second binary list form based on the start value and the end value of the first-base IP address;

[0013] If not, the first-base IP address is converted into a target IP address in a binary single form.

[0014] In a possible implementation manner, merging the sorted target IP addresses includes:

[0015] In response to the current target IP address being in the binary list form, determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address;

[0016] If so, the next target IP address is deleted from the target IP address set.

[0017] In a possible implementation manner, the method for processing the IP address set of the firewall policy further includes:

[0018] If not, then add 1 to the termination value to obtain the test termination value;

[0019] In response to the test termination value being equal to the next target IP address, the test termination value is determined as a new termination value, and a new current target IP address is determined based on the new termination value to merge the next target IP address into the current target IP address.

[0020] In a possible implementation, the calculating the minimum mask of each merged target IP address in the merged target IP address set includes:

[0021] Obtaining the number of consecutive addresses of each merged target IP address based on a preset consecutive address number formula;

[0022] The minimum mask of the target IP address is calculated based on the number of consecutive addresses and a preset minimum mask calculation formula.

[0023] In a possible implementation, converting each merged target IP address into a final target IP address based on the minimum mask includes:

[0024] Calculate the total number of addresses of the merged target IP address based on the minimum mask and a preset total number of addresses formula;

[0025] In response to the total number of addresses not being equal to the number of consecutive addresses, it is determined that the merged target IP address is not a subnet segment, and the merged target IP address is converted into a final target IP address in the form of a consecutive address.

[0026] In a possible implementation manner, the method for processing the IP address set of the firewall policy further includes:

[0027] In response to the total number of addresses being equal to the number of consecutive addresses, determining whether the minimum value of the merged target IP address and the network bit of the merged target IP address are equal;

[0028] If yes, determine that the combined target IP address is a subnet segment, and convert the combined target IP address into a final target IP address in the form of a subnet segment address;

[0029] If not, the combined target IP address is converted into a final target IP address in the form of a continuous address.

[0030] In a second aspect, an embodiment of the present application further provides a device for processing an IP address set of a firewall policy, the processing device comprising:

[0031] A first conversion module, configured to convert each first-base IP address into a target IP address in a target form based on a preset attribute of the first-base IP address, to obtain a corresponding target IP address set; wherein the target form includes a binary single form and a binary list form;

[0032] A merging module, used to sort each target IP address in the target IP address set, and merge the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set;

[0033] The first acquisition module is used to calculate the minimum mask of each merged target IP address in the merged target IP address set, and convert each merged target IP address into a final target IP address based on the minimum mask to obtain the corresponding final target IP address set.

[0034] In a possible implementation manner, the first binary list form includes a start value and an end value; and the first conversion module is specifically configured to:

[0035] Determine whether the attribute of each first-order IP address is network segment information;

[0036] If yes, converting the first-base IP address into the target IP address in the second binary list form based on the start value and the end value of the first-base IP address;

[0037] If not, the first-base IP address is converted into a target IP address in a binary single form.

[0038] In a possible implementation manner, the merging module is specifically used to:

[0039] In response to the current target IP address being in the binary list form, determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address;

[0040] If so, the next target IP address is deleted from the target IP address set.

[0041] In a possible implementation manner, the device for processing the IP address set of the firewall policy further includes:

[0042] A second acquisition module is used for, if not, adding 1 to the termination value to obtain a test termination value;

[0043] A determination module is used to determine the test termination value as a new termination value in response to the test termination value being equal to the next target IP address, and determine a new current target IP address based on the new termination value to merge the next target IP address into the current target IP address.

[0044] In a possible implementation manner, the first acquisition module is specifically configured to:

[0045] Obtaining the number of consecutive addresses of each merged target IP address based on a preset consecutive address number formula;

[0046] The minimum mask of the target IP address is calculated based on the number of consecutive addresses and a preset minimum mask calculation formula.

[0047] In a possible implementation manner, the first acquisition module is specifically configured to:

[0048] Calculate the total number of addresses of the merged target IP address based on the minimum mask and a preset total number of addresses formula;

[0049] In response to the total number of addresses not being equal to the number of consecutive addresses, it is determined that the merged target IP address is not a subnet segment, and the merged target IP address is converted into a final target IP address in the form of a consecutive address.

[0050] In a possible implementation manner, the device for processing the IP address set of the firewall policy further includes:

[0051] A judging module, configured to judge whether the minimum value of the combined target IP address and the network bit of the combined target IP address are equal in response to the total number of addresses being equal to the number of consecutive addresses;

[0052] A second conversion module is used to determine that the combined target IP address is a subnet segment, and convert the combined target IP address into a final target IP address in the form of a subnet segment address;

[0053] The third conversion module is used for converting the combined target IP address into a final target IP address in the form of a continuous address if no.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the method for processing an IP address set of a firewall policy as described in any one of the first aspects.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for processing an IP address set of a firewall policy as described in any one of the first aspects are executed.

