A method, apparatus, and system for creating discontinuous port rules for security groups.

Abstract

This invention provides a method, apparatus, and system for creating non-contiguous port rules for security groups, comprising: creating a security group on an OpenStack platform based on a first creation instruction; obtaining the traffic type and authorization type of the security group; creating security rules within the security group according to network rules and authorization types; generating a security group rule list based on multiple security group rules; verifying the non-contiguous port rules based on a verification method to obtain a verification result; if the verification result indicates successful verification, converting the format of the non-contiguous port rules; decomposing the non-contiguous ports corresponding to the converted non-contiguous port rules into contiguous port groups or single processed ports; merging the non-contiguous port rules corresponding to the decomposed contiguous port groups; and displaying the merged non-contiguous port rules and the non-contiguous port rules corresponding to the single processed ports in the security group rule list so that non-contiguous ports can be used normally in practical applications.

Description

Technical Field

[0001] This invention relates to the field of cloud computing platform technology, and in particular to a method, apparatus and system for creating discontinuous port rules for security groups. Background Technology

[0002] Currently, various industries are gradually integrating their business systems through cloud computing platforms. For security reasons, they can all use VPC technology for secure isolation on the network. VPC, or Virtual Private Cloud, allows tenants to have a logically isolated area within the cloud, where they can use various cloud resources. Tenants have complete control over the virtual network in the cloud. In existing technologies, when users need to allow or block rules for multiple ports in batches, especially non-contiguous ports, open-source security group projects only support creating security group rules for single or consecutive ports, not for non-contiguous ports. Therefore, existing security group rule creation methods may not meet user needs. Summary of the Invention

[0003] This invention provides a method, apparatus, and system for creating non-contiguous port rules for security groups, which solves the problem that existing security groups only support the creation of security group rules for single ports or consecutive ports, and do not support security rules for non-contiguous ports.

[0004] According to one aspect of the present invention, a method for creating discontinuous port rules for a security group is provided, comprising:

[0005] Based on the first creation command, create a security group on the OpenStack platform;

[0006] Obtain the traffic type and authorization type of the security group; wherein, the authorization type indicates whether the security group allows connection to the OpenStack platform, and each traffic type corresponds to a network rule, the network rule indicating whether preset network traffic is allowed to pass through the security group;

[0007] Based on the network rules and authorization type, create security rules within the security group and generate a security group rule list based on the multiple security group rules;

[0008] Based on the second creation instruction, create non-contiguous port rules in the security group rule list;

[0009] Based on the verification method, the discontinuous port rules are verified to obtain the verification result;

[0010] If the verification result indicates that the verification is successful, the format of the non-contiguous port rule is converted to obtain the converted non-contiguous port rule.

[0011] The discontinuous ports corresponding to the transformed discontinuous port rules are decomposed into continuous port groups or individual processed ports.

[0012] Merge the non-contiguous port rules corresponding to the continuous port groups after decomposition;

[0013] The merged discontinuous port rules and the discontinuous port rules corresponding to the individually processed ports are displayed in the security group rule list.

[0014] In one embodiment, the verification method for checking the discontinuous port rules to obtain the verification result includes:

[0015] If the port numbers of the non-contiguous ports in the non-contiguous port rule are all non-zero numbers, each non-contiguous port in the non-contiguous port rule is separated by a comma, and the number of non-contiguous ports is less than a first preset threshold, then a verification result is generated; wherein, the verification result includes the successful verification of the port format of the non-contiguous ports.

[0016] In one embodiment, the verification method for checking the discontinuous port rules to obtain the verification result includes:

[0017] Obtain the number of the multiple security group rules;

[0018] Obtain the number of the non-contiguous port rules;

[0019] Calculate the total number based on the number of the multiple security group rules and the number of the non-contiguous port rules;

[0020] If the total quantity is less than the second preset quantity threshold, a verification result is generated; wherein the verification result includes the total quantity being successfully verified.

[0021] In one embodiment, the verification method for checking the discontinuous port rules to obtain the verification result includes:

[0022] If none of the multiple security group rules has the same content as the non-contiguous port rule, a verification result is generated; wherein, the verification result includes successful creation of the non-contiguous port rule.

[0023] In one embodiment, before verifying the discontinuous port rules based on the verification method to obtain the verification result, the method for creating discontinuous port rules of the security group further includes:

[0024] If the authorization type of the security group is that the security group allows connections to the OpenStack platform, then the rules for non-contiguous ports are modified based on the modification rules.

[0025] In one embodiment, modifying the rules for discontinuous ports based on modification rules includes:

[0026] Delete the non-contiguous port rules that need to be modified;

[0027] Based on the modified content, create discontinuous port rules containing the modified content.

