Firewall white list control method and device, medium and firewall

Abstract

The embodiment of the invention provides a control method and device of a firewall for a white list, a medium and the firewall. Matching a domain name list in a safe state according to the white list; collecting a domain name to be confirmed, and performing security detection on the domain name to be confirmed to define the state of the domain name to be confirmed; if the state of the domain name to be confirmed is a safe state, adding the domain name to a domain name list in the safe state; the domain name list in the safe state is updated in real time, the updated domain name list is synchronized to the firewall, and at the moment, the state of the domain name to be confirmed is defined for safety detection of the domain name to be confirmed so that the domain name to be confirmed in the safe state can be added to the domain name list in the safe state. According to the invention, the updating of the domain name list in the safe state is realized, the updated domain name list in the safe state is synchronized to the firewall, and the normal use of the domain name to be confirmed under the control of the firewall is ensured.

Description

Technical Field

[0001] The present application relates to the technical field of firewalls, and in particular to a firewall whitelist control method, device, medium and firewall. Background Art

[0002] With the development of technology, fire protection control is introduced for servers, and firewalls are added. The firewall performs security control on domain names and performs security registration on domain names through whitelists. In the prior art, if a domain name to be confirmed is introduced, it is necessary to associate the domain name to be confirmed and the firewall, and trigger the security control of the firewall based on the domain name to be confirmed. However, the domain name to be confirmed is not included in the corresponding whitelist under security control, resulting in the domain name list in the original whitelist continuing to maintain the preset state and unable to be updated autonomously. Summary of the invention

[0003] The embodiments of the present application provide a firewall control method, device, medium and firewall for a whitelist, which define the status of a domain name to be confirmed for security detection of the domain name to be confirmed, so as to add the domain name to be confirmed in a safe state to a list of domain names in a safe state, thereby realizing the update of the list of domain names in a safe state, and then synchronizing the updated list of domain names in a safe state to the firewall, thereby realizing the filing of the firewall and ensuring the normal use of the domain name to be confirmed under the control of the firewall.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a firewall control method for a whitelist is provided, which is applied to a firewall control scenario for a whitelist; the firewall control method for a whitelist includes:

[0006] Locate the firewall associated with the server and associate the corresponding IP address based on the firewall;

[0007] Define corresponding whitelists based on firewalls and corresponding IP addresses;

[0008] Match the domain name list in a safe state according to the whitelist;

[0009] Collect the domain names to be confirmed and perform security checks on the domain names to be confirmed to define the status of the domain names to be confirmed;

[0010] If the status of the domain name to be confirmed is safe, the domain name is added to the list of domain names in safe status;

[0011] The list of domain names in a safe state is updated in real time, and the updated list of domain names is synchronized to the firewall.

[0012] Optionally, locating a firewall associated with the server and associating a corresponding IP address with the firewall includes:

[0013] Collection server;

[0014] The corresponding communication network based on the signal matching of the server;

[0015] Define the corresponding firewall according to the communication network;

[0016] Traverse the firewall and define the IP space in the firewall;

[0017] Define the corresponding IP address based on the IP space and the corresponding server.

[0018] Optionally, the whitelist defined based on the firewall and the corresponding IP address includes:

[0019] Fixed IP address;

[0020] Based on the firewall matching corresponding database;

[0021] Associated databases and IP addresses;

[0022] Define the corresponding security space based on the database and IP address;

[0023] Define the corresponding whitelist according to the security space.

[0024] Optionally, matching a list of domain names in a safe state according to a whitelist includes:

[0025] Fixed whitelist;

[0026] Traverse the whitelist and output the corresponding security list;

[0027] Associate the security list with the firewall's fire protection level;

[0028] A list of domain names that are in a safe state is matched based on the security list and the firewall's fire protection level.