[0056] The embodiment of the present application provides a method and device for processing an IP address set of a firewall policy. Based on the preset attribute of each first-base IP address, the first-base IP address is converted into a target IP address in a target form to obtain a corresponding target IP address set, each target IP address in the target IP address set is sorted, and the sorted target IP addresses are merged to obtain a merged target IP address and a corresponding merged target IP address set, and the minimum mask of each merged target IP address in the merged target IP address set is calculated, and each merged target IP address is converted into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set. The present application obtains a final merged address set by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address, merges the IP addresses together in a minimal manner, improves the readability of the merged IP address set, and because the IP addresses do not need to be manually merged, the merging errors caused by human factors are avoided, and the range of the merged IP address set is guaranteed to be within the range of the actual opening request, thereby improving network security, thereby achieving both readability and security.

[0057] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 It is a flowchart of a method for processing an IP address set of a firewall policy provided in an embodiment of the present application;

[0060] Figure 2 It is a schematic diagram of the preset first-order IP address;

[0061] Figure 3 It is a schematic diagram of the target IP address in target form;

[0062] Figure 4 It is a schematic diagram of the sorted target IP addresses;

[0063] Figure 5 It is a schematic diagram of merging and converting the sorted target IP addresses;

[0064] Figure 6is a flowchart of a method for processing an IP address set of a firewall policy provided in another embodiment of the present application;

[0065] Figure 7 is a flowchart of a method for processing an IP address set of a firewall policy provided in another embodiment of the present application;

[0066] Figure 8 is a flowchart of a method for processing an IP address set of a firewall policy provided in another embodiment of the present application;

[0067] Fig. 9 This is a schematic diagram of converting the merged target IP address;

[0068] Fig.10 is a flowchart of a method for processing an IP address set of a firewall policy provided in another embodiment of the present application;

[0069] Fig.11a This is a schematic diagram of the processing flow of the IP address set of the firewall policy. Figure 1 ;

[0070] Fig.11b This is a schematic diagram of the processing flow of the IP address set of the firewall policy. Figure 2 ;

[0071] Fig.12 It is a structural diagram of a device for processing an IP address set of a firewall policy provided in an embodiment of the present application;

[0072] Fig.13 It is a structural schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0073] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0074] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0075] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0076] Considering that there are some security threats in the Internet, due to the network environment and security requirements, it is often necessary to generate firewall policies to effectively protect the network environment. At present, the firewall policy is mainly automatically generated by calculating and obtaining the IP address set of the firewall policy.

[0077] However, the IP address set of the generated firewall policy has low readability, and sometimes the address set can only be merged manually, which takes a lot of time and makes the range of the merged address very likely to be larger than the range of the actual activation request, thus posing a threat to network security and having low security.

[0078] To address this problem, the present application provides a method and device for processing an IP address set of a firewall policy, by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address to obtain a final merged address set, merging the IP addresses together in a minimal manner, thereby improving the readability of the merged IP address set, and since there is no need to manually merge the IP addresses, human-induced merging errors are avoided, ensuring that the range of the merged IP address set is within the range of the actual activation request, thereby improving network security and achieving both readability and security.

[0079] Figure 1 Flow chart of a method for processing an IP address set of a firewall policy according to an embodiment of the present application, such as Figure 1 As shown, the method for processing the IP address set of the firewall policy of the embodiment of the present application may specifically include:

[0080] S101. Convert each first-base IP address into a target IP address in a target form based on a preset attribute of the first-base IP address to obtain a corresponding target IP address set.

[0081] S102: sort each target IP address in the target IP address set, and merge the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set.

[0082] S103: Calculate the minimum mask of each merged target IP address in the merged target IP address set, and convert each merged target IP address into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set.

[0083] In the method for processing the IP address set of the above firewall policy, the final merged address set is obtained by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address, and the IP addresses are merged together in a minimal manner, thereby improving the readability of the merged IP address set. Moreover, since there is no need to manually merge the IP addresses, human-induced merging errors are avoided, and the range of the merged IP address set is guaranteed to be within the range of the actual activation request, thereby improving network security and achieving both readability and security.

[0084] The above exemplary steps of the embodiment of the present application are described below with reference to specific examples:

[0085] S101, based on the preset attribute of each first-base IP address, convert the first-base IP address into a target IP address in a target form to obtain a corresponding target IP address set.

[0086] It should be noted that the first base and the binary base are different base formats. This application is described using the first base as binary and the binary base as decimal as an example, but it does not constitute a limitation on the first base and the binary base, and can be set specifically according to actual conditions.