[0028] In one embodiment, creating a non-contiguous port rule containing the modified content includes:

[0029] If the modified content includes a non-contiguous port rule corresponding to each non-contiguous port, then obtain the number of rules that create non-contiguous port rules containing the modified content; wherein, the number of non-contiguous port rules containing the modified content is equal to the difference between the number of non-contiguous ports and a third preset number threshold.

[0030] Create non-contiguous port rules that satisfy the stated number of rules and contain the stated modifications.

[0031] In one embodiment, the verification method for checking the discontinuous port rules to obtain the verification result includes:

[0032] Calculate the total number of rules based on the number of rules and the number of rules in the multiple security groups;

[0033] If the total number is less than the fourth preset number threshold, a verification result is generated; wherein, the verification result includes the successful creation of discontinuous port rules containing the modified content.

[0034] According to another aspect of the present invention, a module for creating discontinuous port rules for security groups is provided, comprising:

[0035] The first creation module is used to create a security group on the cloud platform based on a first creation instruction; obtain the traffic type and authorization type of the security group; wherein, the authorization type indicates whether the security group is allowed to connect to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates whether preset network traffic is allowed to pass through the security group; create security rules within the security group according to the network rules and authorization type, and generate a security group rule list according to the multiple security group rules;

[0036] The second creation module is used to create non-contiguous port rules in the security group rule list based on the second creation instruction; and to verify the non-contiguous port rules based on the verification method to obtain the verification result.

[0037] The verification module is used to convert the format of the discontinuous port rule to obtain the converted discontinuous port rule if the verification result indicates that the verification is successful; decompose the discontinuous ports corresponding to the converted discontinuous port rule into continuous port groups or single processed ports; merge the discontinuous port rules corresponding to the decomposed continuous port groups; and display the merged discontinuous port rule and the discontinuous port rule corresponding to the single processed port in the security group rule list.

[0038] According to another aspect of the present invention, a system for creating discontinuous port rules for security groups is provided, comprising:

[0039] The network platform management module sets default quota rules; wherein, the default quota rules include the limit number of security groups, the limit number of security group rules for each security group, and the limit number of non-contiguous port rules;

[0040] A northbound interface management module, which is communicatively connected to the network platform management module, queries the list of virtual private networks and subnets through the northbound interface;

[0041] The security group management module is communicatively connected to the northbound interface management module. The security group management module accesses the virtual private network list and subnet list. The security group management module includes the module for creating non-contiguous port rules for security groups as described above.

[0042] The database is communicatively connected to the network platform management module and the security group management module, and is used to store the default quota rules, as well as the security groups, security group rules, and non-contiguous port rules created by the security group management module.

[0043] The OpenStack platform is communicatively connected to the network platform management module and the security group management module, and the security group management module creates the security group on the OpenStack platform.

[0044] This invention provides a method, apparatus, and system for creating discontinuous port rules for security groups, comprising: creating a security group on an OpenStack platform based on a first creation instruction; obtaining the traffic type and authorization type of the security group, wherein the authorization type indicates whether the security group allows connection to the OpenStack platform; each traffic type corresponds to a network rule; the network rule indicates whether preset network traffic is allowed to pass through the security group; creating security rules within the security group based on the network rules and authorization type; generating a security group rule list based on multiple security group rules; creating discontinuous port rules in the security group rule list based on a second creation instruction; verifying the discontinuous port rules based on a verification method to obtain a verification result; if the verification result indicates successful verification, converting the format of the discontinuous port rules to obtain converted discontinuous port rules; decomposing the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports; merging the discontinuous port rules corresponding to the decomposed continuous port groups; and displaying the merged discontinuous port rules and the discontinuous port rules corresponding to the single processed ports in the security group rule list. By creating discontinuous port rules in security group rules and verifying these rules, it is possible to confirm whether discontinuous ports meet design requirements. Furthermore, the discontinuous ports in the discontinuous port rules can be decomposed into continuous port groups or individual ports for processing, thus enabling the discontinuous ports to function normally in practical applications. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating a method for creating discontinuous port rules for security groups according to an exemplary embodiment of the present invention.

[0046] Figure 2 This is a flowchart illustrating a method for creating discontinuous port rules for security groups, provided in another exemplary embodiment of the present invention.

[0047] Figure 3 This is a schematic diagram of the structure of the module for creating discontinuous port rules for security groups provided in an exemplary embodiment of the present invention.

[0048] Figure 4 This is a schematic diagram of the structure of the module for creating discontinuous port rules for security groups provided in another exemplary embodiment of the present invention.

[0049] Figure 5 This is a schematic diagram of the structure of a system for creating discontinuous port rules for security groups provided in an exemplary embodiment of the present invention.