[0029] Optionally, the collecting of the domain name to be confirmed and performing security detection on the domain name to be confirmed to define the status of the domain name to be confirmed includes:

[0030] Monitor the server in real time and collect domain names to be confirmed based on the server;

[0031] Defining the real status of the domain name to be confirmed based on the traversal of the domain name to be confirmed;

[0032] If the domain name to be confirmed is in a real state, the domain name to be confirmed is opened and the corresponding web page is frozen;

[0033] Trigger security detection based on web pages to conduct security detection on the domain name to be confirmed;

[0034] The status of the domain name to be confirmed is defined according to the security check of the domain name to be confirmed.

[0035] Optionally, if the status of the domain name to be confirmed is a safe status, adding the domain name to a list of domain names in a safe status includes:

[0036] If the webpage outputs no abnormal area in the security detection, the status of the domain name to be confirmed is defined as a safe status;

[0037] If the status of the domain name to be confirmed is safe, the domain name will be frozen;

[0038] The domain name is associated with a list of domain names in a safe state;

[0039] Add the domain name to the list of domain names in a safe state to form a new domain name list.

[0040] Optionally, updating the domain name list in a safe state in real time and synchronizing the updated domain name list to the firewall includes:

[0041] Fixed the list of domain names that are in a safe state;

[0042] A list of domain names that are associated with a safe status and domain names that are pending confirmation;

[0043] Triggering real-time update of the domain name list based on the domain name list in a safe state and the domain name to be confirmed, and forming an updated domain name list;

[0044] Define the first parameter according to the updated domain name list and define the second parameter for the firewall;

[0045] defining a synchronization mode according to the second parameter and the first parameter;

[0046] The new content of the firewall is defined based on the synchronization mode and the updated domain name list, and the update of the firewall is triggered based on the new content of the firewall.

[0047] According to one aspect of an embodiment of the present application, a firewall control device for a whitelist is provided, including:

[0048] An association module is used to locate the firewall associated with the server and associate the corresponding IP address based on the firewall;

[0049] Whitelist module, used to define corresponding whitelists based on firewalls and corresponding IP addresses;

[0050] The domain name list module is used to match the domain name list in a safe state according to the whitelist;

[0051] The first status module is used to collect the domain names to be confirmed and perform security detection on the domain names to be confirmed to define the status of the domain names to be confirmed;

[0052] The second status module is used to add the domain name to the list of domain names in a safe state if the state of the domain name to be confirmed is a safe state;

[0053] The firewall module is used to update the list of domain names in a safe state in real time and synchronize the updated domain name list to the firewall.

[0054] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the firewall control method for the whitelist as described in the above embodiment is implemented.

[0055] According to one aspect of an embodiment of the present application, a firewall is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the firewall control method for the whitelist as described in the above embodiments.

[0056] According to one aspect of an embodiment of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the firewall control method for the whitelist provided in the above embodiment.

[0057] In the technical solutions provided in some embodiments of the present application, a firewall associated with a server is located, and an IP address corresponding to the firewall is associated; a corresponding whitelist is defined based on the firewall and the corresponding IP address; a list of domain names in a safe state is matched according to the whitelist; domain names to be confirmed are collected, and security checks are performed on the domain names to be confirmed to define the status of the domain names to be confirmed; if the status of the domain names to be confirmed is a safe state, the domain names are added to the list of domain names in a safe state; the list of domain names in a safe state is updated in real time, and the updated list of domain names is synchronized to the firewall. At this time, the status of the domain names to be confirmed is defined for the security check of the domain names to be confirmed, so that the domain names to be confirmed in a safe state are added to the list of domain names in a safe state, thereby realizing the update of the list of domain names in a safe state, and then synchronizing the updated list of domain names in a safe state to the firewall, realizing the filing of the firewall, and ensuring the normal use of the domain names to be confirmed under the control of the firewall.