[0087] In an embodiment of the present application, the first-base IP address is a pre-set binary IP address, for example, a source destination address obtained from a firewall policy. The present application does not elaborate on the source of the IP address; the first-base IP address is a binary IP address, and the target form includes a binary single form and a binary list form, wherein the binary list format includes a start value and an end value, both of which are binary, the start value may be the minimum value of the IP address, and the end value may be the maximum value of the IP address, and the binary list form is [start value, end value], specifically a list form of [start value, end value] style, namely a decimal single form and a decimal list form, and the decimal single form indicates that the IP address is a single address , the decimal list form indicates that the IP address corresponds to multiple IP addresses, the target IP address is the IP address obtained after the first-base IP address is converted, the target IP address set includes multiple target IP addresses, and the binary IP address is converted accordingly according to the preset binary IP address attribute to obtain a decimal single-form target IP address, that is, a single decimal IP address and / or a decimal list-form target IP address, that is, a list-form decimal IP address in the form of [start value, end value]. The list-form decimal IP address includes multiple single IP addresses. In this way, the conversion is completed for each first-base IP address to obtain the corresponding target IP address set. Obviously, the target IP address set includes at least one target IP address.

[0088] For example, for the convenience of description, IP addresses all start with 0.0, and the beginning is omitted to represent IP addresses, for example, Figure 2 As shown, 1.0 represents the IP address 0.0.1.0, a total of 9 binary IP addresses. Convert these binary IP addresses to the corresponding decimal, such as Figure 3 As shown, for example, the binary IP address 1.0 is converted to the corresponding decimal single form, that is, the decimal IP address 256, and the binary IP addresses 1.2-1.4 are converted to the corresponding decimal list form, that is, the decimal IP address [258, 260], where the starting value and the ending value are 258 and 260 respectively. Figure 2 and Figure 3 The IP addresses correspond one to one according to the location.

[0089] S102, sorting each target IP address in the target IP address set, and merging the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set.

[0090] In an embodiment of the present application, the merged target IP address set includes a merged target IP address, each target IP address in the target IP address set in the above step S101 is sorted to obtain each sorted target IP address, and the sorted target IP addresses are merged to obtain a merged target IP address and a corresponding merged target IP address set.

[0091] It should be noted that each target IP address is sorted according to its size, for example, from large to small, or from small to large, specifically according to a classic sorting method, which will not be described here. Optionally, determine whether the target IP address is in the form of a binary list; if not, determine the starting value of the target IP address as the size of the target IP address. For example, Figure 4 As shown in FIG. 1 , it indicates the sorted target IP addresses obtained by sorting each target IP address in the above example from small to large. For example, the size of the target IP address [258, 260] is the starting value 258; Figure 5 As shown, each sorted target IP address is merged to obtain the final merged target IP address set:

[256] [258, 262][264, 265][271, 275], where the target IP address set contains 4 IP addresses, and each IP address represents a merged target IP address.

[0092] S103, calculating the minimum mask of each merged target IP address in the merged target IP address set, and converting each merged target IP address into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set.

[0093] In an embodiment of the present application, each merged target IP address corresponds to each final target IP address one-to-one, and the merged target IP address set corresponds to the final target IP address set. According to the merged target IP address obtained in step S102 and the corresponding merged target IP address set, the minimum mask of each target IP address in the merged target IP address set is calculated, and each target IP address is converted into the corresponding final target IP address according to the minimum mask of each target IP address to obtain the corresponding final target IP address set.

[0094] The method for processing the IP address set of the firewall policy provided in the embodiment of the present application converts the first-base IP address into a target IP address in a target form based on the preset attribute of each first-base IP address to obtain a corresponding target IP address set, sorts each target IP address in the target IP address set, and merges the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set, calculates the minimum mask of each merged target IP address in the merged target IP address set, and converts each merged target IP address into a final target IP address based on the minimum mask to obtain a corresponding final target IP address set. The method for processing the IP address set of the firewall policy of the present application obtains a final merged address set by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address, merges the IP addresses together in a minimal manner, improves the readability of the merged IP address set, and because there is no need to manually merge the IP addresses, avoids the merging errors caused by human intervention, ensures that the range of the merged IP address set is within the range of the actual activation request, improves network security, and thus achieves both readability and security.

[0095] Further, such as Figure 6 As shown, the "converting the first-base IP address into the target IP address based on the preset first-base IP address attribute" in step S102 in the above embodiment may specifically include the following steps:

[0096] S601, determining whether the attribute of each first-order IP address is network segment information.

[0097] In the embodiment of the present application, the attribute of each binary IP address includes network segment information, and a judgment is made as to whether the attribute of each binary IP address is network segment information, and corresponding processing is performed according to the judgment result. Figure 2 and Figure 3 As shown, binary IP address 1.0 is not network segment information, and binary IP addresses 1.2-1.4 are network segment information.