[0050] Figure 6 This is a structural diagram of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0051] A security group is a virtual firewall with stateful packet filtering capabilities. It's used to configure network access control for instances such as cloud servers, load balancers, and cloud databases, controlling inbound and outbound traffic at the instance level. It's a crucial network security isolation method. Security group rules can be configured to allow or block inbound and outbound traffic to instances within the same security group. A security group is a logical grouping that allows cloud servers, elastic network interfaces, cloud databases, and other instances with similar network security isolation requirements within the same region to be added to the same security group. When creating a new security group, you can choose from three provided templates: allow ports 22, 3389, 80, and 443 and the ICMP protocol; allow all ports; and customize.

[0052] Figure 1 This is a flowchart illustrating a method for creating discontinuous port rules for security groups according to an exemplary embodiment of the present invention. Figure 1 As shown, the methods for creating discontinuous port rules for security groups include:

[0053] Step 110: Based on the first creation command, create a security group on the OpenStack platform.

[0054] In this embodiment of the invention, administrator privileges configure a quota for the number of security groups a user can create, a quota for the number of security group rules a user can create under a security group, and a quota for the number of non-contiguous port rules that can be created at one time. The default quota is: a user can create a maximum of 50 security groups, a security group can create a maximum of 100 inbound and outbound rules, and 20 non-contiguous port rules can be created at one time. The administrator can adjust this quota according to the needs of the cloud center. After the quota is configured, the user logs in to the console to create a security group.

[0055] Step 120: Obtain the traffic type and authorization type of the security group. The authorization type indicates whether the security group allows connection to the OpenStack platform. Each traffic type corresponds to a network rule, which indicates whether preset network traffic is allowed to pass through the security group.

[0056] In this embodiment of the invention, the traffic types of the security group include allowing ports 22, 3389, 80, and 443 and the ICMP protocol, allowing all ports, and custom rules. Allowing ports 22, 3389, 80, and 443 includes: inbound rules for the security group allowing communication between instances within the same security group, allowing access to the internal network (allowing traffic from the internal network), allowing Ping service (allowing ICMP protocol traffic, typically used for Ping command responses), allowing Linux SSH login (allowing remote login via SSH (usually port 22) for managing Linux servers), allowing Windows remote login (allowing remote desktop login via RDP (usually port 3389) for managing Windows servers), and rules for allowing web service ports (allowing access to specific web service ports (such as 80 or 443) so that external users can access web applications). Outbound rules allow all ports (meaning instances can send traffic to any destination address without restriction). The ICMP protocol allows all ports to be open, including both inbound and outbound rules. Allowing all inbound traffic means permitting all traffic originating from any IP address or port. Allowing all outbound traffic means permitting all outbound traffic to any destination IP address or port. Custom rules can also be configured to deny all inbound traffic (blocking all traffic entering the instance unless explicitly allowed) and allow all outbound traffic (allowing the instance to send traffic to any external or internal address without restriction).

[0057] When creating a security group rule, the system first verifies whether the authorization type is allowed or denied, that is, whether the authorization type allows or denies connection to the OpenStack platform. If the authorization type is allowed to connect to the OpenStack platform, the OpenStack API for creating a security group rule is called. If the authorization type is denied to connect to the OpenStack platform, the self-developed API for creating a blacklist rule is called.

[0058] Step 130: Create security rules within the security group based on network rules and authorization types, and generate a list of security group rules based on multiple security group rules.

[0059] In this embodiment of the invention, the security group rule list may include an inbound rule list and an outbound rule list. The inbound rule list includes multiple inbound rules, and the outbound rule list includes multiple outbound rules. Inbound rules control which traffic is allowed to enter the instance (virtual machine or other resource). Outbound rules control which traffic is allowed to be sent out by the instance.

[0060] Step 140: Based on the second creation instruction, create non-contiguous port rules in the security group rule list.

[0061] In this embodiment of the invention, non-contiguous port rules are created in the security group of the OpenStack platform according to the user's creation instructions.

[0062] Step 150: Based on the verification method, verify the non-contiguous port rules to obtain the verification results.

[0063] In this embodiment of the invention, a verification method is used to verify the non-contiguous port rules to determine whether the construction of the non-contiguous port rules meets the preset requirements and whether the number of non-contiguous port rules meets the quantity quota. If the construction of the non-contiguous port rules does not meet the preset requirements, the construction of the non-contiguous port rules fails and the construction failure is displayed, and the user needs to rebuild it.

[0064] Step 160: If the verification result indicates that the verification was successful, the format of the non-contiguous port rule is converted to obtain the converted non-contiguous port rule.

[0065] In this embodiment of the invention, after the rule content verification passes, the rule format needs to be encapsulated. For non-contiguous ports, since the open-source project does not support this format of parameter transmission, it is necessary to parse the non-contiguous port content, perform batch rule creation, encapsulate the non-contiguous ports into a batch rule creation format, and call different business interfaces according to whether the authorization type is allow or deny.

[0066] Step 170: Decompose the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or individual ports for processing.

