A method for configuring template synchronization default security group rules

Abstract

The application provides a method for configuring template synchronization default security group rules, and belongs to the field of cloud computing.The application adds rules to the default security group automatically when a user accesses the security group for the first time by setting a default security group template on a network management platform, monitors four rules when the rule data on the OpenStack is created for the security group, and the user does not modify the rules manually, so that the template rules are added and set automatically under the default security group, and if it is monitored that the user has modified the security group rules, the synchronization of the default security group rules is not performed, so that the business of the user is not affected, and the normal operation of the customer business is ensured.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and computer networks, and in particular to a method for configuring templates to synchronize default security group rules. Background Technology

[0002] Currently, various industries are gradually integrating their business systems through cloud computing platforms. For security reasons, they can all use VPC technology for secure network isolation. VPC, or Virtual Private Cloud, allows tenants to have a logically isolated area within the cloud, where they can use various cloud resources. Tenants have complete control over the virtual network in the cloud. With the increasing prevalence of cloud services, the need for security groups on cloud servers has also emerged. A security group is a virtual firewall with stateful packet filtering capabilities. It is used to configure network access control for instances such as cloud servers, load balancers, and cloud databases, controlling inbound and outbound traffic at the instance level. It is an important means of network security isolation. Security group rules can be configured to allow or block inbound and outbound traffic to instances within the security group. A security group is a logical grouping that allows cloud servers, elastic network interfaces, cloud databases, and other instances with the same network security isolation requirements within the same region to be added to the same security group. When creating a new security group, three templates are available: allow ports 22, 3389, 80, and 443 and ICMP protocol; allow all ports; and customize. If the cloud platform did not set up security group templates in the early stages, and later needs to add default rules to the default security groups, then the synchronization mechanism of security group rules needs to be considered. Summary of the Invention

[0003] To address the aforementioned technical issues, this invention provides a method for configuring templates to synchronize default security group rules. This method does not impact user operations, avoids synchronizing default security group rules, and ensures the normal operation of customer services.

[0004] The technical solution of this invention is:

[0005] A method for configuring template synchronization of default security group rules is provided. When a user accesses a security group for the first time, rules are automatically added to the default security group. If the rule data on OpenStack is detected to be the four rules created when the security group was created and the user has not manually modified them, the set template rules are automatically added to the default security group. If it is detected that the user has modified the security group rules, the synchronization of the default security group rules is not performed in order not to affect the user's business.

[0006] Furthermore,

[0007] The purpose of introducing configuration templates to synchronize default security group rules is to manage the configuration of default security groups through templates, mark the security groups that have been synchronized, ensure the consistency of security group data, and realize the batch creation of security group rules. The operation is simple and fast.

[0008] This solution configures default security group rules in a template that does not depend on any single physical hardware device, allowing for flexible management and configuration. Default security group templates can be configured according to requirements, resulting in high security.

[0009] After the security group rules are synchronized, a tag is added to the default security group. The rules of the security group are checked to ensure they match the rules configured in the security group template. The next time the security group list is queried, if the security group tag exists, there is no need to synchronize the default security group rules, thus ensuring data consistency and correctness.

[0010] Furthermore,

[0011] Create a default security group template, including adding inbound rules, modifying inbound rules, deleting inbound rules, adding outbound rules, modifying outbound rules, and deleting outbound rules. The rule content includes: type (IPv4 and IPv6), protocol / application, port range / ICMP type, source, and description. After the template is configured, users log in to the console to synchronize the default security group rules.

[0012] Furthermore,

[0013] When a user logs into the console interface to view the security group list or create resources such as cloud servers, the security group list interface will first query whether the default security group under that user has been marked as "default".

[0014] If the "default" flag is present, it means that the user has already synchronized the security group rules and does not need to synchronize again. The security group list information under the user will be returned directly.