[0098] S602: If yes, convert the first-base IP address into a target IP address in a binary list format based on the start value and the end value of the first-base IP address.

[0099] In the embodiment of the present application, according to the result of determining whether the attribute of each binary IP address is network segment information in step S601, when it is determined that the attribute of the binary IP address is network segment information, the binary IP address is converted into a target IP address in the form of a decimal list based on the start value and the end value of the binary IP address. Figure 2 and Figure 3As shown, the binary IP address 1.2-1.4 is the network segment information. The starting value and the ending value of the binary IP address 1.2-1.4 are determined to be 258 and 260 respectively, and the binary IP address 1.0 is converted into the corresponding decimal list form, that is, the decimal IP address [258, 260].

[0100] S603, if not, convert the first-order IP address into a target IP address in a single binary form.

[0101] In the embodiment of the present application, according to the result of determining whether the attribute of each binary IP address is network segment information in step S601, if it is determined that the attribute of the binary IP address is not network segment information, it indicates that the binary IP address is a single IP address, and the binary IP address is converted into a single decimal target IP address. Figure 2 and Figure 3 As shown, the binary IP address 1.0 is not the network segment information, so the binary IP address 1.0 is converted into the corresponding decimal single form, that is, the decimal IP address 256.

[0102] Therefore, the binary IP address is converted accordingly according to whether the preset binary IP address is network segment information. If the binary IP address is not network segment information, the binary IP address is converted into a single decimal target IP address, i.e., a single decimal IP address. If the binary IP address is network segment information, the binary IP address is converted into a decimal list target IP address, i.e., a list-based decimal IP address in the form of [start value, end value]. In this way, the conversion is completed for each first-base IP address to obtain the corresponding target IP address set.

[0103] Further, such as Figure 7 As shown, the “merging the sorted target IP addresses” in step S102 in the above embodiment may specifically include the following steps:

[0104] S701, in response to the current target IP address being in the binary list format, determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address.

[0105] In an embodiment of the present application, the current target IP address is a single IP address in the target IP address set that is being merged, and the next target IP address (represented by next in this application) is the next target IP address of the current target IP address in the sorted target IP addresses. When judging whether the current target IP address is in the form of a binary list, when judging that the current target IP address is in the form of a binary list, further judge whether the next target IP address of the current target IP address in the sorted target IP addresses is between the starting value and the ending value of the current target IP address, that is, whether it is greater than the starting value corresponding to the current target IP address and less than the ending value corresponding to the current target IP address. In this application, A and B are used to represent the starting value and the ending value, respectively. Then the decimal list form of the current target IP address is [A, B], that is, judge whether the next target IP address of the current target IP address is greater than A and less than B.

[0106] It should be noted that, in addition to meaning greater than the starting value and less than the ending value, that is, A<next<B, "between the starting value and the ending value" in the present application can also mean greater than or equal to the starting value and less than or equal to the ending value, that is, A≤next≤B. Here, the judgment condition is described as greater than the starting value and less than the ending value, but it does not constitute a limitation to this and can be set specifically according to the situation.

[0107] S702: If yes, then delete the next target IP address in the target IP address set, add 1 to the termination value to obtain a new termination value, and determine a new current target IP address based on the new termination value.

[0108] In the embodiment of the present application, when it is determined according to step S701 that the next target IP address is between the start value and the end value corresponding to the current target IP address, that is, it indicates that the next target IP address appears repeatedly in the target IP address set, that is, the next target IP address belongs to the address set where the current target IP address is located, then the next target IP address is deleted from the target IP address set. Figure 5 As shown, the current target IP address [258, 260] is in the binary list form. If the next target IP address

[259] of the current target IP address [258, 260] is between [258, 260], then the target IP address

[259] is deleted from the sorted 9 addresses to merge the next target IP address

[259] into the current target IP address [258, 260].

[0109] Continue to determine whether the next target IP address of the next target IP address next, that is, next+1, is between the corresponding start value and end value, that is, between [A, B], and so on, to complete the determination and corresponding processing of each IP address.

[0110] It should be noted that when the target IP addresses are sorted from small to large, they can be merged from left to right.

[0111] Further, if not, the termination value is added by 1 to obtain the test termination value; in response to the test termination value being equal to the next target IP address, the test termination value is determined as the new termination value, and the new current target IP address is determined based on the new termination value, so as to merge the next target IP address into the current target IP address. Among them, the test termination value is the termination value obtained by adding 1 to the termination value. When it is determined that the next target IP address is not between the starting value A and the termination value B of the current target IP address, it means that the next target IP address does not belong to the current target IP address, and the address is not merged, but the termination value is continued to be added by 1 as the test termination value B+1. When the test termination value B+1 is equal to the next target IP address, it means that the next target IP address is adjacent to the test termination value B+1, and the test termination value B+1 is determined as the new termination value, and the new current target IP address, namely [A, B+1], is determined based on the new termination value, so as to merge the next target IP address into the current target IP address [A, B+1].

