Firewall Automated Allocation and Configuration Methods and Storage Media for Security Requirements Analysis

Abstract

This invention belongs to the field of automated orchestration of network security devices, and provides a method and storage medium for automated allocation and configuration of firewalls based on security requirements analysis. The aim is to solve the problems of low efficiency, resource waste, and error susceptibility in traditional manual orchestration and configuration of network security devices. The main solution includes: abstracting and constructing a network model, simultaneously building a set of custom network security requirements and associated triples; performing path sharing analysis by traversing the topology graph and the set of associated triples to obtain the path sequence corresponding to each triple and updating the path sharing; performing trial allocation of firewalls, sorting by path sharing and selecting the location with the highest path sharing for trial allocation; generating firewall rules and eliminating satisfied security requirements, generating firewall rules based on the path sequence corresponding to the trial allocation location and the network security requirements, and updating the network security requirements. This invention is used for network security.

Description

Technical Field

[0001] This invention belongs to the field of automated orchestration of network security devices, and provides a method and storage medium for automated allocation and configuration of firewalls based on security requirements analysis. Background Technology

[0002] With the increasing complexity and variety of cyberattack methods and the continuous evolution of cybersecurity threats, traditional defense methods that rely on manual orchestration and configuration of network security devices based on network security needs are no longer effective in dealing with attack formats that require rapid response. This manual orchestration and configuration method is inefficient, especially given the rapid growth in network scale and exponential increase in complexity. It not only makes it easier to over-deploy firewalls, leading to wasted resources, but also increases the likelihood of configuration errors, thus significantly increasing the risk of system attacks and successful intrusion.

[0003] In view of this, the present invention proposes a method for automatically allocating and configuring firewalls. This method offers greater speed and flexibility, enabling firewalls to be reorganized according to changing network security needs and respond promptly to new threats and attacks. This method not only effectively reduces the number of firewalls deployed, thereby lowering overall costs, while ensuring network security requirements are met, but also reduces the risk of operational errors, significantly improving system reliability and security. Summary of the Invention

[0004] The purpose of this invention is to address the problems of inefficiency, resource waste, and error-proneness associated with traditional manual orchestration and configuration of network security devices. By automating the allocation and configuration of firewalls, this solution can quickly respond to new threats and attacks, while reducing the number of firewalls deployed, lowering security overhead, and improving system reliability and security.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] This invention provides a method for automated allocation and configuration of firewalls based on security requirements analysis, comprising the following steps:

[0007] The network is modeled and constructed, and custom network security requirements and related triple sets are built.

[0008] Path sharing analysis is performed by traversing the topology graph and the set of associated triples to obtain the path sequence corresponding to each triple and update the path sharing.

[0009] Perform firewall trial allocation, sort by path sharing degree, and select the location with the highest path sharing degree to try allocating the firewall;

[0010] Generate firewall rules and eliminate satisfied security requirements. Based on the path sequence corresponding to the trial allocation location and network security requirements, generate firewall rules and update network security requirements.

[0011] The above method involves model abstraction and construction of the network, including the following steps:

[0012] Terminal devices and other devices except firewalls are abstracted as nodes in the graph, and the connections between them are abstracted as edges, thus establishing the initial network topology graph;

[0013] The real network topology is modeled as a connected, undirected, unweighted, acyclic graph model G(V,E), where the set V = D∪S = {v1, v2, ..., v...} n Let D = {d1, d2, ..., dn} represent the set of network nodes. x} represents the set of terminal devices, S = {s x+1 s x+2 , ..., s x+y Let} represent the set of devices excluding firewalls, x + y = n, and set E = {e1, e2, ..., e}. m Define the connection relationships between network nodes, where any edge e k (1≤k≤m) represents the two nodes v connected by this edge. i and v i A bidirectional direct connection relationship (1≤i≤n, 1≤j≤n and i≠j);

[0014] Establish the mapping relationship between IP address mapping table and network node addr(v i ), addr(v i ) represents a network node v in the network topology graph. i The corresponding IP address;

[0015] Create a subnet set group of nodes: SubnetSet = {SS1, SS2, ..., SS} num};

[0016] Define the path share degree attribute of the edges as {ε1, ε2, ..., ε...} m}, and initialized to 0, ε k

[0017] =0 (1≤k≤m), ε k Indicates the degree of path sharing.