[0067] In this embodiment of the invention, merging multiple discontinuous ports into a single contiguous port range can significantly reduce the number of rules in a security group, simplifying management and maintenance. For example, if there are discontinuous ports including ports 884, 885, and 8080, ports 884 and 885 can be grouped into a contiguous port group, with port 8080 serving as a single-processing port. Alternatively, if there are discontinuous ports including ports 86, 89, and 8080, ports 86 and 89 can be grouped into a contiguous port group 86-89, with port 8080 serving as a single-processing port.

[0068] Step 180: Merge the non-contiguous port rules corresponding to the decomposed continuous port groups.

[0069] In this embodiment of the invention, the non-contiguous port rules corresponding to the decomposed continuous port groups are merged to combine multiple non-contiguous port rules into one group, thereby enabling faster rule processing.

[0070] Step 190: Display the merged non-contiguous port rules and the non-contiguous port rules corresponding to the individually processed ports in the security group rule list.

[0071] In this embodiment of the invention, the inbound and outbound rules in the discontinuous port rules are determined, and the discontinuous port rules that are inbound rules are displayed in the inbound rule list, and the discontinuous port rules that are outbound rules are displayed in the outbound rule list.

[0072] This invention provides a method for creating non-contiguous port rules for a security group, comprising: creating a security group on an OpenStack platform based on a first creation instruction; obtaining the traffic type and authorization type of the security group, wherein the authorization type indicates whether the security group allows connection to the OpenStack platform; each traffic type corresponds to a network rule, and the network rule indicates whether preset network traffic is allowed to pass through the security group; creating security rules within the security group based on the network rules and authorization type; generating a security group rule list based on multiple security group rules; creating non-contiguous port rules in the security group rule list based on a second creation instruction; verifying the non-contiguous port rules based on a verification method to obtain a verification result; if the verification result indicates successful verification, converting the format of the non-contiguous port rules to obtain converted non-contiguous port rules; decomposing the non-contiguous ports corresponding to the converted non-contiguous port rules into continuous port groups or single processed ports; merging the non-contiguous port rules corresponding to the decomposed continuous port groups; and displaying the merged non-contiguous port rules and the non-contiguous port rules corresponding to the single processed ports in the security group rule list. By creating discontinuous port rules in security group rules and verifying these rules, it is possible to confirm whether discontinuous ports meet design requirements. Furthermore, the discontinuous ports in the discontinuous port rules can be decomposed into continuous port groups or individual ports for processing, thus enabling the discontinuous ports to function normally in practical applications.

[0073] Figure 2 This is a flowchart illustrating a method for creating discontinuous port rules for security groups, provided in another exemplary embodiment of the present invention. Figure 2 As shown, step 150 may include:

[0074] Step 151: If the port numbers of the non-contiguous ports in the non-contiguous port rule are all non-zero numbers, each non-contiguous port in the non-contiguous port rule is separated by a comma, and the number of non-contiguous ports is less than the first preset number threshold, then generate a verification result, wherein the verification result includes the successful verification of the port format of the non-contiguous ports.

[0075] In this embodiment of the invention, non-contiguous port rules can be set from the inbound rule list or the outbound rule list. The system verifies whether the port format of the non-contiguous port rule meets a preset format. The preset format includes the following: non-contiguous ports are not empty (i.e., the port numbers of non-contiguous ports are non-zero numbers); each port is separated by a comma; the content of the non-contiguous ports is not characters but numbers; and the number of non-contiguous ports cannot exceed a first preset threshold, which can be 20. If a non-contiguous port does not meet the preset format requirements, a port format error will be displayed, and the user will be prompted to re-enter the port information.

[0076] In one embodiment, step 150 may be specifically implemented as follows: obtaining the number of multiple security group rules; obtaining the number of non-contiguous port rules; calculating the total number based on the number of multiple security group rules and the number of non-contiguous port rules; if the total number is less than a second preset number threshold, generating a verification result; wherein the verification result includes the total number being verified successfully.

[0077] In this embodiment of the invention, a user is allowed to create a maximum of 50 security groups, and each security group can have a maximum of 100 inbound and outbound rules. A maximum of 20 non-contiguous port rules can be created at once. Therefore, the number of rules in multiple security groups and the number of non-contiguous port rules are obtained, and the total number is calculated based on these numbers. If the total number is less than 120, the rule creation verification is successful. In other words, the number of security group rules and non-contiguous port rules created cannot exceed the system's quota, where the quota and the second preset threshold can be 120. If the total number exceeds the second preset threshold, a prompt message is generated indicating that security group rule creation failed and the security group rule quota has been exhausted.

[0078] In one embodiment, step 150 can be specifically implemented as follows: if there is no security group rule with the same content as the non-contiguous port rule among the multiple security group rules, then a verification result is generated; wherein, the verification result includes successful creation of the non-contiguous port rule.

