Method, device and system for creating discontinuous port rule of security group

Abstract

The embodiment of the invention provides a method, device and system for creating discontinuous port rules of a security group, and the method comprises the steps: creating the security group on an OpenStack platform based on a first creation instruction, obtaining a traffic type and an authorization type of the security group, creating a security rule in the security group according to a network rule and the authorization type, and creating the discontinuous port rules of the security group according to a plurality of security group rules, generating a security group rule list, checking the discontinuous port rule based on a checking method to obtain a checking result, if the checking result shows that the checking is successful, converting the format of the discontinuous port rule, decomposing the discontinuous port corresponding to the converted discontinuous port rule into a continuous port group or a single processed port, and sending the discontinuous port group or the single processed port to the server; and combining the discontinuous port rules corresponding to the decomposed continuous port groups, and displaying the combined discontinuous port rules and the discontinuous port rules corresponding to the singly processed ports in a security group rule list, so that the discontinuous ports can be normally applied in practical application.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing platforms, and in particular to a method, device and system for creating discontinuous port rules of a security group. Background Art

[0002] At present, various industries are gradually integrating their business systems through cloud computing platforms. For security reasons, they can all use VPC technology for network security isolation. VPC stands for Virtual Private Cloud. VPC technology allows tenants to have an area in the cloud that is logically isolated from other tenants and use various cloud resources in this area. Tenants can fully control the virtual network on the cloud. In the existing technology, when users need to open or prohibit rules for multiple ports in batches, especially for discontinuous ports, the open source project security group only supports the creation of security group rules for single ports or continuous ports, but not for discontinuous ports. Therefore, the existing security group rule creation method may not meet user needs. Summary of the invention

[0003] The present invention provides a method, device and system for creating discontinuous port rules for a security group, which solves the problem in the prior art that a security group only supports creating security group rules for a single port or continuous ports, but does not support security rules for discontinuous ports.

[0004] According to one aspect of the present invention, a method for creating a discontinuous port rule of a security group is provided, comprising:

[0005] Based on the first creation instruction, create a security group on the OpenStack platform;

[0006] Obtain the traffic type and authorization type of the security group; wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates that the preset network traffic is allowed to pass through the security group;

[0007] Creating security rules in the security group according to the network rules and the authorization type and generating a security group rule list according to the multiple security group rules;

[0008] Based on the second creation instruction, create a discontinuous port rule in the security group rule list;

[0009] Based on the verification method, the discontinuous port rule is verified to obtain a verification result;

[0010] If the inspection result indicates that the inspection is successful, converting the format of the discontinuous port rule to obtain a converted discontinuous port rule;

[0011] Decomposing the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports;

[0012] Merging the discontinuous port rules corresponding to the decomposed continuous port groups;

[0013] The merged discontinuous port rules and the discontinuous port rules corresponding to the single processed port are displayed in the security group rule list.

[0014] In one embodiment, the checking of the discontinuous port rule based on the checking method to obtain a checking result includes:

[0015] If the port numbers of the discontinuous ports in the discontinuous port rule are all non-zero numbers, each discontinuous port in the discontinuous port rule is separated by a comma and the number of discontinuous ports is less than a first preset number threshold, a verification result is generated; wherein the verification result includes that the port format verification of the discontinuous ports is successful.

[0016] In one embodiment, the checking of the discontinuous port rule based on the checking method to obtain a checking result includes:

[0017] Obtain the number of the multiple security group rules;

[0018] Obtaining the number of the discontinuous port rules;

[0019] Calculate the total number according to the number of the multiple security group rules and the number of the discontinuous port rules;

[0020] If the total quantity is less than a second preset quantity threshold, a test result is generated; wherein the test result includes that the total quantity test is successful.

[0021] In one embodiment, the checking of the discontinuous port rule based on the checking method to obtain a checking result includes:

[0022] If there is no security group rule in the multiple security group rules that has the same content as the discontinuous port rule, a verification result is generated; wherein the verification result includes successful creation of the discontinuous port rule.

[0023] In one embodiment, before verifying the discontinuous port rule based on the verification method to obtain a verification result, the method for creating the discontinuous port rule of the security group further includes:

[0024] If the authorization type of the security group is that the security group is allowed to connect to the OpenStack platform, the discontinuous port rule is modified based on the modification rule.

[0025] In one embodiment, modifying the discontinuous port rule based on the modification rule includes:

[0026] Delete the discontinuous port rules to be modified;

[0027] Based on the modified content, a discontinuous port rule containing the modified content is created.

