An efficient method and system for access control matching

Abstract

The application discloses a kind of efficient access control matching method and system, wherein the method comprises the following steps: step 1: record address book and rule ID information;Step 2: construct B-Tree and record rule ID chain table;Step 3: IPv4 address matching;Step 4: merge rule ID chain table;Step 5: match other parameters.The application can greatly improve the matching efficiency of IPv4 address by introducing B-Tree structure and dynamic adjustment algorithm.In addition, the efficient query capability of B-Tree and the mechanism of dynamically adjusting nodes can optimize the tree structure according to the access frequency of rules, so that high-frequency access rules can be matched faster, thereby improving overall performance.In addition, the merging of priority order and the one-by-one comparison of other parameters ensure the accuracy and consistency of the matching result.

Description

Technical Field

[0001] This invention relates to the field of cloud firewall technology, and in particular to a method and system for efficient access control matching. Background Technology

[0002] As a crucial security component in cloud environments, cloud firewalls are responsible for filtering network traffic and performing security checks based on user-defined rules. Access Control Lists (ACLs) are a key module of cloud firewalls, allowing or denying network traffic by matching the five-tuple information in packets.

[0003] However, with the increasing complexity of network environments and growing user demands, the number of ACL rules is rapidly increasing, especially the number of IPv4 addresses that need to be filtered. Traditional ACL configuration methods, where each rule can only target one source IPv4 address and one destination IPv4 address, result in the generation of numerous redundant rules, leading to complex management and poor matching performance. To optimize this issue, we introduce the concept of an address book. The address book manages IPv4 addresses as independent matching attributes, allowing ACL rules to match multiple IPv4 addresses by referencing address book entries. The address book supports configuration for single IPv4 addresses, address ranges, and address segments, significantly reducing the number of ACL rules and improving configuration flexibility.

[0004] However, even with the introduction of an address book, the traditional method of matching IPv4 addresses by traversing ACL rules one by one still leads to performance bottlenecks when the number of IPv4 addresses reaches a certain level. To address this issue, an efficient access control matching method is proposed. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an efficient access control matching method, comprising the following steps:

[0007] Step 1: Record the address book and rule ID information;

[0008] Step 2: Construct a B-Tree and record the rule ID linked list;

[0009] Step 3: IPv4 address matching;

[0010] Step 4: Merge the rule ID linked list;

[0011] Step 5: Match other parameters.

[0012] As a preferred embodiment of the efficient access control matching method of the present invention, the recording of address book and rule ID information means recording the set of IPv4 addresses and rule ID information in the address book according to the priority order of ACL rules.

[0013] As a preferred embodiment of the efficient access control matching method of the present invention, the step of constructing a B-Tree and recording the rule ID linked list involves sequentially constructing the IPv4 / Mask set into a B-Tree, and recording the ID of the rule to which the IPv4 address belongs in priority order on each node of the B-Tree to generate a rule ID linked list.

[0014] As a preferred embodiment of the efficient access control matching method of the present invention, in step 2, when constructing the B-Tree, a dynamic adjustment algorithm is adopted to adjust the nodes according to the access frequency of the rules in order to improve the matching efficiency of high-frequency rules.

[0015] As a preferred embodiment of the efficient access control matching method of the present invention, the IPv4 address matching means that when the packets are matched with IPv4 addresses, the B-Tree is traversed to obtain a list of all ACL rule IDs that meet the conditions.

[0016] As a preferred embodiment of the efficient access control matching method of the present invention, the merging of the rule ID linked list means merging the obtained rule ID linked lists according to priority order to form an ordered rule ID linked list.

[0017] As a preferred embodiment of the efficient access control matching method described in this invention, in the process of merging the rule ID chain, the priority order is sorted according to the predefined ACL rule priority, and in the merging process, it is ensured that there are no duplicate rule IDs.

[0018] As a preferred embodiment of the efficient access control matching method of the present invention, the matching of other parameters means sequentially matching other matching parameters on the merged rule ID chain until the highest priority rule ID value that satisfies all conditions is found.