[0018] The above method involves constructing custom network security requirements, including the following steps:

[0019] User-defined network security requirements (nsr) are modeled using a six-tuple (sIp, dIp, protocol, sPort, dPort, type), where sIp, dIp, protocol, sPort, and type are the cores. o rt represents the source IP, destination IP, protocol, source port, and destination port, respectively. type defines the connectivity attribute of the data packet in the network. nsr.x represents a network security requirement and a value of an element in nsr, where x∈{sIp,dIp,protocol,sPort,dPort,type}.

[0020] The importance δ value of each NSR is calculated using the calculation rules.

[0021] In the above method, the calculation rule is specifically as follows:

[0022] Define the get(nsr) function to calculate the δ value of an NSR, which is the final δ value obtained after all the calculation rules are satisfied;

[0023] The get(nsr) function is defined as follows:

[0024] The δ value of all NSRs is initialized to 1, indicating that all NSRs are of equal importance initially.

[0025] Repeat step A until all δ values ​​of NSR have been calculated according to all satisfied calculation rules:

[0026] Step A: For each NSR, iterate through all calculation rules and check if they are satisfied. If an NSR satisfies a calculation rule, update the δ value of the NSR according to the δ calculation method corresponding to that calculation rule.

[0027] The above method involves constructing a set of associated triples, including the following steps:

[0028] Using terminal device d r1 Terminal equipment d r2 and terminal equipment d r1 and terminal equipment d r2 The corresponding correlation θ r The set of associative triples P = {p1, p2, ..., p...} is defined by values. q}, p r =(d r1 ,d r2 ,θ r The construction method of the set of associated triples P and the degree of association θ r The value is calculated as follows:

[0029] Initialize set P = {}, for d r1∈D、d r2 ∈D, r1≠r2, find addr(d r1 ), addr(d r2 In the network security requirement securityR, if all NSRs can be matched simultaneously for both the source and destination IP addresses, and the δ value is obtained using get(nsr), then θ r It is the sum of all obtained δ values, d r1 d r2 θ r Add it to the set of triples P.

[0030] The path sharing analysis in the above method specifically includes the following steps:

[0031] Traverse the topological graph and find all the associated triples p in the set P of associated triples. r =(d r1 d r2 θ r According to d r1 Assigned to the corresponding subnet node set SS ix SS ix ∈SubnetSet, and add SS ix The corresponding subnet triplet mapping set SAS of the associated triplet ix And map each subnet triplet to the SAS set ix Create the corresponding path collection SASpath

[0032] Mapping set SAS for each subnet triplet ix The associated triple p k =(d k1 d k2 θ k Perform a depth-first search to generate the path sequence SASpath. ix and with θ k Update the edge e contained in the path sequence k Path sharing degree ε k ;

[0033] Subnet triple mapping set SAS ix Other associated triples in the set are updated with path sharing degree based on the shared path.

[0034] SAS mapping set for all subnet triples ix Processing yields the path sequences and path sharing degrees corresponding to all associated triples.

[0035] The firewall trial allocation method described above specifically includes the following steps:

[0036] Sort the paths by degree of sharing, and try to allocate a firewall at the location with the highest degree of sharing. If there are multiple locations with the highest degree of sharing, generate a random number and select a firewall location to try to allocate based on the defined mapping relationship between the random number and the location.