[0028] In one embodiment, creating a discontinuous port rule containing the modified content based on the modified content includes:

[0029] If the modified content includes that each discontinuous port corresponds to a discontinuous port rule, then the number of rules for creating the discontinuous port rules containing the modified content is obtained; wherein the number of the discontinuous port rules containing the modified content is equal to the difference between the number of the discontinuous ports and a third preset number threshold;

[0030] A discontinuous port rule that meets the rule quantity and contains the modified content is created.

[0031] In one embodiment, the checking of the discontinuous port rule based on the checking method to obtain a checking result includes:

[0032] Calculate the total number of rules based on the number of rules and the number of the multiple security group rules;

[0033] If the total number is less than a fourth preset number threshold, a test result is generated; wherein the test result includes that the discontinuous port rule containing the modified content is successfully created.

[0034] According to another aspect of the present invention, a module for creating discontinuous port rules of a security group is provided, comprising:

[0035] A first creation module is used to create a security group on the cloud platform based on a first creation instruction; obtain a traffic type and an authorization type of the security group; wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates that a preset network traffic is allowed to pass through the security group; according to the network rule and the authorization type, create a security rule in the security group and generate a security group rule list according to the multiple security group rules;

[0036] A second creation module is used to create a discontinuous port rule in the security group rule list based on a second creation instruction; based on a verification method, the discontinuous port rule is verified to obtain a verification result;

[0037] A verification module is used to convert the format of the discontinuous port rule to obtain a converted discontinuous port rule if the verification result indicates that the verification is successful; decompose the discontinuous port corresponding to the converted discontinuous port rule into a continuous port group or a single processed port; merge the discontinuous port rules corresponding to the decomposed continuous port group; and display the merged discontinuous port rule and the discontinuous port rule corresponding to the single processed port in the security group rule list.

[0038] According to another aspect of the present invention, a system for creating discontinuous port rules of a security group is provided, comprising:

[0039] A network platform management module, wherein the network platform module sets default quota rules; wherein the default quota rules include a limited number of security groups, a limited number of security group rules for each security group, and a limited number of discontinuous port rules;

[0040] A northbound interface management module, wherein the northbound interface management module is in communication with the network platform management module, and the northbound interface management module queries a virtual private network list and a subnet list through a northbound interface;

[0041] A security group management module, the security group management module is in communication with the northbound interface management module, the security group management module accesses a virtual private network list and a subnet list, and the security group management module includes a creation module for discontinuous port rules of the security group described above;

[0042] A database, the database is respectively connected to the network platform management module and the security group management module, and the database is used to store the default quota rules and the security groups, security group rules and discontinuous port rules created by the security group management module;

[0043] An OpenStack platform, wherein the OpenStack platform is communicated with the network platform management module and the security group management module respectively, and the security group management module creates the security group on the OpenStack platform.

[0044] The embodiment of the present invention provides a method, device and system for creating discontinuous port rules of a security group, including: based on a first creation instruction, creating a security group on an OpenStack platform, obtaining a traffic type and an authorization type of the security group, wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, the network rule indicates that a preset network traffic is allowed to pass through the security group, creating security rules in the security group according to the network rule and the authorization type, and generating a security group rule list according to multiple security group rules, based on a second creation instruction, creating discontinuous port rules in the security group rule list, based on a verification method, verifying the discontinuous port rules to obtain a verification result, if the verification result indicates that the verification is successful, converting the format of the discontinuous port rules to obtain a converted discontinuous port rule, decomposing the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports, merging the discontinuous port rules corresponding to the decomposed continuous port groups, and displaying the merged discontinuous port rules and the discontinuous port rules corresponding to the single processed ports in the security group rule list. By creating discontinuous port rules in security group rules and testing the discontinuous port rules, it is possible to verify whether the discontinuous ports meet the design requirements, and decompose the discontinuous ports in the discontinuous port rules into continuous port groups or single processed ports, so that the discontinuous ports can be used normally in actual applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The figure is a flowchart of a method for creating discontinuous port rules for a security group provided by an exemplary embodiment of the present invention.

[0046] Figure 2 It is a flowchart of a method for creating discontinuous port rules for a security group provided by another exemplary embodiment of the present invention.

[0047] Figure 3 It is a structural diagram of a module for creating discontinuous port rules of a security group provided by an exemplary embodiment of the present invention.

[0048] Figure 4 It is a structural diagram of a module for creating discontinuous port rules of a security group provided by another exemplary embodiment of the present invention.

[0049] Figure 5 It is a structural diagram of a system for creating discontinuous port rules for a security group provided by an exemplary embodiment of the present invention.