[0058] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0060] Figure 1 A schematic diagram of a process flow of a firewall control method for a whitelist according to an embodiment of the present application is shown;

[0061] Figure 2 Shows Figure 1 Schematic diagram of the process of S110;

[0062] Figure 3 Shows Figure 1 Schematic diagram of the process of S120;

[0063] Figure 4 Shows Figure 1 Schematic diagram of the process flow of S130;

[0064] Figure 5 Shows Figure 1 Schematic diagram of the process of S140;

[0065] Figure 6 Shows Figure 1 Schematic diagram of the process flow of S150;

[0066] Figure 7 Shows Figure 1 Schematic diagram of the process of S160;

[0067] Figure 8 A block diagram of a firewall control device for a whitelist according to an embodiment of the present application is shown;

[0068] Fig. 9 A schematic diagram of the structure of a computer system suitable for implementing a firewall according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0069] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0070] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0071] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0072] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0073] Figure 1 A flowchart of a method for controlling a whitelist by a firewall according to an embodiment of the present application is shown. The method can be applied to a scenario where a firewall controls a whitelist.

[0074] See also Figures 1 to 9A method for maintaining the status of a portable printer is applied to a scenario of diagnosing the status of a portable printer. The method for maintaining the status of a portable printer comprises:

[0075] Step S110: locating a firewall associated with the server, and associating a corresponding IP address based on the firewall;

[0076] Step S120: defining a corresponding whitelist based on the firewall and the corresponding IP address;

[0077] Step S130: matching a list of domain names in a safe state according to the whitelist;

[0078] Step S140: collecting the domain name to be confirmed, and performing security detection on the domain name to be confirmed to define the status of the domain name to be confirmed;

[0079] Step S150: If the status of the domain name to be confirmed is a safe status, the domain name is added to the list of domain names in a safe status;

[0080] Step S160: Update the domain name list in a safe state in real time, and synchronize the updated domain name list to the firewall.

[0081] In an embodiment of the present invention, through the method in the embodiment of the present invention, the firewall associated with the server is located, and the corresponding IP address is associated with the firewall; the corresponding white list is defined based on the firewall and the corresponding IP address; the list of domain names in a safe state is matched according to the white list; the domain names to be confirmed are collected, and the domain names to be confirmed are subjected to security detection to define the status of the domain names to be confirmed; if the status of the domain names to be confirmed is a safe state, the domain names are added to the list of domain names in a safe state; the list of domain names in a safe state is updated in real time, and the updated list of domain names is synchronized to the firewall. At this time, the status of the domain names to be confirmed is defined for the security detection of the domain names to be confirmed, so that the domain names to be confirmed in a safe state are added to the list of domain names in a safe state, thereby realizing the update of the list of domain names in a safe state, and then synchronizing the updated list of domain names in a safe state to the firewall, realizing the filing of the firewall, and ensuring the normal use of the domain names to be confirmed under the control of the firewall.

[0082] refer to Figure 2 , in step S110, locating a firewall associated with the server, and associating a corresponding IP address based on the firewall;

[0083] In the specific implementation process of the present invention, the specific steps may be:

[0084] S111: collection server;

[0085] S112: Matching a corresponding communication network based on the signal of the server;

[0086] S113: Define a corresponding firewall according to the communication network;

[0087] S114: traverse the firewall and define the IP space in the firewall;

[0088] S115: Define a corresponding IP address based on the IP space and the corresponding server.

[0089] In an embodiment of the present application, the server is collected and network tracking is performed on the server to match the corresponding communication network based on the server's signal, thereby introducing the corresponding communication network, and then defining the corresponding firewall according to the communication network, thereby ensuring further management and control of the firewall.

[0090] At this time, the firewall is traversed and the IP space in the firewall is defined to facilitate the introduction of the IP space, and the corresponding IP address is defined based on the IP space and the corresponding server, thereby clarifying the corresponding IP address and ensuring the accuracy of the IP address.

[0091] refer to Figure 3 , in step S120, a corresponding whitelist is defined based on the firewall and the corresponding IP address;

[0092] In the specific implementation process of the present invention, the specific steps may be:

[0093] S121: Fixed IP address;

[0094] S122: Matching a corresponding database based on the firewall;

[0095] S123: association database and IP address;

[0096] S124: defining a corresponding security space according to the database and the IP address;

[0097] S125: Define a corresponding whitelist according to the security space.