[0037] At the selected firewall location, securityR generates corresponding rules in the firewall based on network security requirements and eliminates the security requirements that have already been met. If all security requirements are met, the task is complete. If only some are met, the remaining securityR is used to find associated triples, re-analyze path sharing, and repeat the firewall trial allocation until all security requirements are met.

[0038] The above method, which generates firewall rules and eliminates already satisfied security requirements, includes the following steps:

[0039] Establish rules based on the NSR corresponding to the associated triplet of the edge where the firewall location is located;

[0040] Iterate through all NSRs and check whether each rule created completely conflicts with the original NSR;

[0041] If there is no complete conflict, generate rules and modify or delete the original NSR, then attempt to assign successfully.

[0042] If there is a complete conflict, the allocation attempt will fail, and the calculation rules need to be adjusted, such as modifying or deleting the original calculation rules.

[0043] Check and merge the rules on each successfully assigned firewall.

[0044] Because the present invention adopts the above-described technical solution, it has the following beneficial effects:

[0045] 1. Automated Network Topology Modeling: By abstracting network devices as graph nodes and connections as edges, automated network topology modeling is achieved. This technique solves the problems of complex network topology descriptions and difficulty in dynamic updates in traditional methods, achieving the effect of quickly constructing and updating network topology graphs, and providing a foundation for subsequent network security analysis.

[0046] 2. Custom Network Security Requirements Modeling: Network security requirements are defined using a six-tuple, and the importance of different requirements is measured through calculation rules. This technique solves the problem of difficulty in quantifying and prioritizing network security requirements in traditional methods, achieving the effect of classifying and ranking network security requirements according to their importance, which helps determine the priority of firewall allocation.

[0047] 3. Construction of Associated Triple Sets: This technique associates network devices with security requirements, facilitating the analysis of data flow and path sharing. It addresses the problem of weak correlation between network devices and security requirements in traditional methods, making precise analysis difficult. This achieves a clear association between network devices and security requirements, providing a basis for accurate firewall allocation.

[0048] 4. Path Sharing Analysis: By analyzing path sharing, the method of this invention can optimize the deployment location of firewalls and reduce unnecessary firewall deployments. This technique solves the problem of insufficient data support for firewall deployment in traditional methods, which may lead to resource waste. It achieves the effect of optimizing firewall deployment based on path sharing, thereby improving resource utilization.

[0049] 5. Firewall Trial Allocation: Firewalls are trial-allocated based on path sharing priority, prioritizing locations with the highest sharing degree, thus improving allocation efficiency. This technique addresses the lack of data support and low efficiency in traditional firewall allocation methods, achieving efficient trial allocation based on path sharing degree and reducing unnecessary firewall deployments.

[0050] 6. Firewall Rule Generation and Security Requirement Elimination: Rules are generated based on firewall location and network security requirements, and already satisfied security requirements are eliminated. This technique solves the problems of cumbersome and error-prone firewall rule generation in traditional methods, achieving accurate generation of firewall rules and elimination of satisfied security requirements, thus ensuring the accurate implementation of network security policies.

[0051] 7. Reduced Human Error: Automated processing reduces potential errors from manual operations, improving the accuracy and security of network configuration. This technology solves the problems of error-prone and inefficient manual configuration in traditional methods, thus improving the accuracy and security of network configuration.

[0052] 8. Improved Resource Utilization: By optimizing firewall deployment, resource waste is reduced and the effective utilization rate of network resources is improved. This technique solves the problem of insufficient data support and potential resource waste in traditional firewall deployment methods, thus achieving the effect of improving network resource utilization.

[0053] 9. Reduced Security Overhead: Automated configuration reduces unnecessary security measures and lowers security overhead. This technique addresses the problem of traditional methods lacking data support for security measures and potentially leading to over-protection, thus achieving the effect of reducing security overhead.