[0050] Figure 6 is a structural diagram of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0051] A security group is a virtual firewall with stateful packet filtering capabilities. It is used to set network access control for cloud servers, load balancers, cloud databases, and other instances, and control instance-level inbound and outbound traffic. It is an important means of network security isolation. You can configure security group rules to allow or prohibit outbound and inbound traffic for instances in a security group. A security group is a logical grouping that can add cloud servers, elastic network cards, cloud databases, and other instances in the same region with the same network security isolation requirements to the same security group. When creating a new security group, you can choose from the three provided security group templates: open ports 22, 3389, 80, and 443 and ICMP protocol, open all ports, and customize.

[0052] Figure 1 FIG. 1 is a flow chart of a method for creating discontinuous port rules for a security group provided by an exemplary embodiment of the present invention. Figure 1 As shown in the figure, the method of creating discontinuous port rules for a security group includes:

[0053] Step 110: Create a security group on the OpenStack platform based on the first creation instruction.

[0054] In an embodiment of the present invention, the administrator has the authority to configure the quota of security groups that can be created under a user, the quota of security group rules that can be created under a security group, and the quota of discontinuous port rules that can be created at one time. The default quota is: a user can create up to 50 security groups, a security group can create up to 100 inbound and outbound rules, and 20 discontinuous port rules can be created at one time. The administrator can adjust the quota according to the needs of the cloud center. After the quota configuration is completed, the user logs in to the console to create a security group.

[0055] Step 120: Obtain the traffic type and authorization type of the security group, where the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, and each traffic type corresponds to a network rule, which indicates that the preset network traffic is allowed to pass through the security group.

[0056] In the embodiment of the present invention, the traffic type of the security group includes opening ports 22, 3389, 80, 443 and ICMP protocol, opening all ports and custom. Opening ports 22, 3389, 80, and 443 includes: the entry rules of the security group will add rules for opening the same security group (allowing instances in the same security group to communicate with each other), opening the intranet (allowing traffic access from the intranet), opening the Ping service (allowing ICMP protocol traffic, usually used for Ping command response), opening Linux SSH login (allowing remote login through SSH (usually port 22) to manage Linux servers), opening Windows remote login (allowing remote desktop login through RDP (usually port 3389) to manage Windows servers), and opening rules for WEB service ports (allowing access to specific WEB service ports (such as 80 or 443) so that external users can access WEB applications), and the exit rules open all (indicates that the instance can send traffic to any destination address without restriction). ICMP protocol, open all ports, including inbound rules and outbound rules, where inbound rules open all means to allow all inbound traffic, regardless of the source IP address or port. Outbound rules open all means to allow all outbound traffic to any destination IP address or port. Customization includes inbound rules deny all traffic (prohibit all traffic entering the instance unless there is an explicit allow rule) and outbound rules open all (allow the instance to send traffic to any external or internal address without restriction).

[0057] When creating security group rules, the authorization type will be checked first to see if it is allowed or denied, that is, to determine whether the authorization type is allowed or denied to connect to the OpenStack platform. If the authorization type is allowed to connect to the OpenStack platform, the OpenStack security group rule creation API will be called. If the authorization type is denied to connect to the OpenStack platform, the self-developed blacklist rule creation API will be called.

[0058] Step 130: Create security rules in the security group according to the network rules and the authorization type and generate a security group rule list according to the multiple security group rules.

[0059] In an embodiment of the present invention, the security group rule list may include an inbound rule list and an outbound rule list, wherein the inbound rule list includes multiple inbound rules and the outbound rule list includes multiple outbound rules. Inbound rules control which traffic is allowed to enter an instance (virtual machine or other resource). Outbound rules control which traffic is allowed to be sent out by an instance.

[0060] Step 140: Based on the second creation instruction, create a discontinuous port rule in the security group rule list.

[0061] In the embodiment of the present invention, a discontinuous port rule is created in a security group of the OpenStack platform according to a creation instruction of a user.

[0062] Step 150: Based on the verification method, the discontinuous port rule is verified to obtain a verification result.

[0063] In an embodiment of the present invention, the discontinuous port rules are verified by a verification method to determine whether the construction of the discontinuous port rules meets the preset requirements and whether the number of discontinuous port rules meets the quantity quota. If the construction of the discontinuous port rules does not meet the preset requirements, the construction of the discontinuous port rules fails, and the construction failure is displayed, and the user is required to rebuild.

[0064] Step 160: If the test result indicates that the test is successful, the format of the discontinuous port rule is converted to obtain a converted discontinuous port rule.

[0065] In the embodiment of the present invention, after the rule content is verified, it is necessary to encapsulate the rule format. For discontinuous ports, since the open source project does not support parameter transmission in this format, it is necessary to parse the discontinuous port content, execute batch creation of rules, encapsulate the discontinuous ports into the creation format of batch rules, and call different business interfaces according to whether the authorization type is allowed or denied.

[0066] Step 170: Decompose the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports.