[0019] As a preferred embodiment of the efficient access control matching method of the present invention, in step 5, when matching other parameters, the matching of ports and protocols is first prioritized and then compared one by one with the merged rule ID chain to ensure the accuracy and efficiency of the matching results.

[0020] This invention also provides a system for efficient access control matching, which is applied in a method for efficient access control matching. The system includes:

[0021] The address book recording module is used to record the IPv4 address set and rule ID information in the address book according to the priority order of ACL rules;

[0022] The B-Tree construction module is used to construct the IPv4 / Mask set into a B-Tree, and record the ID of the rule to which the IPv4 address belongs in priority order on each node of the B-Tree to generate a rule ID linked list.

[0023] A dynamic adjustment module is used to adjust nodes according to the access frequency of rules during the B-Tree construction process using a dynamic adjustment algorithm, so as to improve the matching efficiency of high-frequency rules.

[0024] The IPv4 address matching module is used to traverse the B-Tree and obtain a list of all ACL rule IDs that meet the conditions when the packets are matched for IPv4 addresses.

[0025] The rule ID merging module is used to merge the obtained rule ID linked lists according to priority order to form an ordered rule ID linked list and ensure that there are no duplicate rule IDs.

[0026] The parameter matching module is used to sequentially match other matching parameters on the merged rule ID chain until the highest priority rule ID value that satisfies all conditions is found.

[0027] The beneficial effects of this invention are:

[0028] 1. This invention transforms the original method of obtaining matching results by matching IPv4 rules one by one into a method of first matching IPv4 rules and then finding the matching ACL rules, which can greatly improve the matching performance of the ACL module.

[0029] 2. By introducing a B-Tree structure and a dynamic adjustment algorithm, this invention can greatly improve the matching efficiency of IPv4 addresses. In addition, the efficient query capability of the B-Tree and the mechanism of dynamic node adjustment can optimize the tree structure according to the access frequency of the rules, so that high-frequency access rules can be matched faster, thereby improving the overall performance.

[0030] 3. By treating IPv4 addresses as independent matching attributes and using address book referencing, this invention allows multiple IPv4 addresses to be included in a single rule, greatly reducing the number and redundancy of ACL rules and improving the simplicity and maintainability of configuration.

[0031] 4. This invention employs a priority sorting and rule merging method to merge the matched rule ID linked lists according to priority order and ensure that there are no duplicate rule IDs. This not only improves the accuracy of rule matching but also reduces the consumption of system resources and improves resource utilization. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0033] Figure 1 This is a flowchart illustrating an efficient access control matching method according to the present invention.

[0034] Figure 2 The flowchart illustrates the generation of a complete B-Tree using an efficient access control matching method according to the present invention. Detailed Implementation

[0035] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0036] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0037] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0038] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0039] Example 1

[0040] Reference Figure 1-2 This is the first embodiment of the present invention, which provides an efficient access control matching method, comprising the following steps:

[0041] Step 1: Record address book and rule ID information

[0042] Record the IPv4 address sets and rule IDs in the address book according to the priority order of ACL rules. This ensures that ACL rules related to specific IPv4 addresses can be obtained efficiently and accurately during subsequent matching processes, improving the accuracy and efficiency of matching.

[0043] Step 2: Construct a B-Tree and record the rule ID linked list.

[0044] The IPv4 / Mask sets are sequentially constructed into a B-Tree. At each node of the B-Tree, the ID of the rule to which the IPv4 address belongs is recorded in priority order, generating a linked list of rule IDs. Furthermore, a dynamic adjustment algorithm is used during B-Tree construction to adjust nodes based on the access frequency of rules. In this step, the B-Tree structure makes the IPv4 address matching process more efficient, reducing matching time. Simultaneously, the dynamic adjustment algorithm optimizes the tree structure based on access frequency, improving the matching efficiency of high-frequency rules and further enhancing overall performance.