[0054] 10. Adaptability: It can quickly adapt to changes in the network security environment, improving network security and reliability. This technology solves the problem that traditional network security strategies are difficult to adapt to environmental changes quickly, thus achieving the effect of improving network security and reliability. Attached Figure Description

[0055] Figure 1 Here is a flowchart of an automated firewall allocation and configuration method proposed in this invention;

[0056] Figure 2 This is the initial network topology diagram;

[0057] Figure 3 A network topology abstract model diagram;

[0058] Figure 4 This represents the mapping relationship between IP addresses and network nodes.

[0059] Figure 5 Customize the requirements table for users;

[0060] Figure 6 For the rule table;

[0061] Figure 7 The updated path sharing degree;

[0062] Figure 8 Then, iterate through nsr1-nsr13 to generate the rule table for firewall fw1 at that location;

[0063] Figure 9 For the rule table of fw2;

[0064] Figure 10 This is the final fw1 table;

[0065] Figure 11 This is the final fw2 table. Detailed Implementation

[0066] The embodiments of the present invention will be described in detail below. Although the present invention will be described and illustrated in conjunction with some specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, any modifications or equivalent substitutions made to the present invention should be covered within the scope of the claims of the present invention.

[0067] Furthermore, to better illustrate the present invention, numerous specific details are set forth in the following detailed embodiments. Those skilled in the art will understand that the present invention can be practiced without these specific details.

[0068] Example 1

[0069] The implementation process and method of the present invention will be further described below. A method for automated allocation and configuration of firewalls based on security requirements analysis includes:

[0070] S1: Model Abstraction and Construction: The network is modeled and constructed to obtain a custom network security requirement and a set of associated triples.

[0071] Specifically, this embodiment is illustrated using the network topology shown in the figure, and includes the following sub-steps:

[0072] S101: Reference Figure 2 Network topology abstraction and construction: In a network, terminal devices and other devices besides firewalls are abstracted as nodes in the graph, and the connections between them are represented as edges. An initial network topology graph is established, modeling the real network topology as a connected, undirected, unweighted, acyclic graph model G(V,E).

[0073] refer to Figure 4 Let the set be D ∪ S = {v1, v2, v3, v4, v5, v6, v7, v8, v9, v...}. 10 Let} represent the set of network nodes (terminal devices, devices other than firewalls). Where D = {d1, d2, d3, d4, d5, d6, d7} represents the set of terminal devices, and S = {s8, s9, s...} 10} represents a collection of devices other than firewalls.

[0074] refer to Figure 3 Establish the correspondence between the IP mapping table and the network nodes, i.e., addr(v i ) represents a network node v in the network topology graph. i The corresponding IP address.

[0075] Create a subnet set group SubnetSet = {SS1, SS2, SS3, SS4} consisting of four terminal sets (subnet node sets SS) with the same subnet number. Then, group the terminals whose IP addresses have the same first 24 bits. i Add a subnet node set SS, if d i If the first 24 bits of a node are different from those of other terminal devices, then a new subnet node set SS = {} is created, where SS = SS ∪ {d}. i}={d i}

[0076] In this embodiment, SS1 = {d1, d2}, SS2 = {d3}, SS3 = {d4}, and SS4 = {d5, d6, d7}.

[0077] Let E = {e1, e2, e3, e4, e5, e6, e7, e8, e9} define the connection relationships between network nodes, where any edge e k (1≤k≤9) represents the two nodes v connected by this edge. i and v j (1≤i≤10, 1≤j≤10 and i

[0078] A bidirectional direct connection is defined for edges ≠j). The path sharing attribute of an edge is represented by Sharedegree = {ε1, ε2, ε3, ε4, ε5, ε6, ε7, ε8, ε9}, where ε... k =0 (1≤k≤9).