[0079] In this embodiment of the invention, if multiple security group rules contain the same content as non-contiguous port rules, it indicates that the non-contiguous port rule already exists in the security group. If the created non-contiguous port rule is duplicated with an existing rule, a message will be displayed indicating that the creation of the security group rule failed.

[0080] In one embodiment, before step 150, the method for creating non-contiguous port rules for a security group can be specifically implemented as follows: if the authorization type of the security group is that the security group allows connection to the OpenStack platform, then the non-contiguous port rules are modified based on the modified rules.

[0081] In this embodiment of the invention, since the open-source project's security group rules do not modify the API, when modifying rules, the old rules must first be deleted and new rules created. If the number of rules to be created for discontinuous port requests is consistent with the number of ports, then it is checked that the number of rules to be created under the security group is equal to the number of ports minus 1. Then, it is determined whether the number of rules to be created plus the number of existing rules exceeds the rule quota under the security group. If the quota is exceeded, a message will be displayed indicating that the creation of security group rules failed and the security group rule quota has been exhausted.

[0082] In one embodiment, before step 150, the method for creating discontinuous port rules in a security group can be specifically implemented as follows: deleting the discontinuous port rules to be modified; and creating discontinuous port rules containing the modified content based on the modified content.

[0083] In this embodiment of the invention, deleting an old rule is similar to creating a rule; it requires determining whether the authorization type is allow or deny to determine the API to be called. If an allow rule is to be changed to deny, the whitelist interface must first be called to delete the allow rule. Similarly, if a deny rule is to be changed to allow, the blacklist interface must be called to delete the deny rule.

[0084] In other words, when deleting an old rule, the API to be called depends on the rule's authorization type (i.e., whether it's "allow" or "deny"). If you need to change a rule that was originally "allow" to "deny," you must first call the whitelist API to delete the "allow" rule. Conversely, if you need to change a "deny" rule to "allow," you need to call the blacklist API to delete the "deny" rule.

[0085] A whitelist is a list of entities that are allowed access or operation. In this context, the rules in the whitelist indicate that certain specific operations or requests are permitted. For example, a user or service may be allowed to access a particular API. A blacklist, on the other hand, is a list of entities that are prohibited from access or operation. The rules in the blacklist indicate that certain specific operations or requests are not permitted. For example, a user or service may be denied access to a particular API. An API is an interface used for interaction between different software components. For example, an API can be an interface for managing whitelists and blacklists, such as providing functionality to add, delete, or modify rules.

[0086] In one embodiment, before step 150, the method for creating non-contiguous port rules in the security group can be specifically implemented as follows: if the modification content includes that each non-contiguous port corresponds to a non-contiguous port rule, then obtain the number of rules containing the modification content to create non-contiguous port rules; wherein, the number of non-contiguous port rules containing the modification content is equal to the difference between the number of non-contiguous ports and the third preset number threshold; create non-contiguous port rules that meet the rule number and contain the modification content.

[0087] In this embodiment of the invention, since the security group rules of the open-source project do not have a direct modification API, users must delete the old rules and then create new ones when they need to update the rules. This results in additional steps and may cause configuration errors. If rules need to be created for multiple non-contiguous ports, a new rule needs to be created for each port. Therefore, the number of new rules created is consistent with the number of ports. This means that if five non-contiguous ports need to be opened, five new rules for those non-contiguous ports need to be created.

[0088] In this embodiment of the invention, before creating a new rule, it is necessary to check whether the number of rules to be created under the current security group exceeds the quota. Specifically: the number of non-contiguous port rules containing modification content = the number of non-contiguous ports – 1, which means the number of ports that need to be opened in a request minus 1 (because usually at least one existing rule needs to be retained). Before attempting to create a new rule, it is necessary to check whether the total number of existing rules plus the number of newly created rules exceeds the rule quota of the security group. If the total number of existing rules plus the number of newly created rules exceeds the rule quota of the security group, that is, the system will prompt "Failed to create security group rule, security group rule quota exhausted". This means that the user cannot add more rules and must delete some existing rules before continuing to create new rules. The third preset quantity threshold is 1.

[0089] In one embodiment, before step 150, the method for creating non-contiguous port rules of a security group can be specifically implemented as follows: calculate the total number of rules based on the number of rules and the number of rules in multiple security groups; if the total number is less than a fourth preset threshold, generate a verification result; wherein, the verification result includes the successful creation of non-contiguous port rules containing modified content.

[0090] In this embodiment of the invention, the fourth preset quantity threshold can be the system's default quantity quota. If the total quantity is less than the fourth preset quantity threshold, a verification result is generated, indicating that the total number of security group rules and non-contiguous port rules does not exceed the system's default quantity quota. If the total quantity is greater than the fourth preset quantity threshold, it indicates that the total number of security group rules and non-contiguous port rules exceeds the system's default quantity quota, and a prompt message is generated, indicating that the creation of non-contiguous port rules failed.