[0015] If the default security group is not tagged with "default", then the rules of the default security group need to be compared with the rules when the security group was created. This determines whether the user has modified the rules. If the current security group rules are consistent with the original rules, the default security group rules need to be synchronized according to the default security group template set in the network management platform, and the default security group needs to be tagged with "default" to indicate that the template has been synchronized and will not be synchronized again on the next access to the security group list. If the current security group rules are inconsistent with the original rules, it means that the user has modified them. In this case, it is not necessary to synchronize the default security group rules to ensure the normal operation of the user's business.

[0016] The rules are as follows:

[0017] The first rule is to allow inbound rules for all IPv4 ports and all protocols originating from the default security group;

[0018] The second rule is to allow access to all IPv6 ports and all protocol sources in the same security group that are set to "default".

[0019] The third rule is to allow all ports of IPv4 to be used as the source of all rules;

[0020] The fourth rule is to allow all ports on the IPv6 network to be accessible from all sources.

[0021] When a user logs into the console and clicks "Create Security Group," they can choose from three security group templates: Allow ports 22, 3389, 80, and 443 and the ICMP protocol; Allow all ports; and Custom. After selecting a template, the created security group will automatically generate corresponding rules with descriptions. When the user selects the first template, inbound rules will allow access to the same security group, the intranet, Ping service, Linux SSH login, Windows remote login, and the web service port; outbound rules will allow all ports. When the user selects the second template, both inbound and outbound rules will allow all traffic. When the user selects the third template, inbound rules will deny all traffic, while outbound rules will allow all traffic. After creating a security group, users can view the security group list, view security group details, modify the security group name, delete the security group, view inbound and outbound rule lists, add rules, modify rules, and delete rules.

[0022] Furthermore,

[0023] The implementation architecture includes the following modules: 1) Northbound interface module, 2) Database, 3) Network platform management module, and 4) Security group management module;

[0024] 1) The northbound interface module provides REST APIs to enable users to create networks, create cloud hosts, and synchronize default security group rules. For example, it provides tenant ID, network segment CIDR, and region to enable functions such as creating networks, creating subnets, deleting subnets, deleting virtual private networks, creating security groups, deleting security groups, viewing security group lists, and synchronizing default security group rules.

[0025] 2) The database module stores relevant tenant, virtual private network, subnet, security group, and security group synchronization tag information; all relevant information created by tenants through the network platform management module and security group management module is stored in the database;

[0026] 3) The network platform management module is used to manage default security group templates;

[0027] 4) The security group management module is used to manage security groups, including querying the security group list, viewing security group details, creating security groups, deleting security groups, updating security group names, querying the inbound rule list, querying the outbound rule list, adding rules, deleting rules, and modifying rules.

[0028] in,

[0029] The network platform management module is used to manage default security group rules. It allows users to view the list of inbound rules, the list of outbound rules, add rules, modify rules, and delete rules. Templates can be added according to user needs, and the added templates take effect immediately. Adding rules that already exist in the default security group is not allowed. There are two inbound rules, including rules that allow IPv4 and IPv6 in the same security group. There are two outbound rules, including rules that allow all IPv4 and IPv6.

[0030] When a tenant accesses the security group list feature, the system first checks whether the default security group under that user has been marked as "default".

[0031] If the "default" flag is present, it means that the user has already synchronized the security group rules and does not need to synchronize again. The security group list information under the user will be returned directly.

[0032] If the default security group is not tagged with "default", then it is necessary to compare whether the rules of the default security group are the same as the rules when the security group was created.

[0033] The beneficial effects of this invention are

[0034] 1) After adopting the scheme of synchronizing the default security group rules with the configuration template of the present invention, the default security group template can be flexibly configured, and the security groups that have been synchronized can be marked to ensure the consistency of security group data, realize the batch creation of security group rules, and the operation is simple and fast.