[0079] S102: Custom Network Security Requirements: SecurityR Abstraction and Construction

[0080] We use a six-tuple (sIp, dIp, protocol, sPort, dPort, type) to model 14 user-defined network security requirements (nsr). The five-tuple (sIp, dIp, protocol, sPort, dPort) defines the characteristics of the data packet, where sIp, dIp, protocol, sPort, and dPort represent the source IP, destination IP, protocol, source port, and destination port, respectively, and type defines the connectivity attribute of the data packet in the network, type ∈ {isolated, reach}. Let nsr.x represent a value of an element in a network security requirement (nsr), where x ∈ {

[0081] sIp, dIp, protocol, sPort, dPort, type}, user-defined requirements such as Figure 5 .

[0082] The δ value is used to measure the importance of different NSRs, and calculation rules are designed. The get(nsr) function is defined as the final δ value obtained after calculating the δ value of a single NSR using the δ calculation methods corresponding to all calculation rules satisfied by that NSR.

[0083] The get(nsr) function is as follows:

[0084] If an NSR satisfies one calculation rule, then the δ value of that NSR is calculated according to the δ calculation method corresponding to that rule. Initially, all NSRs have the same importance, so δ = 1. After calculating the δ value of each NSR according to all the calculation rules satisfied by that NSR, the final δ value corresponding to each NSR is obtained.

[0085] refer to Figure 6It can be seen from the rules that get(nsrl)=get(nsr2)=get(nsr3)=get(nsr4)=get(nsr8)=get(nsr9)=get(nsr13)=get(nsr14)=1, get(nsr7)=get(nsr12)=1.25, get(nsr5)=get(nsr6)=get(nsr1 0)=get(nsr1 1)=1.5625.

[0086] S103: Abstraction and Construction of Association Triple Sets

[0087] Using terminal device d r1 Terminal equipment d r2 and terminal equipment d r1 and terminal equipment d r2 The corresponding correlation θ r The set of associative triples P = {p1, p2, ..., p...} is defined by values. q}, p r =(d r1 ,d r2 ,θ r The construction method of set P and its correlation θ r The value is calculated as follows:

[0088] Initialize P = {}, for d r1 ∈D、d r2 ∈D, r1≠r2, find addr(d r1 ), addr(d r2 In the network security requirement securityR, if all NSRs can be matched simultaneously for both the source and destination IP addresses, and the δ value is obtained using get(nsr), then θ r It is the sum of all obtained δ values, that is:

[0089]

[0090]

[0091] d r1 d r2 θ r Add it to the set of triples P.

[0092] The set of triples constructed according to the above calculation method is P = {(d1, d5, 1), (d1, d6, 1), (d1, d7, 1), ...

[0093] (d2,d5,1), (d2,d6,1), (d2,d7,1),

[0094] (d3,d6,1), (d3,d7,1), (d3,d5,4.375), (d5,d3,1), (d4,d5,1), (d4,d6,4.375), (d6,d4,1), (d4,d3,1)}

[0095] S2: Path sharing analysis: Perform path sharing analysis by traversing the topology graph and the set of associated triples to obtain the path sequence corresponding to each triple and update the path sharing.

[0096] Based on the obtained set of associated triples P, traverse the topological graph to obtain d in P. r1 to d r2 A path sequence of length l, nodePath.

[0097] `nodePath` is a sequence consisting of alternating `l+1` vertices and `l` edges. Where l≥1,

[0098] From step S101, we know that Sharedegree={ε1,ε2,ε3,ε4,ε5,ε6,ε7,ε8,ε9} represents the path sharing attribute of the edges, ε k =0 (1≤k≤9);

[0099] Traverse the set of associative triples: For each triple in P, based on the first two attributes of the triple, i.e., d... r1 d r2 Combining the subnet node set group, from d r1 Initially, the search found d r2 All paths were analyzed, and their share degree was determined. The specific analysis process is as follows:

[0100] S201: Put all associated triples p r =(d r1 d r2 θ r According to d r1 Find the corresponding subnet node set SS in the subnet node set group. ix SS ix ∈SubnetSet, add SS ix The corresponding subnet triplet mapping set SAS of the associated triplet ix SAS ix Initially, it is an empty set. That is:

[0101] SAS ix ={}

[0102]

[0103] Create a corresponding path set SASpath for each set of subnet triples, i.e.

