Communication protocol management method and device, computer equipment and storage medium

Abstract

The invention belongs to the field of artificial intelligence and management, and relates to a communication protocol management method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining a changed first target IP address according to a change signal in response to the change signal of an IP associated document; matching a second target IP address from an IP associated document according to the first target IP address; generating a test data packet according to the first target IP address and the second target IP address; sending the test data packet to the port corresponding to the second target IP address to test the network connection state between the port corresponding to the first target IP address and the port corresponding to the second target IP address; and if the network connection state is that the network connection is not connected, generating a firewall opening request according to the first target IP address and the second target IP address, and sending the firewall opening request to an operation and maintenance end corresponding to firewall management. According to the method and the device, the firewall rule which fails due to the change of the network IP can be quickly checked.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence and management technology, and in particular to a communication protocol management method, apparatus, computer equipment and storage medium. Background Art

[0002] When an enterprise faces frequent changes in office areas and floors for each team, such changes are often accompanied by corresponding changes in wired and wireless IP addresses in the office area network. The dynamic nature of IP addresses poses challenges to the enterprise's network security management, especially for firewall policies that rely on specific IP addresses to access work-related target applications or services. Since the original IP address is no longer valid, the firewall may not be able to correctly identify and allow legitimate access requests, resulting in these requests being incorrectly blocked or ignored.

[0003] Traditional solutions to the problem of network IP changes caused by changes in office areas and floors often require the team to conduct one-by-one investigations and apply to the operation and maintenance department to modify the firewall rules for the service applications that cannot be accessed normally due to IP changes. This is a time-consuming and complicated process. Since the IT team frequently uses a variety of applications and services (such as log access, REDIS, ES, DSP, database, etc.) at work, the number of IP addresses associated with these applications and services is huge, possibly up to hundreds. Therefore, when these IP addresses change, troubleshooting becomes particularly difficult. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a communication protocol management method, apparatus, computer equipment and storage medium, which can quickly check the firewall rules that are invalid due to changes in network IP.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a communication protocol management method, which adopts the following technical solution:

[0006] In response to a change signal of an Internet Protocol (IP) associated document, acquiring a changed first target IP address according to the change signal;

[0007] matching a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of the service application running on the network endpoint IP address;

[0008] Generate a test data packet according to the first target IP address and the second target IP address;

[0009] Sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address;

[0010] If the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, a firewall activation request is generated based on the first target IP address and the second target IP address, and the firewall activation request is sent to the operation and maintenance end corresponding to the firewall management.

[0011] In order to solve the above technical problems, the embodiment of the present application also provides a communication protocol management device, which adopts the following technical solution:

[0012] An acquisition module, configured to respond to a change signal of an Internet Protocol (IP) associated document and acquire a changed first target IP address according to the change signal;

[0013] a matching module, configured to match a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of a service application running on the network endpoint IP address;

[0014] A generating module, configured to generate a test data packet according to the first target IP address and the second target IP address;

[0015] A test module, used for sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address;

[0016] A request module is used to generate a firewall activation request based on the first target IP address and the second target IP address if the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, and send the firewall activation request to the operation and maintenance end corresponding to the firewall management.

[0017] In order to solve the above technical problems, an embodiment of the present application also provides a computer device, which adopts the technical solution described below: the computer device includes a memory and a processor, the memory stores computer-readable instructions, and the processor implements the steps of the communication protocol management method described in any one of the above when executing the computer-readable instructions.

[0018] In order to solve the above technical problems, an embodiment of the present application also provides a computer-readable storage medium, which adopts the following technical solution: the computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the communication protocol management method as described in any one of the above items are implemented.

[0019] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0020] The embodiment of the present application monitors the changes of IP-related documents. When the IP address in the document is detected to have changed, it can immediately respond and obtain the changed first target IP address, thereby realizing instant perception and response to the IP address change and greatly reducing the delay of manual investigation. By matching the second target IP address associated with the first target IP address from the IP-related document, it is possible to establish an accurate association between the network port and the service application. By generating a test data packet based on the first target IP address and the second target IP address, and sending the test data packet to the port corresponding to the second target IP address for network connection testing, it is possible to accurately determine whether the network connection between the first target IP address and the second target IP address is connected, and quickly identify the problem of firewall rule failure caused by the original IP change. And by automatically generating a firewall activation request and sending the request to the operation and maintenance end corresponding to the firewall management when testing that the network connection is not connected, the efficiency of firewall rule investigation and operation and maintenance is further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0023] Figure 2 It is a flowchart of an embodiment of the communication protocol management method of the present application;

[0024] Figure 3 yes Figure 2 A flowchart of a specific implementation method before step S201;

[0025] Figure 4 yes Figure 2 A flowchart of a specific implementation of step S204;

[0026] Figure 5It is a structural diagram of an embodiment of a communication protocol management device of the present application;

[0027] Figure 6 It is a structural diagram of an embodiment of a computer device of the present application. DETAILED DESCRIPTION

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0029] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0031] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0032] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0033] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0034] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0035] It should be noted that the communication protocol management method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the communication protocol management device is generally set in the server / terminal device.