[0045] Step 3: IPv4 address matching

[0046] When matching packets against IPv4 addresses, the B-Tree is traversed to retrieve a linked list of all ACL rule IDs that meet the criteria. This step leverages the efficient lookup capabilities of the B-Tree to quickly obtain the linked list of all rule IDs matching the IPv4 addresses in the packet, significantly reducing the matching time.

[0047] Step 4: Merge the rule ID linked list

[0048] The resulting rule ID lists are merged according to priority to form an ordered rule ID list. Furthermore, during the merging process, the priority order is based on predefined ACL rule priorities, and it is ensured that there are no duplicate rule IDs. This priority order ensures that rule conflicts during matching are effectively resolved, guaranteeing the accuracy and consistency of the matching results. Simultaneously, the deduplication process avoids duplicate rule IDs, improving processing efficiency.

[0049] Step 5: Match other parameters

[0050] The merged rule ID list is then sequentially matched against other matching parameters (such as port, protocol, etc.) until the highest priority rule ID value that satisfies all conditions is found. Furthermore, when matching other parameters, port and protocol matches are first prioritized and then compared one by one with the merged rule ID list to ensure accuracy and efficiency. In this step, comparing other matching parameters one by one ensures the accuracy and efficiency of the final matching result. In addition, priority sorting further optimizes the matching process, allowing the system to quickly locate the best rule ID that satisfies all conditions, improving overall access control matching efficiency.

[0051] The following examples illustrate the above content:

[0052] I. Example system configuration is as follows:

[0053] Address Book:

[0054] Address Book Name IPv4 address set AddrG1 1.1.0.1 / 32，2.1.0.1 / 32 AddrG2 1.1.0.1 / 24，2.1.0.1 / 24

[0055] ACL rules, priority from top to bottom:

[0056] Rule Name Rule ID Source IP Reference Address Book Rule 1 1 AddrG1 Rule 2 2 AddrG2 Rule 3 3 AddrG1

[0057] II. Record the IPv4 address set and rule ID information according to rule priority.

[0058] IPv4 / Mask address set Rule ID 1.1.0.1 / 32，2.1.0.1 / 32 1 1.1.0.1 / 24，2.1.0.1 / 24 2 1.1.0.1 / 32，2.1.0.1 / 32 3

[0059] III. Generate a B-Tree by mapping the IPv4 / Mask address set to rule IDs.

[0060] i. Expand the IPv4 address in binary form. For example, the binary form of 1.1.0.1 is 0000000100000001000000000000001. Use 0 and 1 as B-Tree nodes, where the left subtree represents 0 and the right subtree represents 1.

[0061] ii. Mask can be understood as the number of layers in the B-Tree. For example, 32 means that the depth of the B-Tree is 32.

[0062] iii. Configure and generate a complete B-Tree based on the above examples, see appendix. Figure 2 .

[0063] iiii. When matching IPv4 addresses, if a traffic with a source IP of 1.1.0.3 needs to be filtered by ACL, the source IP 1.1.0.3 is converted into binary form 00000001000000010000000000000011. The B-Tree is searched node by node from top to bottom, and eventually the rule ID value 2 is found to be a match.

[0064] In summary, this invention significantly improves IPv4 address matching efficiency by introducing a B-Tree structure and a dynamic adjustment algorithm. Furthermore, the efficient query capabilities of the B-Tree and the dynamic node adjustment mechanism optimize the tree structure based on rule access frequency, enabling high-frequency access rules to be matched more quickly, thereby improving overall performance. This invention transforms the previous method of obtaining matching results by matching IPv4 addresses one ACL rule at a time into one that first matches IPv4 addresses and then finds the matching ACL rules, greatly improving the matching performance of the ACL module. By treating IPv4 addresses as independent matching attributes and using address book referencing, this invention allows multiple IPv4 addresses to be included in a single rule, significantly reducing the number and redundancy of ACL rules and improving configuration simplicity and maintainability. This invention employs priority sorting and rule merging methods, merging the matched rule ID chains according to priority order and ensuring no duplicate rule IDs. This not only improves the accuracy of rule matching but also reduces system resource consumption and increases resource utilization.