[0104]

[0105] The subnet triplet mapping sets of all associated triplets obtained according to the above formula are as follows: SAS1 = {(d1, d5, 1), (d1, d6, 1), (d1, d7, 1), (d2, d5, 1), (d2, d6, 1), (d2, d7, 1)}, SAS2 = {(d3, d6, 1), (d3, d7, 1), (d3, d6, 1), (d3, d7, 1)}, ... s ,4.375)}, SAS3={(d4,d5,1), (d4,d6,4.375), (d4,d3,1)}, SAS4={(d5,d3,1), (d6,d4,1)}

[0106] SASpath1={}, SASpath2={}, SASpath3={}, SASpath4={}

[0107] S202: Select any subnet triplet mapping set SASi x The associated triple p k =(d k1 d k2 θ k ). currentPath = (), starting node d k1 Mark the node as visited and record the visit information. Push the starting node onto the stack. When the stack is not empty, pop a node (the current node) from the stack. X Record the node, currentPath = (currentPath, v x Determine if node d is equal to target node d. k2 If the current node equals the target node, then SASpath ix =SASpath ix ∪currentPath; If the current node is not equal to the target node, then obtain all adjacent nodes among the unvisited nodes and record the connection edges e between the current node and its adjacent nodes. y Then, currentPath = (currentPath, ey), its adjacent nodes are marked as visited, and they are pushed onto the stack. This process continues until the stack is empty, meaning all reachable nodes have been visited, resulting in the path sequence SASpath. ix According to SASpath ix The path sequence in θk Update the edge e contained in the path sequence k Path sharing degree ε k .Right now:

[0108]

[0109] ε k =ε k +θ k

[0110] Without loss of generality, let's assume we choose the associative triple (d1, d5, 1). Then initially...

[0111] SASpath1={(d1, e1, s8, e3, s9, e6, s 10 ,e7,d5)}

[0112] ε1 = 1, ε3 = 1, ε6 = 1, ε7 = 1, and the shared degree of other paths is 0.

[0113] S203: Other associated triples in the subnet triplet mapping set share all paths with this associated triplet in the path sequence except for the head node to the sinking node (the first node ∈ S in the nodepath sequence) and the sinking node (the last node ∈ S in the nodepath sequence) to the tail node. Thus, the nodePath of other associated triples in the subnet triplet mapping set can be obtained, and the path sharing degree on the edge can be updated according to the nodePath.

[0114]

[0115] ε1 = 3, ε2 = 3, ε3 = 6, ε6 = 6, ε7 = 2, ε8 = 2, ε9 = 2, and the shared degree values ​​of other paths remain unchanged.

[0116] S204: Repeat the above steps for all subnet triple mapping sets. Obtain the path sequence corresponding to all associated triples and the path sharing degree corresponding to the current security requirements. The updated path sharing degree is referenced. Figure 7 .

[0117] S3: Firewall Trial Allocation: Perform firewall trial allocation, sort by path sharing degree, and select the location with the highest path sharing degree to try allocating the firewall.

[0118] S301: Sort the obtained path sharing scores and attempt to allocate a firewall at the location with the highest path sharing score. If there is more than one location with the highest path sharing score, generate a random number and select a firewall location to attempt allocation based on the defined mapping relationship between the random number and the location.

[0119] In this embodiment, the highest path sharing position is e6, so we choose to try to insert and allocate a firewall at the connection position of s9 and s10.

[0120] S302: After selecting the firewall location for trial allocation, based on the customized network security requirements (securityR), follow the steps in S4 to generate corresponding rules in the firewall and eliminate any security requirements that can be satisfied. If all security requirements are satisfied, the task of automatically configuring the firewall is complete. If only some security requirements are satisfied, use the eliminated securityR as input to find the associated triples corresponding to the eliminated securityR, find the corresponding path sequences, re-analyze the path sharing degree, and repeat S3 until all security requirements are satisfied.