[0112] For example, Figure 5 As shown, after

[259] is merged into [258, 260], the current target IP address is [258, 260], and the next target IP address is

[261] . At this time, it is determined that the next target IP address

[261] is not between the current target IP addresses [258, 260]. Then, 1 is added to the termination value 260 of the current target IP address [258, 260] to obtain a test termination value 261. It is determined that the test termination value 261 is equal to the next target IP address

[261] . Then, the test termination value 261 is used as the new termination value of the IP address in the list form corresponding to the current target IP address [258, 260]. The corresponding new current target IP address is [258, 261], so that the next target IP address

[261] is merged into the current target IP address [258, 260] to form a new current target IP address [258, 261].

[0113] Therefore, after the merger is completed, Figure 5 As shown, the final merged target IP address set

[256] [258,262][264,265][271,275] can be obtained.

[0114] Further, such as Figure 8 As shown, the "calculating the minimum mask of each merged target IP address in the merged target IP address set" in step S103 in the above embodiment may specifically include the following steps:

[0115] S801, obtaining the number of consecutive addresses of each merged target IP address based on a preset formula for the number of consecutive addresses.

[0116] In the embodiment of the present application, after the merging of the sorted target IP addresses in the above embodiment is completed, the number of consecutive addresses of each merged target IP address is calculated based on the preset consecutive address number formula for subsequent processing. The consecutive address number formula is the following formula:

[0117] f(z)=max(z)-min(z)+1

[0118] Among them, z represents the merged target IP address, f(z) represents the number of consecutive addresses in the list of the merged target IP address, max(z) represents the maximum value in the list of the target IP address, and min(z) represents the minimum value in the list of the target IP address.

[0119] For example, Figure 5 and Fig. 9 As shown, the target IP addresses after merging are

[256] [258,262][264,265][271,275], respectively. When the target IP address after merging is

[256] , f(z)=256-256+1=1, when the target IP address after merging is [258,262], f(z)=262-258+1=5, when the target IP address after merging is [264,265], f(z)=265-264+1=2, when the target IP address after merging is [271,275], f(z)=275-271+1=5, thereby calculating the number of consecutive addresses of each target IP address after merging.

[0120] S802: Calculate the minimum mask of the target IP address based on the number of consecutive addresses and a preset minimum mask calculation formula.

[0121] In the embodiment of the present application, the minimum mask of the merged target IP address is calculated based on the number of consecutive addresses of each merged target IP address calculated in step S801 and the minimum mask calculation formula. The minimum mask calculation formula is the following formula:

[0122]

[0123] Wherein, f(y) represents the minimum mask of the merged target IP address, y represents the current address number of the target IP address, that is, the number of consecutive addresses f(z) mentioned above, that is, y=f(z), Indicates rounding up, so the minimum mask f(y) of the target IP address can be calculated based on the number of consecutive addresses f(z) of each merged target IP address and the minimum mask calculation formula.

[0124] For example, Fig. 9 As shown in Figure 2, when the combined target IP address is

[256] , f(z) = 1, then When the combined target IP address is [258,262], f(z) = 5, then When the combined target IP address is [264,265], f(z) = 2, then When the combined target IP address is [271,275], f(z) = 5, then In this way, the minimum mask of each merged target IP address is calculated.

[0125] Further, such as Fig.10 As shown, the step S103 in the above embodiment of “converting each merged target IP address into a final target IP address based on the minimum mask” may specifically include the following steps:

[0126] S1001, calculating the total number of addresses of the merged target IP address based on the minimum mask and a preset total number of addresses formula.

[0127] In the embodiment of the present application, based on the minimum mask of each merged target IP address calculated in the above embodiment and the preset address total number formula, the address total number of the corresponding target IP address is calculated for subsequent processing. The address total number formula is as follows:

[0128] f(x)=2^(32-x)

[0129] Among them, f(x) represents the total number of addresses of a certain mask, and x represents a certain mask, that is, the minimum mask f(y) in the above can be substituted into x, that is, x=f(y).

[0130] For example, Fig. 9As shown, when the merged target IP address is

[256] , f(y)=32, then f(x)=2^(32-x)=2^(32-f(y))=1, when the merged target IP address is [258,262], f(y)=29, then f(x)=2^(32-x)=2^(32-f(y))=8, when the merged target IP address is [264,265], f(y)=31, then f(x)=2^(32-x)=2^(32-f(y))=2, when the merged target IP address is [271,275], f(y)=29, then f(x)=2^(32-x)=2^(32-f(y))=8, in this way, the total number of addresses of each merged target IP address is calculated.