[0067] In an embodiment of the present invention, multiple discontinuous ports are merged into a continuous port range, which can significantly reduce the number of rules in the security group and simplify management and maintenance. For example, there are discontinuous ports including port 884, port 885, and port 8080. Port 884 and port 885 are constructed into a continuous port group, and port 8080 is a single processed port. Or there are discontinuous ports including port 86, port 89, and port 8080. Port 86 and port 89 are constructed into a continuous 86-89 port group, and port 8080 is a single processed port.

[0068] Step 180: Merge the discontinuous port rules corresponding to the decomposed continuous port groups.

[0069] In the embodiment of the present invention, the discontinuous port rules corresponding to the decomposed continuous port groups are merged so as to combine a plurality of discontinuous port rules into one group, so that the rules can be processed more quickly.

[0070] Step 190: Display the merged discontinuous port rules and the discontinuous port rules corresponding to the single processed port in the security group rule list.

[0071] In the embodiment of the present invention, the inbound rule and the outbound rule in the discontinuous port rule are determined, the discontinuous port rule that is the inbound rule is displayed in the inbound rule list, and the discontinuous port rule that is the outbound rule is displayed in the outbound rule list.

[0072] An embodiment of the present invention provides a method for creating discontinuous port rules of a security group, comprising: creating a security group on an OpenStack platform based on a first creation instruction, obtaining a traffic type and an authorization type of the security group, wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, the network rule indicates that a preset network traffic is allowed to pass through the security group, creating security rules in the security group according to the network rule and the authorization type, and generating a security group rule list according to multiple security group rules, creating discontinuous port rules in the security group rule list based on a second creation instruction, verifying the discontinuous port rules based on a verification method to obtain a verification result, if the verification result indicates that the verification is successful, converting the format of the discontinuous port rules to obtain converted discontinuous port rules, decomposing discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports, merging discontinuous port rules corresponding to the decomposed continuous port groups, and displaying the merged discontinuous port rules and the discontinuous port rules corresponding to the single processed ports in the security group rule list. By creating discontinuous port rules in security group rules and testing the discontinuous port rules, it is possible to verify whether the discontinuous ports meet the design requirements, and decompose the discontinuous ports in the discontinuous port rules into continuous port groups or single processed ports, so that the discontinuous ports can be used normally in actual applications.

[0073] Figure 2 FIG. 1 is a flow chart of a method for creating discontinuous port rules for a security group provided by another exemplary embodiment of the present invention. Figure 2 As shown, step 150 may include:

[0074] Step 151: If the port numbers of the discontinuous ports in the discontinuous port rule are all non-zero numbers, each discontinuous port in the discontinuous port rule is separated by a comma and the number of discontinuous ports is less than a first preset number threshold, a verification result is generated, wherein the verification result includes that the port format verification of the discontinuous ports is successful.

[0075] In an embodiment of the present invention, a discontinuous port rule can be set from an input rule list or an output rule list to verify whether the port format of the discontinuous port rule corresponding to the discontinuous port rule meets the preset format. The preset format includes that the discontinuous port is not empty (that is, the port number of the discontinuous port is a non-zero number), each port is separated by a comma, the content of the discontinuous port is not a character but a number, and the number of discontinuous ports cannot exceed the first preset number threshold, wherein the first preset number threshold can be 20. If the discontinuous port does not meet the requirements of the preset format, it will prompt that the port format is wrong and ask the user to re-enter.

[0076] In one embodiment, step 150 can be specifically implemented as follows: obtaining the number of multiple security group rules; obtaining the number of discontinuous port rules; calculating the total number based on the number of multiple security group rules and the number of discontinuous port rules; if the total number is less than a second preset number threshold, generating a test result; wherein the test result includes a total number test success.

[0077] In an embodiment of the present invention, it is set that a user can create a maximum of 50 security groups, a security group can create a maximum of 100 inbound and outbound rules, and 20 discontinuous port rules are allowed to be created at one time. Therefore, the number of multiple security group rules and the number of discontinuous port rules are obtained, and the total number is calculated based on the number of multiple security group rules and the number of discontinuous port rules. If the total number is less than 120, it means that the total number of rule creation tests is successful. In other words, the number of security group rules and discontinuous port rules constructed cannot exceed the system's quantity quota, where the quantity quota and the second preset quantity threshold can be 120. If the total number is greater than the second preset quantity threshold, a prompt message is generated, which indicates that the creation of the security group rules failed and the security group rule quota has been exhausted.

[0078] In one embodiment, step 150 may be specifically implemented as follows: if there is no security group rule with the same content as the discontinuous port rule among the multiple security group rules, a verification result is generated; wherein the verification result includes successful creation of the discontinuous port rule.