[0098] In an embodiment of the present application, the IP address is fixed so as to make full use of the IP address. At this time, the corresponding database is matched based on the firewall so as to introduce the database and the IP address, thereby associating the database and the IP address, and being compatible with the overall consideration of the database and the IP address.

[0099] Furthermore, a corresponding security space is defined according to the database and the IP address; a corresponding white list is defined according to the security space, thereby introducing a white list to facilitate management and control of the white list, thereby ensuring the accuracy of the white list.

[0100] refer to Figure 4 , in step S130, matching a list of domain names in a safe state according to the whitelist;

[0101] In the specific implementation process of the present invention, the specific steps may be:

[0102] S131: Fixed whitelist;

[0103] S132: traverse the whitelist and output the corresponding security list;

[0104] S133: Associate the security list and the firewall level;

[0105] S134: A list of domain names in a safe state is matched based on the security list and the fire protection level of the firewall.

[0106] In an embodiment of the present application, a whitelist is fixed and further controlled. At this time, the whitelist is traversed and the corresponding security list is output to facilitate traversal of the security list. At the same time, the security list and the fire protection level of the firewall are associated; the domain name list in a safe state is matched based on the security list and the fire protection level of the firewall, so as to be compatible with the overall consideration of the security list and the fire protection level of the firewall, and then the security list and the fire protection level of the firewall are controlled, the accuracy of the domain name list in a safe state is ensured, and precise control in multiple dimensions is achieved.

[0107] refer to Figure 5 , S140: collecting the domain name to be confirmed, and performing security detection on the domain name to be confirmed to define the status of the domain name to be confirmed;

[0108] In the specific implementation process of the present invention, the specific steps may be:

[0109] S141: monitor the server in real time, and collect domain names to be confirmed based on the server;

[0110] S142: defining the real status of the domain name to be confirmed based on the traversal of the domain name to be confirmed;

[0111] S143: If the domain name to be confirmed is in a real state, the domain name to be confirmed is opened and the corresponding web page is frozen;

[0112] S144: triggering a security check based on the web page to perform a security check on the domain name to be confirmed;

[0113] S145: Defining the status of the domain name to be confirmed according to the security detection of the domain name to be confirmed.

[0114] In an embodiment of the present application, the server is monitored in real time, and domain names to be confirmed are collected based on the server, domain names to be confirmed are introduced, and the domain names to be confirmed are further processed, so as to control the status of the domain names to be confirmed.

[0115] At this time, the real status of the domain name to be confirmed is defined based on the traversal of the domain name to be confirmed; if the domain name to be confirmed is in the real status, the domain name to be confirmed is opened, and the corresponding web page is frozen to facilitate the introduction of the web page, and a security check is triggered based on the web page to perform a security check on the domain name to be confirmed, thereby realizing the security check of the domain name to be confirmed, and then the status of the domain name to be confirmed is defined according to the security check of the domain name to be confirmed, the status of the domain name to be confirmed is clarified, and the control of the status of the domain name to be confirmed is realized.

[0116] refer to Figure 6 , S150: If the status of the domain name to be confirmed is a safe status, the domain name is added to the list of domain names in a safe status;

[0117] In the specific implementation process of the present invention, the specific steps may be:

[0118] S151: If the webpage outputs no abnormal area in the security detection, the state of the domain name to be confirmed is defined as a safe state;

[0119] S152: If the status of the domain name to be confirmed is a safe status, freeze the domain name;

[0120] S153: the domain name is associated with a list of domain names in a safe state;

[0121] S154: Add the domain name to the list of domain names in a safe state to form a new domain name list.

[0122] In an embodiment of the present application, if the web page outputs no abnormal area in the security detection, the state of the domain name to be confirmed is defined as a safe state. At this time, if the state of the domain name to be confirmed is a safe state, and the domain name is frozen, further control of the domain name to be confirmed is introduced.

[0123] Therefore, the domain name is associated with the list of domain names in a safe state; the domain name is added to the list of domain names in a safe state to form a new domain name list, and the autonomous update of the domain name list is realized, so as to ensure the real-time and autonomous update function of the domain name list.