[0131] S1002: In response to the total number of addresses not being equal to the number of consecutive addresses, determining that the merged target IP address is not a subnet segment, and converting the merged target IP address into a final target IP address in the form of a consecutive address.

[0132] In the embodiment of the present application, it is determined whether the total number of addresses of each merged target IP address calculated in step S1001 and the number of consecutive addresses of the merged target IP address are equal. When the total number of addresses of a merged target IP address and the number of consecutive addresses are not equal, it is determined that the merged target IP address is not a subnet segment, and the merged target IP address is converted into a final target IP address in the form of a consecutive address. For example, Fig. 9 As shown, when the merged target IP address is [258,262], the total number of addresses is 8, and the number of consecutive addresses is 5, and the two are not equal, then [258,262] is not a subnet segment, and [258,262] is converted to the consecutive address range1.2-1.6, that is, range0.0.1.2-0.0.1.6. When the merged target IP address is [271,275], the total number of addresses is 8, and the number of consecutive addresses is 5, and the two are not equal, then [271,275] is not a subnet segment, and [271,275] is converted to the consecutive address range1.15-1.19, that is, range0.0.1.15-0.0.1.19.

[0133] Further, in response to the total number of addresses being equal to the number of consecutive addresses, it is determined whether the minimum value of the merged target IP address and the network bit of the merged target IP address are equal; if so, it is determined that the merged target IP address is a subnet segment, and the merged target IP address is converted into a final target IP address in the form of a subnet segment address; if not, the merged target IP address is converted into a final target IP address in the form of a consecutive address. Each IP address has a corresponding network bit. That is, when the total number of addresses and the number of consecutive addresses of a merged target IP address are equal, it is determined whether the minimum value and the network bit of the merged target IP address are equal. If they are equal, it is determined that the merged target IP address is a subnet segment, and the merged target IP address is converted into a subnet segment address form. If they are not equal, the merged target IP address is converted into a consecutive address form.

[0134] For example, Fig. 9 As shown, when the merged target IP address is [264,265], the total number of addresses is 2, and the number of consecutive addresses is 2, which are equal. The minimum value of [264,265] is 264, 264=0.0.1.8, and 0.0.1.8 / 31, the network bit is 0.0.1.8. At this time, [264,265] is determined to be a subnet segment, and [264,265] is converted to the subnet segment address 1.8 / 31, that is, 0.0.1.8 / 31; when the merged target IP address is

[256] , the minimum value of

[256] and the network bit are not equal, then

[256] is converted to 1.0 / 32, that is, 0.0.1.0 / 32.

[0135] To better describe the method for processing the IP address set of the firewall policy of this application, the following is combined with Fig.11a and Fig.11b Further examples are given.

[0136] like Fig.11a and Fig.11bAs shown, the final merged address set is obtained by performing address conversion, address sorting, address splitting (address merging) and calculation merging (address conversion) on each IP address. Among them, in the address conversion, it is involved to judge whether the conversion is completed. When the conversion is not completed, it is judged whether the IP address is a network segment. If so, it is converted to list[A,B] style, that is, decimal list form. If not, it is converted to decimal, that is, decimal single form, until the conversion of each IP address is completed and the next address sorting is performed; in the address sorting, it is involved to judge whether the sorting is completed. When the sorting is not completed, it is judged whether the current IP address is [A,B]. If so, A is used as the size of the address for comparison and calculation. If not, the size is compared normally until the address sorting of each IP address is completed and the next step of address splitting is performed; in the split address, it is involved to judge whether the splitting is completed. When the splitting is not completed, it is judged whether the value of the current IP address is [A,B]. If so, it is judged that A≤n ext≤B, if so, the next address next is deleted from the address set, and next=next+1 is performed to continue the judgment of A≤next≤B; if not, that is, the value of the current IP address is not [A,B], then the judgment of next==B+1 is performed, and if so, the next IP address is merged into the previous list, that is, the list where the current IP address is located, if not, it is split into a new list, until the next step of calculation and merging is performed after the splitting of each IP address is completed; in the calculation and merging, it is involved to judge whether the merger is completed. When the merger is not completed, the minimum mask of the current IP address is calculated, and it is judged that the number of network addresses is == the length of the split list. If the number of network addresses is equal to the length of the split list, the IP address is converted into a natural network segment subnet. If the number of network addresses is not equal to the length of the split list, the IP address is converted into a continuous network number range, until the conversion of each IP address is completed, the processing flow of the IP address set of the firewall policy of this application is ended.