[0079] In an embodiment of the present invention, if there is a security group rule with the same content as a discontinuous port rule in multiple security group rules, it means that the discontinuous port rule already exists in the security group. If the created discontinuous port rule is repeated with the existing rule, it will be prompted that the creation of the security group rule failed.

[0080] In one embodiment, before step 150, the method for creating the discontinuous port rule of the security group may be specifically implemented as follows: if the authorization type of the security group is that the security group allows connection with the OpenStack platform, the discontinuous port rule is modified based on the modification rule.

[0081] In the embodiment of the present invention, since there is no modification API for the open source project security group rules, when modifying the rules, it is necessary to delete the old rules first and create new rules. If the number of newly created rules for discontinuous port requests is consistent with the number of ports, then check that the number of rules to be created under the security group is equal to the number of ports minus 1, and then determine whether the number of rules to be created plus the number of existing rules exceeds the rule quota under the security group. If the quota exceeds the limit, it will prompt that the creation of security group rules has failed and the security group rule quota has been exhausted.

[0082] In one embodiment, before step 150, the method for creating the discontinuous port rule of the security group may be specifically implemented as follows: deleting the discontinuous port rule to be modified; and creating a discontinuous port rule containing the modified content based on the modified content.

[0083] In the embodiment of the present invention, deleting old rules is the same as creating rules. It is necessary to determine the called API according to whether the authorization type is allowed or denied. If an allowed rule is modified to denied, the whitelist interface needs to be called to delete the allowed rule. Similarly, if a denied rule is modified to allowed, the blacklist interface needs to be called to delete the denied rule.

[0084] That is to say, when deleting old rules, you need to decide which API to call based on the authorization type of the rule (i.e., "allow" or "deny"). If you need to change a rule that was originally "allow" to "deny", you must first call the whitelist interface to delete the "allow" rule. Conversely, if you want to change a "deny" rule to "allow", you need to call the blacklist interface to delete the "deny" rule.

[0085] A whitelist is a list of entities that are allowed access or operations. In this case, the rules in the whitelist indicate that certain specific operations or requests are allowed to pass. For example, a user or service is allowed to access a certain API. A blacklist is a list of entities that are prohibited from access or operations. The rules in the blacklist indicate that certain specific operations or requests are not allowed. For example, a user or service is denied access to a certain API. An API is an interface for interaction between different software components. For example, an API can be an interface for managing whitelists and blacklists, such as the ability to add, delete, or modify rules.

[0086] In one embodiment, before step 150, the method for creating discontinuous port rules for the security group can be specifically implemented as follows: if the modified content includes that each discontinuous port corresponds to a discontinuous port rule, then the number of rules for creating discontinuous port rules containing the modified content is obtained; wherein the number of discontinuous port rules containing the modified content is equal to the difference between the number of discontinuous ports and a third preset number threshold; and a discontinuous port rule that meets the rule number and contains the modified content is created.

[0087] In an embodiment of the present invention, since there is no direct modification API for the security group rules of the open source project, when the user needs to update the rules, he must first delete the old rules and then create new rules. This approach will result in additional operation steps and may cause configuration errors. If you need to create rules for multiple discontinuous ports, you need to create a new rule for each port separately. Therefore, the number of new rules created is consistent with the number of ports. This means that if you need to open 5 discontinuous ports, you need to create 5 new discontinuous port rules.

[0088] In an embodiment of the present invention, before creating a new rule, it is necessary to check whether the number of rules to be created under the current security group exceeds the quota. Specifically: the number of discontinuous port rules containing modified content = the number of discontinuous ports - 1, which means that the number of ports that need to be opened in a request is minus 1 (because usually at least one existing rule needs to be retained). Before trying to create a new rule, it is necessary to check whether the number of existing rules plus the total number of newly created rules exceeds the rule quota of the security group. If the number of existing rules plus the number of newly created rules exceeds the rule quota of the security group, that is, the system will prompt "Failed to create security group rules, the security group rule quota has been exhausted." This means that the user can no longer add more rules and must first delete some existing rules before continuing to create new rules. Among them, the third preset quantity threshold is 1.

[0089] In one embodiment, before step 150, the method for creating discontinuous port rules for a security group may be specifically implemented as follows: calculating the total number of rules based on the number of rules and the number of multiple security group rules; if the total number is less than a fourth preset number threshold, generating a test result; wherein the test result includes successful creation of the discontinuous port rule containing the modified content.

[0090] In the embodiment of the present invention, the fourth preset quantity threshold may be a quantity quota set by the system by default. If the total quantity is less than the fourth preset quantity threshold, a test result is generated, indicating that the total quantity of security group rules and discontinuous port rules does not exceed the quantity quota set by the system by default. If the total quantity is greater than the fourth preset quantity threshold, it means that the total quantity of security group rules and discontinuous port rules exceeds the quantity quota set by the system by default, and a prompt message is generated, indicating that the creation of the discontinuous port rule failed.