[0124] refer to Figure 7 , S160: Update the domain name list in a safe state in real time, and synchronize the updated domain name list to the firewall;

[0125] In the specific implementation process of the present invention, the specific steps may be:

[0126] S161: Freeze the list of domain names in a safe state;

[0127] S162: associate a list of domain names in a safe state and domain names to be confirmed;

[0128] S163: triggering a real-time update of the domain name list based on the domain name list in a safe state and the domain name to be confirmed, and forming an updated domain name list;

[0129] S164: define a first parameter according to the updated domain name list, and define a second parameter for the firewall;

[0130] S165: defining a synchronization mode according to the second parameter and the first parameter;

[0131] S166: Define new content of the firewall based on the synchronization mode and the updated domain name list, and trigger an update of the firewall based on the new content of the firewall.

[0132] In the specific implementation process of the present invention, the list of domain names in a safe state is frozen, so as to introduce the list of domain names in a safe state and the domain names to be confirmed, thereby associating the list of domain names in a safe state and the domain names to be confirmed, and realizing the overall control of the list of domain names in a safe state and the domain names to be confirmed.

[0133] At this time, based on the domain name list in a safe state and the domain name to be confirmed, the real-time update of the domain name list is triggered, and an updated domain name list is formed; the first parameter is defined according to the updated domain name list, and the firewall defines the second parameter, so as to introduce the second parameter and the first parameter, and fully consider the second parameter and the first parameter.

[0134] Therefore, the synchronization mode is defined according to the second parameter and the first parameter; the new content of the firewall is defined based on the synchronization mode and the updated domain name list, and the update of the firewall is triggered based on the new content of the firewall.

[0135] At this time, the security check of the domain name to be confirmed defines the status of the domain name to be confirmed, so that the domain name to be confirmed in a safe state can be added to the list of domain names in a safe state, thereby realizing the update of the list of domain names in a safe state, and then synchronizing the updated list of domain names in a safe state to the firewall, realizing the filing of the firewall, and ensuring the normal use of the domain name to be confirmed under the control of the firewall.

[0136] The details are as follows:

[0137] When the application initiates a communication request to the domain name server, Qnx will first send a domain name resolution request to the DNS server. After the DNS server replies with the IP address, the application can accurately access the domain name server. During the DNS server reply process, the program myapp we developed will obtain the DNS resolution message on the BPF node, process it in time, and add it to the whitelist, so that the application will not be blocked by the firewall when communicating with the IP address in the future. Optionally, Qnx is a system and myapp is a program.

[0138] The startup process of myapp is to first load the network card driver, in which the bpf node function needs to be enabled; secondly, open the pf firewall and set the table that is allowed to pass. Use the qnx ham program to start myapp. If myapp exits abnormally due to uncertain factors such as memory being stepped on, ham will restart myapp in milliseconds. Finally, start each application and access the external domain name according to business needs.

[0139] The code logic of myapp:

[0140] 1. Use the open function to open the pf node (file in the / dev / pf path).

[0141] 2. Use the BIOCSETIF command of the ioctl function to set the monitoring network card.

[0142] 3. Use the BIOCIMMEDIATE command of the ioctl function to set the function to return immediately when any data packet appears in the receive buffer, rather than accumulating more data packets and processing them together, so that data can be processed quickly.

[0143] 4. Through the BIOCSHDRCMPLT command of the ioctl function, set to disable the automatically added Ethernet header. In other words, the target MAC address, own MAC address, and Ethernet type are filled in by our code in the next step of setting the filtering rules.

[0144] 5. Set the bpf filtering rules through the BIOCSETF command of the ioctl function.

[0145] Filter the source mac address to the specified mac

[0146] Filter the destination mac address to the specified mac

[0147] Filter the IP protocol or VLAN packets with Ethernet packet type 0x0800. If the Ethernet type field of the VLAN packet is 0x8100, skip 4 bytes.

[0148] Filter the source IP address to the specified IP (8.8.8.8)

[0149] 6. Use the BIOCGBLEN command of the ioctl function to obtain the length of the data buffer returned by the bpf node to prepare for reading data.