[0137] Fig.12 is a structural diagram of an IP address set processing device according to a firewall policy provided in an embodiment of the present application, such as Fig.12 As shown, the IP address set processing device 1200 of the firewall policy of the embodiment of the present application may specifically include:

[0138] The first conversion module 1201 is used to convert each first-base IP address into a target IP address in a target form based on the preset attributes of the first-base IP address, and obtain a corresponding target IP address set; wherein the target form includes a binary single form and a binary list form.

[0139] The merging module 1202 is used to sort each target IP address in the target IP address set, and merge the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set.

[0140] The first acquisition module 1203 is used to calculate the minimum mask of each merged target IP address in the merged target IP address set, and convert each merged target IP address into a final target IP address based on the minimum mask to obtain the corresponding final target IP address set.

[0141] In a possible implementation manner, the binary list format includes a start value and an end value; and the first conversion module is specifically configured to:

[0142] Determine whether the attribute of each first-order IP address is network segment information;

[0143] If yes, convert the first-base IP address into a target IP address in a second-base list form based on the start value and the end value of the first-base IP address;

[0144] If not, the first-order IP address is converted into a target IP address in a binary single form.

[0145] In a possible implementation, the merging module is specifically used to:

[0146] In response to the current target IP address being in the binary list form, determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address;

[0147] If so, the next target IP address is deleted from the target IP address set.

[0148] In a possible implementation manner, the device for processing the IP address set of the firewall policy further includes:

[0149] The second acquisition module is used for, if not, adding 1 to the termination value to obtain a test termination value;

[0150] The determination module is used to determine the test termination value as a new termination value in response to the test termination value being equal to the next target IP address, and determine a new current target IP address based on the new termination value to merge the next target IP address into the current target IP address.

[0151] In a possible implementation manner, the first acquisition module is specifically configured to:

[0152] Obtain the number of consecutive addresses of each merged target IP address based on a preset consecutive address number formula;

[0153] The minimum mask of the target IP address is calculated based on the number of consecutive addresses and the preset minimum mask calculation formula.

[0154] In a possible implementation manner, the first acquisition module is specifically configured to:

[0155] Calculate the total number of addresses of the merged target IP address based on the minimum mask and a preset total number of addresses formula;

[0156] In response to the total number of addresses not being equal to the number of consecutive addresses, it is determined that the merged target IP address is not a subnet segment, and the merged target IP address is converted into a final target IP address in the form of a consecutive address.

[0157] In a possible implementation manner, the device for processing the IP address set of the firewall policy further includes:

[0158] A judging module, configured to judge whether the minimum value of the combined target IP address and the network bit of the combined target IP address are equal in response to the total number of addresses being equal to the number of consecutive addresses;

[0159] A second conversion module is used to determine that the combined target IP address is a subnet segment, and convert the combined target IP address into a final target IP address in the form of a subnet segment address;

[0160] The third conversion module is used for converting the combined target IP address into a final target IP address in the form of a continuous address if no.

[0161] The processing device of the IP address set of the firewall policy provided in the embodiment of the present application converts the first-base IP address into a target IP address in a target form based on the attribute of each preset first-base IP address, obtains the corresponding target IP address set, sorts each target IP address in the target IP address set, merges the sorted target IP addresses, obtains the merged target IP address and the corresponding merged target IP address set, calculates the minimum mask of each merged target IP address in the merged target IP address set, and converts each merged target IP address into a final target IP address based on the minimum mask to obtain the corresponding final target IP address set. The processing device of the IP address set of the firewall policy of the present application obtains the final merged address set by performing address system conversion, address sorting, address merging and address conversion on each first-base IP address, merges the IP addresses together in a minimal manner, improves the readability of the merged IP address set, and avoids the merging errors caused by human intervention because the IP addresses do not need to be manually merged, ensures that the range of the merged IP address set is within the range of the actual activation request, improves network security, and thus achieves both readability and security.

[0162] like Fig.13 As shown, an electronic device 1300 provided in an embodiment of the present application includes: a processor 1301, a memory 1302 and a bus, the memory 1302 stores machine-readable instructions executable by the processor 1301, and when the electronic device is running, the processor 1301 communicates with the memory 1302 through the bus, and the processor 1301 executes the machine-readable instructions to perform the steps of the method for processing the IP address set of the above-mentioned firewall policy.

[0163] Specifically, the above-mentioned memory 1302 and processor 1301 can be general-purpose memory and processor, which are not specifically limited here. When the processor 1301 runs the computer program stored in the memory 1302, it can execute the processing method of the IP address set of the above-mentioned firewall policy.

[0164] Corresponding to the method for processing the IP address set of the above-mentioned firewall policy, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, the steps of the method for processing the IP address set of the above-mentioned firewall policy are executed.