[0121] S4: Generate firewall rules and eliminate security requirements: Perform firewall trial allocation, sort by path sharing degree, and select the location with the highest path sharing degree to try allocating the firewall.

[0122] Based on the NSR corresponding to the associated triplet of the edge containing the firewall location, rules are established. All NSRs are traversed, and each rule creation checks for complete conflict with the original NSR. If there is no complete conflict, a rule is generated, and the original NSR is modified or even deleted, attempting allocation successfully. If there is a complete conflict, allocation fails, and the calculation rules need to be adjusted.

[0123] Check the rules on each successfully assigned firewall and merge the rules.

[0124] In this embodiment, the path sequence corresponding to the edge where the firewall location is located includes the following associated triples: (d1, d5, 1), (d1, d6, 1), (d1, d7, 1), (d2, d5, 1), (d2, d6, 1), (d2, d7, 1).

[0125] (d3, d6, 1), (d3, d7, 1), (d3, d5, 4.375), (d5, d3, 1), (d4, d5, 1), (d4, d6, 4.375), (d6, d4, 1), corresponding to nsr1-nsr13. Then, iterate through nsrl-nsr13 to generate the firewall FWL rules for that location, such as... Figure 8 As shown.

[0126] At this point, only NSR14 remains an unmet security requirement. Analyzing the associated triple (d4, d3, 1) corresponding to NSR14, we re-analyze the path sharing degree ε4 = 1, ε5 = 1, and the remaining path sharing degrees are 0. There are two identical path sharing degrees, so the generated random number [0, 1] can be used with 0.5 as the boundary. [0, 0.5] is used to try allocating a firewall on the e4 edge. (0.5, 1) is used to try allocating a firewall on the e5 edge. Let's assume a firewall is allocated on the e4 edge, generating a rule for fw2, such as... Figure 9 As shown. All security requirements are met, and the rules of fw1 and fw2 are merged separately. The final fw1 is as follows. Figure 10 As shown, the final fw2 is as follows: Figure 11 As shown.

Claims

1. A method for automated allocation and configuration of firewalls based on security requirements analysis, characterized in that, Includes the following steps: The network is modeled and constructed to obtain a topology graph, and at the same time, custom network security requirements and a set of associated triples are constructed. Path sharing analysis is performed by traversing the topology graph and the set of associated triples to obtain the path sequence corresponding to each triple and update the path sharing. Perform firewall trial allocation, sort by path sharing degree, and select the location with the highest path sharing degree to try allocating the firewall; Generate firewall rules and eliminate satisfied security requirements. Based on the path sequence and network security requirements corresponding to the trial allocation location, generate firewall rules and update network security requirements. Developing custom network security requirements includes the following steps: User-defined network security requirements (NSR) are modeled using a six-tuple (sIp, dIp, protocol, sPort, dPort, type). Here, sIp, dIp, protocol, sPort, and dPort represent the source IP, destination IP, protocol, source port, and destination port, respectively. The type defines the connectivity attribute of the data packet in the network. nsr.x represents a specific element value in an NSR requirement, where x... {sIp,dIp,protocol,sPort,dPort,type}; The importance of each NSR is calculated using the calculation rules. value; Constructing a set of associative triples includes the following steps: Using terminal devices Terminal equipment and terminal equipment and terminal equipment Corresponding correlation The set of associated triples P = { is defined by the value} }, The construction method and correlation degree of the set of associated triples P The value is calculated as follows: Initialize set P = {}, for D、 D, , found 𝑎dd𝑟( ), 𝑎dd𝑟( In the network security requirement securityR, all NSRs that can simultaneously match source and destination IP addresses are used. get Value, then It is all that is obtained The sum of values ​​will Add it to the set of triples P.