[0091] Figure 3 FIG. 1 is a schematic diagram of a structure of a module for creating discontinuous port rules for a security group provided by an exemplary embodiment of the present invention. Figure 3As shown, the creation module 20 of the discontinuous port rules of the security group includes: a first creation module 201, which is used to create a security group on the cloud platform based on the first creation instruction; obtain the traffic type and authorization type of the security group; wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, and each traffic type corresponds to a network rule, and the network rule indicates that the preset network traffic is allowed to pass through the security group; according to the network rule and the authorization type, create security rules in the security group and generate a security group rule list according to multiple security group rules; a second creation module 202, which is used to create a discontinuous port rule in the security group rule list based on the second creation instruction; based on the verification method, verify the discontinuous port rule to obtain a verification result; a verification module 203, which is used to convert the format of the discontinuous port rule to obtain a converted discontinuous port rule if the verification result indicates that the verification is successful; decompose the discontinuous port corresponding to the converted discontinuous port rule into a continuous port group or a single processed port; merge the discontinuous port rules corresponding to the decomposed continuous port group; and display the merged discontinuous port rule and the discontinuous port rule corresponding to the single processed port in the security group rule list.

[0092] An embodiment of the present invention provides a device for creating discontinuous port rules for a security group. The device creates discontinuous port rules in security group rules and verifies the discontinuous port rules to verify whether the discontinuous ports meet the design requirements. The discontinuous ports in the discontinuous port rules are decomposed into continuous port groups or individually processed ports, so that the discontinuous ports can be used normally in actual applications.

[0093] Figure 4 FIG. 1 is a schematic diagram of a structure of a module for creating discontinuous port rules for a security group provided by another exemplary embodiment of the present invention. Figure 4 As shown, the verification module 203 may include: a first verification unit 2031, which is used to generate a verification result if the port numbers of the discontinuous ports in the discontinuous port rules are all non-zero numbers, each discontinuous port in the discontinuous port rule is separated by a comma and the number of discontinuous ports is less than a first preset number threshold; wherein the verification result includes a successful port format check of the discontinuous ports.

[0094] In one embodiment, the verification module 203 may include: a first quantity unit 2032, used to obtain the number of multiple security group rules; a second quantity unit 2033, used to obtain the number of discontinuous port rules; a calculation unit 2034, used to calculate the total number based on the number of multiple security group rules and the number of discontinuous port rules; a generation unit 2035, used to generate a verification result if the total number is less than a second preset quantity threshold; wherein the verification result includes a successful total quantity verification.

[0095] In one embodiment, the verification module 203 may be specifically configured to generate a verification result if there is no security group rule with the same content as the discontinuous port rule among the multiple security group rules; wherein the verification result includes successful creation of the discontinuous port rule.

[0096] In one embodiment, before the verification module 203, the security group discontinuous port rule creation device 20 may be specifically configured as follows: if the authorization type of the security group is that the security group is allowed to connect to the OpenStack platform, the discontinuous port rule is modified based on the modification rule.

[0097] In one embodiment, before the verification module 203, the security group discontinuous port rule creation device 20 may be specifically configured to: delete the discontinuous port rule to be modified;

[0098] Based on the modified content, a discontinuous port rule containing the modified content is created.

[0099] In one embodiment, before the verification module 203, the discontinuous port rule creation device 20 of the security group may be specifically configured as follows: if the modification content includes that each discontinuous port corresponds to a discontinuous port rule, then the number of rules for creating discontinuous port rules containing the modification content is obtained; wherein the number of discontinuous port rules containing the modification content is equal to the difference between the number of discontinuous ports and the third preset number threshold;

[0100] Create a non-contiguous port rule that meets the rule quantity and contains the modified content.

[0101] In one embodiment, the verification module 203 can be specifically configured as follows: calculating the total number of rules based on the number of rules and the number of multiple security group rules; if the total number is less than a fourth preset number threshold, generating a verification result; wherein the verification result includes successful creation of a discontinuous port rule containing modified content.

[0102] Figure 5 FIG. 1 is a schematic diagram of a system for creating discontinuous port rules for a security group provided by an exemplary embodiment of the present invention. Figure 5As shown, the system for creating discontinuous port rules for security groups includes: a network platform management module, the network platform module sets default quota rules; wherein the default quota rules include the limited number of security groups, the limited number of security group rules for each security group, and the limited number of discontinuous port rules; a northbound interface management module, the northbound interface management module is communicated with the network platform management module, and the northbound interface management module queries the virtual private network list and the subnet list through the northbound interface; a security group management module, the security group management module is communicated with the northbound interface management module, the security group management module accesses the virtual private network list and the subnet list, and the security group management module includes the above-mentioned security group discontinuous port rule creation module; a database, the database is communicated with the network platform management module and the security group management module respectively, and the database is used to store the default quota rules and the security groups, security group rules, and discontinuous port rules created by the security group management module; an OpenStack platform, the OpenStack platform is communicated with the network platform management module and the security group management module respectively, and the security group management module creates a security group on the OpenStack platform.