[0035] 2) This solution configures the template to synchronize default security group rules without relying on a single physical hardware device, allowing for flexible management and configuration. Default security group templates can be configured according to needs, resulting in high security. Attached Figure Description

[0036] Figure 1 A flowchart for configuring template synchronization of default security group rules;

[0037] Figure 2 Architecture diagram for synchronizing default security group rules for configuration templates;

[0038] Figure 3 This diagram illustrates the implementation principle of synchronizing default security group rules for configuration templates. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0040] This invention proposes a method for configuring templates to synchronize default security group rules for OpenStack-based cloud computing management platforms.

[0041] (1) Create a default security group template on the network management platform using administrator privileges. The template name is security-group-template. This template only synchronizes rules for the default security group under the user account. Inbound and outbound rules can be configured, and there are no quota restrictions. Administrators can view the default security group template, add, modify, and delete inbound rules, add, modify, and delete outbound rules. The rule content mainly includes: type (IPv4 and IPv6), protocol / application (TCP, UDP, ICMP, SSH, Telnet, etc.), port range / ICMP type, source, and description. After the template is configured, users log in to the console to synchronize the default security group rules.

[0042] (2) When a tenant logs into the console interface, they can see the security group list or create resources such as cloud servers. The security group list interface will first query whether the default security group under the user has been tagged with "default". If there is a "default" tag, it means that the user has already synchronized the security group rules and does not need to be synchronized again. The security group list information under the user will be returned directly.

[0043] (3) When a tenant logs into the console and views the security group list or creates resources such as cloud servers, they can see the security group list. If the default security group is not tagged with "default", it is necessary to compare whether the rules of the default security group are the four rules used when the security group was created. These four rules are: the first rule allows inbound rules for all IPv4 ports and all protocols originating from the same security group with "default" as the source; the second rule allows inbound rules for all IPv6 ports and all protocols originating from the same security group with "default" as the source; the third rule allows outbound rules for all IPv4 ports and all protocols originating from "all" as the source; and the fourth rule allows outbound rules for all IPv6 ports and all protocols originating from "all" as the source. This determines whether the user has modified the rules. If the current security group rules are consistent with the original rules, the default security group rules need to be synchronized according to the default security group template set by the network management platform, and the default security group needs to be tagged with "default" to indicate that the template has been synchronized and will not be synchronized again when accessing the security group list next time. If the current security group rules are inconsistent with the original rules, it means that the user has modified them. In this case, it is not necessary to synchronize the default security group rules to ensure the normal operation of the user's business.

[0044] (4) When a tenant logs into the console interface and clicks "Create Security Group," they can choose from three provided security group templates: Allow ports 22, 3389, 80, and 443 and the ICMP protocol; Allow all ports; and Custom. After selecting the corresponding template, the created security group will automatically create corresponding rules and add rule descriptions. When the user selects the first template: inbound rules will add rules to allow access to the same security group, allow access to the intranet, allow access to the Ping service, allow access to Linux SSH login, allow access to Windows remote login, and allow access to the WEB service port; outbound rules will allow all. When the user selects the second template: both inbound and outbound rules will allow all. When the user selects the third template: inbound rules will deny all traffic, and outbound rules will allow all. After the security group is created, the user can view the security group list, view security group details, modify the security group name, delete the security group, view the inbound and outbound rule lists, add rules, modify rules, and delete rules.

[0045] The implementation architecture diagram of the present invention is as follows: Figure 1 As shown, it includes the following modules: 1) Northbound interface module; 2) Database; 3) Network platform management module; 4) Security group management module.

[0046] The northbound interface module is primarily used to provide REST APIs to enable tenants to create networks, create cloud hosts, and synchronize default security group rules. For example, by providing tenant ID, network segment CIDR, and region, it allows users to create networks, subnets, delete subnets, delete virtual private networks, create security groups, delete security groups, view security group lists, and synchronize default security group rules.

[0047] The database module stores information related to tenants, virtual private networks, subnets, security groups, and security group synchronization tags. All relevant information created by tenants through the network platform management module and the security group management module is stored in the database.