2. The firewall automated allocation and configuration method for security requirements analysis according to claim 1, characterized in that, The process of model abstraction and construction of a network includes the following steps: Terminal devices and other devices except firewalls are abstracted as nodes in the graph, and the connections between them are abstracted as edges, thus establishing the initial network topology graph; Model the real network topology as a connected, undirected, unweighted, acyclic graph. , where set Let D represent the set of network nodes, where D = { } represents the set of terminal devices, S={ } represents a collection of devices excluding firewalls. Set E = { Define the connection relationships between network nodes, where any edge This indicates the two nodes connected by this edge. and ( , and The two-way direct connection relationship; Establish the correspondence between IP mapping tables and network nodes 𝑎dd𝑟( ), 𝑎dd𝑟( ) represents a network node in the network topology graph. The corresponding IP address; Create a subnet node set group SubnetSet={ }; Define the path share degree attribute of the edge: Sharedegree={ } and initialized to 0, , Indicates the degree of path sharing.

3. The firewall automated allocation and configuration method for security requirements analysis according to claim 1, characterized in that, The calculation rules are as follows: Define the get(nsr) function to calculate the δ value of an NSR, which is the final δ value obtained after all the calculation rules are satisfied.

4. The firewall automated allocation and configuration method for security requirements analysis according to claim 3, characterized in that, The calculation rules are as follows: The function is defined as: The δ value of all NSRs is initialized to 1, indicating that all NSRs are of equal importance initially. Repeat step A until all δ values ​​of NSR have been calculated according to all satisfied calculation rules: Step A: For each NSR, iterate through all calculation rules and check if they are satisfied. If an NSR satisfies a calculation rule, update the δ value of the NSR according to the δ calculation method corresponding to that calculation rule.

5. The firewall automated allocation and configuration method for security requirements analysis according to claim 1, characterized in that, Path sharing analysis and updating path sharing specifically includes the following steps: Traverse the topological graph and find all associated triples in the set P. = in accordance with Assigned to the corresponding subnet node set , and join The corresponding subnet triplet mapping set of the associated triplet And map sets for each subnet triplet. Create the corresponding path collection SASpath; Mapping set for each subnet triple Related triples in = Perform a depth-first search to generate a path sequence. and use Update the edges contained in the path sequence Path sharing ; Pair network triple mapping set Other associated triples in the set are updated with path sharing degree based on the shared path. Mapping set of all subnet triples Processing yields the path sequences and path sharing degrees corresponding to all associated triples.

6. The firewall automated allocation and configuration method for security requirements analysis according to claim 1, characterized in that, Firewall trial allocation specifically includes the following steps: Sort the paths by degree of sharing, and try to allocate a firewall at the location with the highest degree of sharing. If there are multiple locations with the highest degree of sharing, generate a random number and select a firewall location to try to allocate based on the defined mapping relationship between the random number and the location. At the selected firewall location, securityR generates corresponding rules in the firewall based on network security requirements and eliminates the security requirements that have already been met. If all security requirements are met, the task is complete. If only some are met, the remaining securityR is used to find associated triples, re-analyze path sharing, and repeat the firewall trial allocation until all security requirements are met.

7. The firewall automated allocation and configuration method for security requirements analysis according to claim 1, characterized in that, Generating firewall rules and eliminating met security requirements involves the following steps: Establish rules based on the NSR corresponding to the associated triplet of the edge where the firewall location is located; Iterate through all NSRs and check whether each rule created completely conflicts with the original NSR; If there is no complete conflict, generate rules and modify or delete the original NSR, then attempt to assign successfully. If there is a complete conflict, the allocation attempt fails, and the original calculation rule should be modified or deleted. Check and merge the rules on each successfully assigned firewall.

8. A storage medium, characterized in that, When the processor executes a program in the storage medium, it implements a firewall automatic allocation and configuration method for security requirements analysis as described in any one of claims 1-7.

Images