[0091] Figure 3 This is a schematic diagram of the structure of a module for creating discontinuous port rules for security groups provided in an exemplary embodiment of the present invention. For example... Figure 3As shown, the security group discontinuous port rule creation module 20 includes: a first creation module 201, used to create a security group on the cloud platform based on a first creation command; obtain the traffic type and authorization type of the security group; wherein, the authorization type indicates whether the security group allows connection to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates that preset network traffic is allowed to pass through the security group; create security rules within the security group according to the network rules and authorization type, and generate a security group rule list based on multiple security group rules; a second creation module 202, used to create discontinuous port rules in the security group rule list based on the second creation command; verify the discontinuous port rules based on a verification method to obtain a verification result; a verification module 203, used to convert the format of the discontinuous port rules if the verification result indicates successful verification, to obtain the converted discontinuous port rules; decompose the discontinuous ports corresponding to the converted discontinuous port rules into continuous port groups or single processed ports; merge the discontinuous port rules corresponding to the decomposed continuous port groups; and display the merged discontinuous port rules and the discontinuous port rules corresponding to the single processed ports in the security group rule list.

[0092] This invention provides a device for creating discontinuous port rules for security groups. By creating discontinuous port rules from security group rules and verifying these rules, the device verifies whether discontinuous ports meet design requirements. Furthermore, it decomposes the discontinuous ports in the discontinuous port rules into continuous port groups or individual ports for processing, thereby enabling the discontinuous ports to be used normally in practical applications.

[0093] Figure 4 This is a schematic diagram of the structure of a module for creating discontinuous port rules for security groups, provided in another exemplary embodiment of the present invention. (See diagram below.) Figure 4 As shown, the verification module 203 may include: a first verification unit 2031, used to generate a verification result if the port numbers of the non-continuous ports in the non-continuous port rule are all non-zero numbers, each non-continuous port in the non-continuous port rule is separated by a comma, and the number of non-continuous ports is less than a first preset number threshold; wherein, the verification result includes the successful verification of the port format of the non-continuous ports.

[0094] In one embodiment, the verification module 203 may include: a first quantity unit 2032 for obtaining the number of multiple security group rules; a second quantity unit 2033 for obtaining the number of non-contiguous port rules; a calculation unit 2034 for calculating the total number based on the number of multiple security group rules and the number of non-contiguous port rules; and a generation unit 2035 for generating a verification result if the total number is less than a second preset quantity threshold; wherein the verification result includes a successful verification of the total number.

[0095] In one embodiment, the verification module 203 may be specifically configured to generate a verification result if there is no security group rule with the same content as the non-contiguous port rule among the multiple security group rules; wherein the verification result includes successful creation of the non-contiguous port rule.

[0096] In one embodiment, before the verification module 203, the device 20 for creating non-contiguous port rules for a security group can be specifically configured to modify the non-contiguous port rules based on the following: if the authorization type of the security group is that the security group allows connection to the OpenStack platform.

[0097] In one embodiment, before the verification module 203, the device 20 for creating discontinuous port rules of the security group can be specifically configured to delete the discontinuous port rules to be modified;

[0098] Based on the modified content, create non-contiguous port rules containing the modified content.

[0099] In one embodiment, before the verification module 203, the device 20 for creating non-contiguous port rules of the security group can be specifically configured as follows: if the modification content includes that each non-contiguous port corresponds to a non-contiguous port rule, then the number of rules containing the modification content for creating non-contiguous port rules is obtained; wherein, the number of non-contiguous port rules containing the modification content is equal to the difference between the number of non-contiguous ports and the third preset number threshold.

[0100] Create non-contiguous port rules that meet the required number of rules and contain modified content.

[0101] In one embodiment, the verification module 203 may be specifically configured to: calculate the total number of rules based on the number of rules and the number of rules in multiple security groups; if the total number is less than a fourth preset threshold, generate a verification result; wherein the verification result includes the successful creation of non-contiguous port rules containing modified content.

[0102] Figure 5 This is a schematic diagram of the structure of a system for creating discontinuous port rules for security groups, provided in an exemplary embodiment of the present invention. Figure 5As shown, the system for creating discontinuous port rules for security groups includes: a network platform management module, which sets default quota rules; these default quota rules include the limit on the number of security groups, the limit on the number of security group rules for each security group, and the limit on the number of discontinuous port rules; a northbound interface management module, which communicates with the network platform management module and queries the list of virtual private networks and subnets through the northbound interface; a security group management module, which communicates with the northbound interface management module and accesses the list of virtual private networks and subnets, including the aforementioned module for creating discontinuous port rules for security groups; a database, which communicates with both the network platform management module and the security group management module, storing the default quota rules, security groups, security group rules, and discontinuous port rules created by the security group management module; and an OpenStack platform, which communicates with both the network platform management module and the security group management module, creating security groups on the OpenStack platform.