[0048] The network platform management module is primarily used to manage default security group templates. These templates manage default security group rules, allowing users to view inbound and outbound rule lists, add, modify, and delete rules. Administrators can add templates based on user needs. Added templates take effect immediately. Adding four existing rules to the default security group is not permitted: two inbound rules (allowing both IPv4 and IPv6 within the same security group) and two outbound rules (allowing all IPv4 and IPv6 rules).

[0049] The security group management module is used to manage security groups, including querying the security group list, viewing security group details, creating security groups, deleting security groups, updating security group names, querying the inbound rule list, querying the outbound rule list, adding rules, deleting rules, and modifying rules. When a tenant accesses the security group list function, it first checks whether the default security group under that user has been tagged with "default". If it has the "default" tag, it means that the user has already synchronized the security group rules and does not need to synchronize again; the security group list information under that user is directly returned. If the default security group is not tagged with "default", it needs to compare whether the rules of the default security group are the four rules when the security group was created. These four rules are: the first rule allows inbound rules from the same security group with all IPv4 ports and all protocols originating from "default"; the second rule allows inbound rules from the same security group with all IPv6 ports and all protocols originating from "default"; the third rule allows outbound rules with all IPv4 ports and all protocols originating from "all"; and the fourth rule allows outbound rules with all IPv6 ports and all protocols originating from "all". This determines whether the user has modified the rules. If the current security group rules are consistent with the original rules, the default security group rules need to be synchronized according to the default security group template set in the network management platform, and the default security group should be tagged with "default" to indicate that the template has been synchronized and will not be synchronized again on the next access to the security group list. If the current security group rules are inconsistent with the original rules, it means that the user has modified them. In this case, it is not necessary to synchronize the default security group rules to ensure the normal operation of the user's business.

[0050] like Figure 3 As shown, the example demonstrates configuring template synchronization of default security group rules:

[0051] Prerequisites:

[0052] There is a subnet named subnet1 under a network1, and a subnet named subnet2 under a network2. User account a belongs to network1, and user account b belongs to network2.

[0053] 1. The network platform management module uses administrator privileges to create a default security group template.

[0054] 2. Call the northbound interface to query the list of virtual private networks and subnets, select the security group, and then user A and user B call the API to create cloud hosts respectively.

[0055] 3. The northbound interface management module first writes the network and subnet information into the database.

[0056] 4. In the security group management module, view the security group list and synchronize the default security group rules from step 2. Add inbound and outbound rules to the default security group according to the security group template.

[0057] 5. After the default security group rules data synchronization is completed, store the security group synchronization identifier record in the database and tag the default security group.

[0058] At this point, the configuration template synchronization of default security group rules is complete.

[0059] The above description is merely a preferred embodiment of the present invention and is used only to illustrate the technical solution of the present invention, and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for configuring template synchronization default security group rules, characterized in that, By setting a default security group template on the network management platform, rules are automatically added to the default security group when a user accesses the security group for the first time. If the OpenStack rule data is detected as the rules when the security group was created and the user has not manually modified them, the set template rules are automatically added to the default security group. If the user has modified the security group rules, the default security group rules are not synchronized. When a user logs into the console interface to view the security group list or create resources such as cloud servers, the security group list interface will first query whether the default security group under that user has been marked as "default". If the "default" flag is present, it means that the user has already synchronized the security group rules and does not need to synchronize again. The security group list information under the user will be returned directly. If the default security group is not tagged with "default", then it is necessary to compare the rules of the default security group with the rules when the security group was created. This will determine whether the user has modified the rules. If the current security group rules are consistent with the original rules, the default security group rules need to be synchronized according to the default security group template set in the network management platform, and the default security group needs to be tagged with "default" to indicate that the template has been synchronized and will not be synchronized again when accessing the security group list next time. If the current security group rules are inconsistent with the original rules, it means that the user has modified them. In this case, it is not necessary to synchronize the default security group rules to ensure the normal operation of the user's business.