[0103] An embodiment of the present invention provides a system for creating discontinuous port rules for a security group. By creating discontinuous port rules in security group rules and checking the discontinuous port rules, it is verified whether the discontinuous ports meet the design requirements, and the discontinuous ports in the discontinuous port rules are decomposed into continuous port groups or individually processed ports, so that the discontinuous ports can be used normally in actual applications.

[0104] The northbound interface module is mainly used to provide REST API to the outside world, so as to provide tenants with the functions of creating networks, creating cloud hosts and associating security groups. For example, by providing tenant ID, network segment CIDR, and region, you can create networks, create subnets, delete subnets, delete virtual private networks, create security groups, delete security groups, view security group lists, create security group rules, modify security group rules, view security group entry rule lists, view security group exit rule lists, and delete security group rules.

[0105] The database module stores information about related tenants, virtual private networks, subnets, security groups, security group rules, etc. All relevant information established by tenants through the network platform management module and the security group management module is stored in the database.

[0106] The network platform management module is mainly used to manage security groups and security group rule quotas. The quota is managed through the administrator account. The quota includes: the security group quota allowed to be created under a user, the security group rule quota allowed to be created under a security group, and the discontinuous port rule quota allowed to be created at one time. The default quota is: a user can create up to 50 security groups, a security group can create up to 100 inbound and outbound rules, and 20 discontinuous port rules are allowed to be created at one time. The administrator can adjust the quota according to the needs of the cloud center. After the quota configuration is completed, the user logs in to the console to create a security group.

[0107] The security group management module is used to manage security groups, including querying the security group list, viewing security group details, creating security groups, deleting security groups, updating security group names, querying the input rule list, querying the output rule list, adding rules, deleting rules, and modifying rules. Operations on discontinuous ports involve creating rules and modifying rules. Both creating and modifying rules require port format verification. The port format is used to determine whether to create a discontinuous port rule. The port format for creating discontinuous ports must meet the following requirements: the port is not empty, the comma-separated ports are not characters but numbers, and the number of discontinuous ports cannot exceed 20. If the discontinuous ports transmitted do not meet the format requirements, the port format error will be prompted, please re-enter. In addition, quota verification is required. The quota verification when creating rules means that the number of rules to be created is equal to the number of ports. To modify rules, the old rules must be deleted first and new rules must be created. The number of rules to be created is equal to the number of ports minus 1. Whether the number of rules created plus the number of existing rules exceeds the rule quota under the security group, if the quota exceeds the limit, it will prompt that the creation of security group rules has failed and the security group rule quota has been exhausted. After the rule format and field verification pass, the security group rule duplication verification is also required. If the rule to be created is repeated with an existing rule, it will prompt that the creation of the security group rule failed and the same rule already exists under the security group. Creating and deleting rules requires calling different business interfaces based on whether the authorization type is allowed or denied.

[0108] Figure 6 A block diagram of an electronic device according to an embodiment of the present application is illustrated.

[0109] like Figure 6 As shown, the electronic device 10 includes one or more processors 11 and a memory 12 .

[0110] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0111] The memory 12 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the method for creating discontinuous port rules for the security group of each embodiment of the present application described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0112] In one example, the electronic device 10 may further include: an input device 13 and an output device 14, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0113] When the electronic device 10 is a stand-alone device, the input device 13 may be a communication network connector for receiving collected input signals from the first device and the second device.

[0114] In addition, the input device 13 may also include, for example, a keyboard, a mouse, and the like.

[0115] The output device 14 can output various information to the outside, including the determined distance information, direction information, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0116] Of course, to simplify, Figure 6 Only some of the components related to the present application in the electronic device 10 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 10 may also include any other appropriate components.

[0117] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0118] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0119] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0120] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for creating discontinuous port rules for a security group, characterized in that: include: Based on the first creation instruction, create a security group on the OpenStack platform; Obtain the traffic type and authorization type of the security group; wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates that the preset network traffic is allowed to pass through the security group; Creating security rules in the security group according to the network rules and the authorization type and generating a security group rule list according to the multiple security group rules; Based on the second creation instruction, create a discontinuous port rule in the security group rule list; Based on the verification method, the discontinuous port rule is verified to obtain a verification result; If the inspection result indicates that the inspection is successful, converting the format of the discontinuous port rule to obtain a converted discontinuous port rule; Decomposing the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports; Merging the discontinuous port rules corresponding to the decomposed continuous port groups; The merged discontinuous port rules and the discontinuous port rules corresponding to the single processed port are displayed in the security group rule list.