[0150] 7. Read the buffer buff through the read function.

[0151] 8. Check the read buff again

[0152] Check whether the source MAC address is 8.8.8.8

[0153] Check whether the source port is the dedicated port for DNS messages.

[0154] 9. The buff is the reply message from the DNS server. Parse the buff to obtain the domain name and the corresponding resolved IP address.

[0155] 10. There is a whitelist of domain names that are allowed to be accessed in myapp. Check whether the domain name parsed in 9 is in the whitelist.

[0156] 11. If it is in the domain name whitelist table, add it to the system whitelist table through the pfctl command, otherwise it will be discarded.

[0157] Therefore, compared with the solution of using pfctl to parse CDN domain names and add corresponding IP addresses to the whitelist in a regular manner under the QNX system, the problem that the CDN domain name whitelist cannot be added in real time when using the PF firewall under the QNX system is solved, and the real-time access of applications to the CDN domain name server through the PF firewall is ensured;

[0158] Combine the mac driver support for bpf nodes and bpf programming with the pf firewall, intercept the dns reply message through the bpf node to resolve the domain name and ip, and add it to the qnx system whitelist table through the pfctl command.

[0159] In an embodiment of the present invention, through the method in the embodiment of the present invention, the firewall associated with the server is located, and the corresponding IP address is associated with the firewall; the corresponding white list is defined based on the firewall and the corresponding IP address; the list of domain names in a safe state is matched according to the white list; the domain names to be confirmed are collected, and the domain names to be confirmed are subjected to security detection to define the status of the domain names to be confirmed; if the status of the domain names to be confirmed is a safe state, the domain names are added to the list of domain names in a safe state; the list of domain names in a safe state is updated in real time, and the updated list of domain names is synchronized to the firewall. At this time, the status of the domain names to be confirmed is defined for the security detection of the domain names to be confirmed, so that the domain names to be confirmed in a safe state are added to the list of domain names in a safe state, thereby realizing the update of the list of domain names in a safe state, and then synchronizing the updated list of domain names in a safe state to the firewall, realizing the filing of the firewall, and ensuring the normal use of the domain names to be confirmed under the control of the firewall.

[0160] The following describes an embodiment of the device of the present application, which can be used to execute the firewall control method for the whitelist in the above embodiment of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the firewall control method for the whitelist in the above embodiment of the present application.

[0161] Figure 8 A block diagram of a firewall whitelist control device according to an embodiment of the present application is shown.

[0162] Reference Figure 8 As shown, according to an embodiment of the present application, a firewall control device for a whitelist includes:

[0163] An association module 210, for locating a firewall associated with the server and associating a corresponding IP address based on the firewall;

[0164] A whitelist module 220, for defining a corresponding whitelist based on a firewall and a corresponding IP address;

[0165] A domain name list module 230, used to match a domain name list in a safe state according to a white list;

[0166] The first status module 240 is used to collect the domain name to be confirmed and perform security detection on the domain name to be confirmed to define the status of the domain name to be confirmed;

[0167] The second status module 250 is used to add the domain name to the list of domain names in a safe state if the state of the domain name to be confirmed is a safe state;

[0168] The firewall module 260 is used to update the domain name list in a safe state in real time and synchronize the updated domain name list to the firewall.

[0169] Fig. 9 A schematic diagram of the structure of a computer system suitable for implementing a firewall according to an embodiment of the present application is shown.

[0170] It should be noted that Fig. 9 The computer system of the firewall shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0171] like Fig. 9 As shown, the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method described in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0172] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0173] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 309, and / or installed from a removable medium 311. When the computer program is executed by a central processing unit (CPU) 301, various functions defined in the system of the present application are executed.

[0174] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0175] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0176] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not constitute limitations on the units themselves in some cases.

[0177] As another aspect, the present application also provides a computer-readable medium, which may be included in the firewall described in the above embodiment; or may exist independently without being assembled into the firewall. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the firewall, the firewall implements the method described in the above embodiment.