2. The method according to claim 1, characterized in that, Configure default security groups through template management, and mark the security groups that have been synchronized. After the security group rules are synchronized, mark the default security group and check that the rules of the security group are consistent with the rules configured in the security group template. The next time you query the security group list, if the security group mark exists, you will not need to synchronize the default security group rules.

3. The method according to claim 1, characterized in that, Create a default security group template, including adding inbound rules, modifying inbound rules, deleting inbound rules, adding outbound rules, modifying outbound rules, and deleting outbound rules. The rule content includes: type (IPv4 and IPv6), protocol / application, port range / ICMP type, source, and description. After the template is configured, users log in to the console to synchronize the default security group rules.

4. The method according to claim 1, characterized in that, The rules are as follows: The first rule is to allow inbound rules for all IPv4 ports and all protocols originating from the default security group; The second rule is to allow access to all IPv6 ports and all protocol sources in the same security group that are set to "default". The third rule is to allow all ports of IPv4 to be used as the source of all rules; The fourth rule is to allow all ports on the IPv6 network to be accessible from all sources.

5. The method according to claim 4, characterized in that, When a user logs into the console interface and a tenant clicks "Create Security Group," they can choose from three provided security group templates: Allow ports 22, 3389, 80, and 443 and the ICMP protocol; Allow all ports; and Custom. After selecting the corresponding template, the created security group will automatically generate the corresponding rules and add rule description information.

6. The method according to claim 5, characterized in that, When a user selects the first template: Inbound rules will add rules to allow access to the same security group, the intranet, the Ping service, Linux SSH login, Windows remote login, and the web service port; outbound rules will allow all traffic. When a user selects the second template: Both inbound and outbound rules will allow all traffic. When a user selects the third template: Inbound rules will reject all traffic; outbound rules will allow all traffic. After a security group is created, you can view the security group list, view security group details, modify the security group name, delete the security group, view the inbound and outbound rule lists, add rules, modify rules, and delete rules.

7. The method according to claim 5, characterized in that, The implementation architecture includes the following modules: 1) Northbound interface module, 2) Database, 3) Network platform management module, and 4) Security group management module; 1) The northbound interface module is used to provide REST APIs to enable users to create networks, create cloud hosts and synchronize default security group rules. For example, it provides tenant ID, network segment CIDR, and region to create networks, create subnets, delete subnets, delete virtual private networks, create security groups, delete security groups, view security group lists and synchronize default security group rules. 2) The database module stores relevant tenant, virtual private network, subnet, security group, and security group synchronization tag information; all relevant information created by tenants through the network platform management module and security group management module is stored in the database; 3) The network platform management module is used to manage default security group templates; 4) The security group management module is used to manage security groups, including querying the security group list, viewing security group details, creating security groups, deleting security groups, updating security group names, querying the inbound rule list, querying the outbound rule list, adding rules, deleting rules, and modifying rules.

8. The method according to claim 7, characterized in that, The network platform management module is used to manage default security group rules. It allows users to view the list of inbound rules, the list of outbound rules, add rules, modify rules, and delete rules. Templates can be added according to user needs, and the added templates take effect immediately. Adding rules that already exist in the default security group is not allowed. There are two inbound rules, including rules that allow IPv4 and IPv6 in the same security group. There are two outbound rules, including rules that allow all IPv4 and IPv6.

9. The method according to claim 7, characterized in that, When a tenant accesses the security group list feature, the system first checks whether the default security group under that user has been marked as "default". If the "default" flag is present, it means that the user has already synchronized the security group rules and does not need to synchronize again. The security group list information under the user will be returned directly. If the default security group is not tagged with "default", then it is necessary to compare whether the rules of the default security group are the same as the rules when the security group was created.

Images