[0103] This invention provides a system for creating discontinuous port rules for security groups. By creating discontinuous port rules within security group rules and verifying these rules, the system verifies whether discontinuous ports meet design requirements. Furthermore, the system decomposes discontinuous ports within the rules into continuous port groups or individual ports for processing, thereby enabling the normal application of discontinuous ports in practical applications.

[0104] The northbound interface module is primarily used to provide REST APIs to enable tenants to create networks, cloud hosts, and associate security groups. For example, by providing tenant ID, network segment CIDR, and region, it can enable functions such as creating networks, subnets, deleting subnets, deleting virtual private networks, creating security groups, deleting security groups, viewing security group lists, creating security group rules, modifying security group rules, viewing security group inbound rules, viewing security group outbound rules, and deleting security group rules.

[0105] The database module stores information related to tenants, virtual private networks, subnets, security groups, and security group rules. All relevant information created by tenants through the network platform management module and the security group management module is stored in the database.

[0106] The network platform management module is primarily used to manage security groups and security group rule quotas. These quotas are managed through administrator accounts and include: the quota for security groups a user is allowed to create, the quota for security group rules a user is allowed to create within a single security group, and the quota for non-contiguous port rules that can be created at one time. The default quotas are: a maximum of 50 security groups per user, a maximum of 100 inbound and outbound rules per security group, and 20 non-contiguous port rules allowed to be created at one time. Administrators can adjust these quotas according to the cloud center's needs. After the quotas are configured, users log in to the console to create security groups.

[0107] The security group management module is used to manage security groups, including querying the security group list, viewing security group details, creating security groups, deleting security groups, updating security group names, querying the inbound rule list, querying the outbound rule list, adding rules, deleting rules, and modifying rules. Operations involving non-contiguous ports involve creating and modifying rules. Both rule creation and modification require port format validation. The port format determines whether a rule for non-contiguous ports should be created. The port format for non-contiguous port rule creation must meet the following requirements: the port number must not be empty, comma-separated ports must be numbers (not strings), and the number of non-contiguous ports cannot exceed 20. If the transmitted non-contiguous ports do not meet the format requirements, a port format error message will be displayed, requiring re-entry. Additionally, quota validation is required. When creating a rule, the quota validation means the number of rules to be created equals the number of ports. Modifying a rule requires deleting the old rules and creating a new one; therefore, the number of rules to be created equals the number of ports minus 1. Finally, the module checks whether the number of rules created plus the number of existing rules exceeds the rule quota under the security group. If the quota is exceeded, a message will be displayed indicating that the security group rule creation failed and the security group rule quota has been exhausted. After the rule format and field validation pass, a security group rule duplication check is also required. If the rule to be created is duplicated with an existing rule, a message will appear indicating that the creation of the security group rule failed because the same rule already exists in the security group. Creating and deleting rules both require calling different business interfaces depending on whether the authorization type is allow or deny.

[0108] Figure 6 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0109] like Figure 6 As shown, the electronic device 10 includes one or more processors 11 and memory 12.

[0110] The processor 11 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0111] The memory 12 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may execute the program instructions to implement the methods for creating discontinuous port rules for security groups in the various embodiments of this application described above, and / or other desired functions. Various contents such as input signals, signal components, and noise components may also be stored in the computer-readable storage medium.

[0112] In one example, the electronic device 10 may also include an input device 13 and an output device 14, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0113] When the electronic device 10 is a standalone device, the input device 13 can be a communication network connector for receiving the collected input signals from the first device and the second device.

[0114] In addition, the input device 13 may also include, for example, a keyboard, a mouse, etc.

[0115] The output device 14 can output various information to the outside, including determined distance information, direction information, etc. The output device 14 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0116] Of course, for the sake of simplicity, Figure 6 Only some of the components of the electronic device 10 relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device 10 may include any other suitable components depending on the specific application.

[0117] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0118] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0119] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

[0120] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for creating discontinuous port rules for a security group, characterized in that, include: Based on the first creation command, create a security group on the OpenStack platform; Obtain the traffic type and authorization type of the security group; wherein, the authorization type indicates whether the security group allows connection to the OpenStack platform, and each traffic type corresponds to a network rule, the network rule indicating whether preset network traffic is allowed to pass through the security group; Based on the network rules and authorization type, create security rules within the security group and generate a security group rule list based on multiple security group rules; Based on the second creation instruction, create non-contiguous port rules in the security group rule list; Based on the verification method, the discontinuous port rules are verified to obtain the verification result; If the verification result indicates that the verification is successful, the format of the non-contiguous port rule is converted to obtain the converted non-contiguous port rule. The discontinuous ports corresponding to the transformed discontinuous port rules are decomposed into continuous port groups or individual processed ports. Merge the non-contiguous port rules corresponding to the continuous port groups after decomposition; The merged discontinuous port rules and the discontinuous port rules corresponding to the individually processed ports are displayed in the security group rule list.