[0178] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0179] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0180] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0181] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A firewall control method for a whitelist, characterized in that: Applicable to firewall whitelist control scenarios; The firewall control method for the whitelist includes: Locate the firewall associated with the server and associate the corresponding IP address based on the firewall; Define corresponding whitelists based on firewalls and corresponding IP addresses; Match the domain name list in a safe state according to the whitelist; Collect the domain names to be confirmed and perform security checks on the domain names to be confirmed to define the status of the domain names to be confirmed; If the status of the domain name to be confirmed is safe, the domain name is added to the list of domain names in safe status; The list of domain names in a safe state is updated in real time, and the updated list of domain names is synchronized to the firewall.

2. The method according to claim 1, characterized in that The locating the firewall associated with the server and associating the corresponding IP address with the firewall includes: Collection server; The corresponding communication network based on the signal matching of the server; Define the corresponding firewall according to the communication network; Traverse the firewall and define the IP space in the firewall; Define the corresponding IP address based on the IP space and the corresponding server.

3. The method according to claim 1, characterized in that The whitelist defined based on the firewall and the corresponding IP address includes: Fixed IP address; Based on the firewall matching corresponding database; Associated databases and IP addresses; Define the corresponding security space based on the database and IP address; Define the corresponding whitelist according to the security space.

4. The method according to claim 3, characterized in that The domain name list in a safe state according to the whitelist matching includes: Fixed whitelist; Traverse the whitelist and output the corresponding security list; Associate the security list with the firewall's fire protection level; A list of domain names that are in a safe state is matched based on the security list and the firewall's fire protection level.

5. The method according to claim 4, characterized in that The collecting of the domain names to be confirmed and performing security detection on the domain names to be confirmed to define the status of the domain names to be confirmed includes: Monitor the server in real time and collect domain names to be confirmed based on the server; Defining the real status of the domain name to be confirmed based on the traversal of the domain name to be confirmed; If the domain name to be confirmed is in a real state, the domain name to be confirmed is opened and the corresponding web page is frozen; Trigger security detection based on web pages to conduct security detection on the domain name to be confirmed; The status of the domain name to be confirmed is defined according to the security check of the domain name to be confirmed.

6. The method according to claim 5, characterized in that If the status of the domain name to be confirmed is a safe status, the domain name is added to the list of domain names in a safe status, including: If the webpage outputs no abnormal area in the security detection, the status of the domain name to be confirmed is defined as a safe status; If the status of the domain name to be confirmed is safe, the domain name will be frozen; The domain name is associated with a list of domain names in a safe state; Add the domain name to the list of domain names in a safe state to form a new domain name list.

7. The method according to claim 6, characterized in that The real-time updating of the domain name list in a safe state and synchronizing the updated domain name list to the firewall include: Fixed the list of domain names that are in a safe state; A list of domain names that are associated with a safe status and domain names that are pending confirmation; Triggering real-time update of the domain name list based on the domain name list in a safe state and the domain name to be confirmed, and forming an updated domain name list; Define the first parameter according to the updated domain name list and define the second parameter for the firewall; defining a synchronization mode according to the second parameter and the first parameter; The new content of the firewall is defined based on the synchronization mode and the updated domain name list, and the update of the firewall is triggered based on the new content of the firewall.

8. A firewall control device for a whitelist, characterized in that: include: An association module is used to locate the firewall associated with the server and associate the corresponding IP address based on the firewall; Whitelist module, used to define corresponding whitelists based on firewalls and corresponding IP addresses; The domain name list module is used to match the domain name list in a safe state according to the whitelist; The first status module is used to collect the domain names to be confirmed and perform security detection on the domain names to be confirmed to define the status of the domain names to be confirmed; The second status module is used to add the domain name to the list of domain names in a safe state if the state of the domain name to be confirmed is a safe state; The firewall module is used to update the list of domain names in a safe state in real time and synchronize the updated domain name list to the firewall.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the firewall control method for a whitelist according to any one of claims 1 to 7 is implemented.

10. A firewall, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the firewall control method for the whitelist as described in any one of claims 1 to 7.

Images