[0065] This invention also provides a system for efficient access control matching, which is applied in a method for efficient access control matching. The system includes:

[0066] The address book recording module is used to record the IPv4 address set and rule ID information in the address book according to the priority order of ACL rules;

[0067] The B-Tree construction module is used to construct the IPv4 / Mask set into a B-Tree, and record the ID of the rule to which the IPv4 address belongs in priority order on each node of the B-Tree to generate a rule ID linked list.

[0068] A dynamic adjustment module is used to adjust nodes according to the access frequency of rules during the B-Tree construction process using a dynamic adjustment algorithm, so as to improve the matching efficiency of high-frequency rules.

[0069] The IPv4 address matching module is used to traverse the B-Tree and obtain a list of all ACL rule IDs that meet the conditions when the packets are matched for IPv4 addresses.

[0070] The rule ID merging module is used to merge the obtained rule ID linked lists according to priority order to form an ordered rule ID linked list and ensure that there are no duplicate rule IDs.

[0071] The parameter matching module is used to sequentially match other matching parameters on the merged rule ID chain until the highest priority rule ID value that satisfies all conditions is found.

[0072] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for access control matching, characterized in that, Includes the following steps: Before step 1, the system is configured, including the address book name and the set of IPv4 addresses; ACL rules, with priority from top to bottom, include the rule name, rule ID, and source IP referencing the address book; Step 1: Record the address book and rule ID information; The recorded address book and rule ID information refers to recording the set of IPv4 addresses and rule ID information in the address book according to the priority order of ACL rules; Step 2: Construct a B-Tree and record the rule ID linked list; The construction of the B-Tree and the recording of the rule ID linked list involves sequentially constructing the IPv4 / Mask set into a B-Tree, and recording the ID of the rule to which the IPv4 address belongs in priority order on each node of the B-Tree to generate a rule ID linked list. When constructing the B-Tree, a dynamic adjustment algorithm is used to adjust the nodes according to the access frequency of the rules in order to improve the matching efficiency of high-frequency rules. Step 3: IPv4 address matching; IPv4 address matching means that when each packet is matched with an IPv4 address, the B-Tree is traversed to obtain a list of all ACL rule IDs that meet the conditions. Step 4: Merge the rule ID linked list; Merging the rule ID linked list means merging the obtained rule ID linked lists according to priority order to form an ordered rule ID linked list; During the merging of the rule ID linked list, the priority order is sorted according to the predefined ACL rule priority, and it is ensured that there are no duplicate rule IDs during the merging process; Step 5: Match other parameters; The matching of other parameters involves sequentially matching other parameters on the merged rule ID chain until the highest priority rule ID value that satisfies all conditions is found.

2. The access control matching method as described in claim 1, characterized in that: In step 5, when matching other parameters, the matching structure of ports and protocols is first prioritized and then compared one by one with the merged rule ID chain to ensure the accuracy and efficiency of the matching results.

3. A system for access control matching, characterized in that, The system is applied in the method according to any one of claims 1-2, the system comprising: The address book recording module is used to record the IPv4 address set and rule ID information in the address book according to the priority order of ACL rules; The B-Tree construction module is used to construct the IPv4 / Mask set into a B-Tree, and record the ID of the rule to which the IPv4 address belongs in priority order on each node of the B-Tree to generate a rule ID linked list. A dynamic adjustment module is used to adjust nodes according to the access frequency of rules during the B-Tree construction process using a dynamic adjustment algorithm, so as to improve the matching efficiency of high-frequency rules. The IPv4 address matching module is used to traverse the B-Tree and obtain a list of all ACL rule IDs that meet the conditions when the packets are matched for IPv4 addresses. The rule ID merging module is used to merge the obtained rule ID linked lists according to priority order to form an ordered rule ID linked list and ensure that there are no duplicate rule IDs. The parameter matching module is used to sequentially match other matching parameters on the merged rule ID chain until the highest priority rule ID value that satisfies all conditions is found.

Images