2. The method for creating discontinuous port rules for a security group according to claim 1, characterized in that: The checking of the discontinuous port rule based on the checking method to obtain a checking result includes: If the port numbers of the discontinuous ports in the discontinuous port rule are all non-zero numbers, each discontinuous port in the discontinuous port rule is separated by a comma and the number of discontinuous ports is less than a first preset number threshold, a verification result is generated; wherein the verification result includes that the port format verification of the discontinuous ports is successful.

3. The method for creating discontinuous port rules of a security group according to claim 1, characterized in that: The checking of the discontinuous port rule based on the checking method to obtain a checking result includes: Obtain the number of the multiple security group rules; Obtaining the number of the discontinuous port rules; Calculate the total number according to the number of the multiple security group rules and the number of the discontinuous port rules; If the total quantity is less than a second preset quantity threshold, a test result is generated; wherein the test result includes that the total quantity test is successful.

4. The method for creating discontinuous port rules for a security group according to claim 1, characterized in that: The checking of the discontinuous port rule based on the checking method to obtain a checking result includes: If there is no security group rule in the multiple security group rules that has the same content as the discontinuous port rule, a verification result is generated; wherein the verification result includes successful creation of the discontinuous port rule.

5. The method for creating discontinuous port rules of a security group according to claim 1, characterized in that: Before the discontinuous port rule is checked based on the checking method to obtain a checking result, the method further includes: If the authorization type of the security group is that the security group is allowed to connect to the OpenStack platform, the discontinuous port rule is modified based on the modification rule.

6. The method for creating discontinuous port rules of a security group according to claim 5, characterized in that: The modifying of the discontinuous port rule based on the modification rule includes: Delete the discontinuous port rules to be modified; Based on the modified content, a discontinuous port rule containing the modified content is created.

7. The method for creating discontinuous port rules for a security group according to claim 6, characterized in that: The step of creating a discontinuous port rule containing the modified content based on the modified content includes: If the modified content includes that each discontinuous port corresponds to a discontinuous port rule, then the number of rules for creating the discontinuous port rules containing the modified content is obtained; wherein the number of the discontinuous port rules containing the modified content is equal to the difference between the number of the discontinuous ports and a third preset number threshold; A discontinuous port rule that meets the rule quantity and contains the modified content is created.

8. The method for creating discontinuous port rules of a security group according to claim 5, characterized in that: The checking of the discontinuous port rule based on the checking method to obtain a checking result includes: Calculate the total number of rules based on the number of rules and the number of the multiple security group rules; If the total number is less than a fourth preset number threshold, a test result is generated; wherein the test result includes that the discontinuous port rule containing the modified content is successfully created.

9. A module for creating discontinuous port rules of a security group, characterized in that: include: A first creation module, used to create a security group on the cloud platform based on a first creation instruction; Obtaining the traffic type and authorization type of the security group; wherein the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates that the preset network traffic is allowed to pass through the security group; creating security rules in the security group according to the network rules and authorization type, and generating a security group rule list according to the multiple security group rules; A second creation module is used to create a discontinuous port rule in the security group rule list based on a second creation instruction; based on a verification method, the discontinuous port rule is verified to obtain a verification result; A verification module is used to convert the format of the discontinuous port rule to obtain a converted discontinuous port rule if the verification result indicates that the verification is successful; decompose the discontinuous port corresponding to the converted discontinuous port rule into a continuous port group or a single processed port; merge the discontinuous port rules corresponding to the decomposed continuous port group; and display the merged discontinuous port rule and the discontinuous port rule corresponding to the single processed port in the security group rule list.

10. A system for creating discontinuous port rules for a security group, characterized in that: include: A network platform management module, wherein the network platform module sets default quota rules; wherein the default quota rules include a limited number of security groups, a limited number of security group rules for each security group, and a limited number of discontinuous port rules; A northbound interface management module, the northbound interface management module is in communication connection with the network platform management module, and the northbound interface management module queries the virtual private network list and the subnet list through the northbound interface; A security group management module, the security group management module is in communication with the northbound interface management module, the security group management module accesses a virtual private network list and a subnet list, and the security group management module includes a creation module for discontinuous port rules of the security group according to claim 9; A database, the database is respectively connected to the network platform management module and the security group management module, and the database is used to store the default quota rules and the security groups, security group rules and discontinuous port rules created by the security group management module; An OpenStack platform, wherein the OpenStack platform is communicated with the network platform management module and the security group management module respectively, and the security group management module creates the security group on the OpenStack platform.

Images