2. The method for creating discontinuous port rules for security groups according to claim 1, characterized in that, The verification method, which verifies the discontinuous port rules to obtain the verification result, includes: If the port numbers of the non-contiguous ports in the non-contiguous port rule are all non-zero numbers, each non-contiguous port in the non-contiguous port rule is separated by a comma, and the number of non-contiguous ports is less than a first preset threshold, then a verification result is generated; wherein, the verification result includes the successful verification of the port format of the non-contiguous ports.

3. The method for creating discontinuous port rules for security groups according to claim 1, characterized in that, The verification method, which verifies the discontinuous port rules to obtain the verification result, includes: Obtain the number of the multiple security group rules; Obtain the number of the non-contiguous port rules; Calculate the total number based on the number of the multiple security group rules and the number of the non-contiguous port rules; If the total quantity is less than the second preset quantity threshold, a verification result is generated; wherein the verification result includes the total quantity being successfully verified.

4. The method for creating discontinuous port rules for security groups according to claim 1, characterized in that, The verification method, which verifies the discontinuous port rules to obtain the verification result, includes: If none of the multiple security group rules has the same content as the non-contiguous port rule, a verification result is generated; wherein, the verification result includes successful creation of the non-contiguous port rule.

5. The method for creating discontinuous port rules for security groups according to claim 1, characterized in that, Before verifying the discontinuous port rules based on the verification method to obtain the verification result, the method further includes: If the authorization type of the security group is that the security group allows connections to the OpenStack platform, then the rules for non-contiguous ports are modified based on the modification rules.

6. The method for creating discontinuous port rules for security groups according to claim 5, characterized in that, The modification of the non-contiguous port rules based on the modified rules includes: Delete the non-contiguous port rules that need to be modified; Based on the modified content, create discontinuous port rules containing the modified content.

7. The method for creating discontinuous port rules for security groups according to claim 6, characterized in that, The process of creating discontinuous port rules containing the modified content includes: If the modified content includes a non-contiguous port rule corresponding to each non-contiguous port, then obtain the number of rules that create non-contiguous port rules containing the modified content; wherein, the number of non-contiguous port rules containing the modified content is equal to the difference between the number of non-contiguous ports and a third preset number threshold. Create non-contiguous port rules that satisfy the stated number of rules and contain the stated modifications.

8. The method for creating discontinuous port rules for security groups according to claim 7, characterized in that, The verification method, which verifies the discontinuous port rules to obtain the verification result, includes: Calculate the total number of rules based on the number of rules and the number of rules in the multiple security groups; If the total number is less than the fourth preset number threshold, a verification result is generated; wherein, the verification result includes the successful creation of discontinuous port rules containing the modified content.

9. A module for creating discontinuous port rules for security groups, characterized in that, include: The first creation module is used to create security groups on the cloud platform based on the first creation command; Obtain the traffic type and authorization type of the security group; wherein, the authorization type indicates whether the security group allows connection to the OpenStack platform, each traffic type corresponds to a network rule, and the network rule indicates whether preset network traffic is allowed to pass through the security group; based on the network rule and authorization type, create security rules within the security group and generate a security group rule list based on multiple security group rules; The second creation module is used to create non-contiguous port rules in the security group rule list based on the second creation instruction; and to verify the non-contiguous port rules based on the verification method to obtain the verification result. The verification module is used to convert the format of the discontinuous port rule to obtain the converted discontinuous port rule if the verification result indicates that the verification is successful; decompose the discontinuous ports corresponding to the converted discontinuous port rule into continuous port groups or single processed ports; merge the discontinuous port rules corresponding to the decomposed continuous port groups; and display the merged discontinuous port rule and the discontinuous port rule corresponding to the single processed port in the security group rule list.

10. A system for creating discontinuous port rules for security groups, characterized in that, include: The network platform management module sets default quota rules; wherein, the default quota rules include the limit number of security groups, the limit number of security group rules for each security group, and the limit number of non-contiguous port rules; A northbound interface management module, which is communicatively connected to the network platform management module, queries the list of virtual private networks and subnets through the northbound interface; The security group management module is communicatively connected to the northbound interface management module. The security group management module accesses the virtual private network list and the subnet list. The security group management module includes the module for creating discontinuous port rules for the security group as described in claim 9. The database is communicatively connected to the network platform management module and the security group management module, and is used to store the default quota rules, as well as the security groups, security group rules, and non-contiguous port rules created by the security group management module. The OpenStack platform is communicatively connected to the network platform management module and the security group management module, and the security group management module creates the security group on the OpenStack platform.

Images