[0165] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0166] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0168] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the deployment method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0169] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing an IP address set of a firewall policy, characterized in that: The processing method comprises: Based on the preset attributes of each first-base IP address, the first-base IP address is converted into a target IP address in a target form to obtain a corresponding target IP address set; wherein the target form includes a binary single form and a binary list form; the binary list form includes a start value and an end value; the first-base IP address is converted into a target IP address in a target form based on the preset attributes of each first-base IP address, including: determining whether the attribute of each first-base IP address is network segment information; if so, converting the first-base IP address into a target IP address in the binary list form based on the start value and the end value of the first-base IP address; if not, converting the first-base IP address into a target IP address in a binary single form; Sorting each target IP address in the target IP address set, and merging the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set; merging the sorted target IP addresses includes: in response to the current target IP address being in the binary list form, determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address; if so, deleting the next target IP address from the target IP address set; Calculate the minimum mask of each merged target IP address in the merged target IP address set, and convert each merged target IP address into a final target IP address based on the minimum mask to obtain the corresponding final target IP address set; the calculation of the minimum mask of each merged target IP address in the merged target IP address set includes: obtaining the number of consecutive addresses of each merged target IP address based on a preset consecutive address number formula; calculating the minimum mask of the target IP address based on the consecutive address number and a preset minimum mask calculation formula; converting each merged target IP address into a final target IP address based on the minimum mask includes: calculating the total number of addresses of the merged target IP address based on the minimum mask and a preset total number of addresses formula; in response to the total number of addresses not being equal to the number of consecutive addresses, determine that the merged target IP address is not a subnet segment, and convert the merged target IP address into a final target IP address in the form of a continuous address; In response to the total number of addresses being equal to the number of consecutive addresses, determining whether the minimum value of the combined target IP address and the network bit of the combined target IP address are equal; If so, determining that the combined target IP address is a subnet segment, and converting the combined target IP address into a final target IP address in the form of a subnet segment address; If not, the combined target IP address is converted into a final target IP address in the form of a continuous address.

2. The method according to claim 1, characterized in that The step of determining whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address further includes: If not, then add 1 to the termination value to obtain the test termination value; In response to the test termination value being equal to the next target IP address, the test termination value is determined as a new termination value, and a new current target IP address is determined based on the new termination value to merge the next target IP address into the current target IP address.

3. A device for processing an IP address set of a firewall policy, characterized in that: The processing device comprises: The first conversion module is used to convert each first-base IP address into a target IP address in a target form based on the preset attributes of the first-base IP address, and obtain a corresponding target IP address set; wherein the target form includes a binary single form and a binary list form; the binary list form includes a start value and an end value; the first conversion module is specifically used to: determine whether the attribute of each first-base IP address is network segment information; if so, convert the first-base IP address into a target IP address in the binary list form based on the start value and the end value of the first-base IP address; if not, convert the first-base IP address into a target IP address in a binary single form; a merging module, configured to sort each target IP address in the target IP address set, and merge the sorted target IP addresses to obtain a merged target IP address and a corresponding merged target IP address set; the merging module is further configured to, in response to the current target IP address being in the binary list form, determine whether the next target IP address of the current target IP address in the sorted target IP addresses is between the start value and the end value corresponding to the current target IP address; if so, delete the next target IP address from the target IP address set; The first acquisition module is used to calculate the minimum mask of each merged target IP address in the merged target IP address set, and convert each merged target IP address into a final target IP address based on the minimum mask to obtain the corresponding final target IP address set; the first acquisition module is specifically used to: obtain the number of consecutive addresses of each merged target IP address based on a preset consecutive address number formula; calculate the minimum mask of the target IP address based on the consecutive address number and the preset minimum mask calculation formula; the first acquisition module is also specifically used to: calculate the total number of addresses of the merged target IP address based on the minimum mask and the preset total number of addresses formula; in response to the total number of addresses not being equal to the number of consecutive addresses, determine that the merged target IP address is not a subnet segment, and convert the merged target IP address into a final target IP address in the form of a continuous address; a judgment module, configured to judge whether the minimum value of the combined target IP address and the network bit of the combined target IP address are equal in response to the total number of addresses being equal to the number of consecutive addresses; a second conversion module, for determining that if so, the combined target IP address is a subnet segment, and converting the combined target IP address into a final target IP address in the form of a subnet segment address; The third conversion module is used to convert the combined target IP address into a final target IP address in a continuous address form if no.

4. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the method for processing the IP address set of the firewall policy as described in any one of claims 1 to 2 are performed.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for processing an IP address set of a firewall policy as claimed in any one of claims 1 to 2 are executed.

Images