[0036] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0037] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for communication protocol management according to the present application. The communication protocol management method comprises the following steps:

[0038] Step S201, in response to a change signal of an Internet Protocol (IP) associated document, obtaining a changed first target IP address according to the change signal;

[0039] In this embodiment, the electronic device (eg, Figure 1 The server / terminal device shown in the figure can obtain the change signal of the Internet Protocol IP associated document through a wired connection method or a wireless connection method. It should be noted that the above wireless connection method may include but is not limited to 2G / 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0040] In this embodiment, IP (Internet Protocol) changes refer to the situation where the IP address changes when data is transmitted between devices connected to the Internet (such as computers, mobile phones, servers, etc.). The network endpoint IP address refers to a unique identifier used to locate and identify network devices (such as routers, switches, servers, personal computers, etc.) in the network. The service application IP address refers to the IP address of a device that provides a specific service or application (such as distributed computing platform Hadoop, big data log access, MYSQL / Oracle database, REDIS development environment, DSP test environment, ES test environment, customer relationship management CRM test environment, security platform, etc.). The IP association document is a document that records the association between each network endpoint IP address in the network and the service or application (i.e., service application IP address) running on the network endpoint IP address. The IP association document may include at least one network endpoint IP address and the service application IP address corresponding to the network endpoint IP address.

[0041] Specifically, a change signal for an IP association document is received and responded to. For example, when an IP address changes, the IP address in the IP association document is modified accordingly. At this time, a change signal is generated corresponding to the IP address change in the IP association document, and the change signal includes the IP address that has changed. In response to the change signal, the IP address that has changed is obtained according to the change signal as the first target IP address. The first target IP address may be a network endpoint IP address or a service application IP address.

[0042] In some optional implementations, reference Figure 3 The above-mentioned method of responding to the change signal of the Internet Protocol IP association document and obtaining the changed first target IP address according to the change signal may further include the following steps:

[0043] Step S101, monitoring whether there is any change in the IP list in the IP association document, wherein the IP list includes a network endpoint IP address list and a service application IP address list corresponding to each network endpoint IP address;

[0044] In this embodiment, after setting up monitoring of a specific IP list in an IP association document, based on a set signal collection period, the IP list in the IP association document is monitored for changes, wherein the IP list includes a network endpoint IP address list and a service application IP address list corresponding to each network endpoint IP address list. The method of monitoring whether the IP list in the IP association document has changed may be, for example, collecting the IP list in the current IP association document as baseline data, collecting the IP list in the IP association document again after a set signal collection period, and comparing the baseline data with the IP list collected again to identify IP addresses that have changed; if there are IP addresses that have changed, it is determined that the IP list in the IP association document has changed.

[0045] Step S102: If the IP list changes, the changed IP address is determined as the first target IP address, and a change signal is generated according to the first target IP address.

[0046] In this embodiment, when the IP list in the IP association document changes, the identified IP address that has changed is determined as the first target IP address, and a change signal for the IP association document is generated based on the first target IP address. The change signal may include the first target IP address, the type of change, the time of change, and the details before and after the change.

[0047] More specifically, if the IP list changes, the IP address that has changed is determined as the first target IP address. For example, after comparing the baseline data with the IP list collected again, the IP address that has changed is identified, wherein the type of change may include but is not limited to adding an IP, deleting an IP, or modifying an IP, and the type of the IP address that has changed may be a network endpoint IP address or a service application IP address. The identified IP address that has changed is marked to obtain the first target IP address.

[0048] The embodiment of the present application can instantly perceive any changes in IP addresses by continuously monitoring the IP list in the IP association document. This implementation monitoring mechanism ensures that changes in network configuration can be responded to quickly. When the IP address in the IP list changes, the changed IP address can be accurately identified, and the corresponding change signal can be quickly generated according to the changed IP address, ensuring the accuracy and timeliness of the signal.

[0049] Step S202, matching a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of the service application running on the network endpoint IP address;

[0050] In this embodiment, the definition of the IP association document is as shown in the above step S201, which will not be repeated here. According to the obtained first target IP address, the second target IP address is matched from the IP association document. For example, when the first target IP address is a network endpoint IP address that has changed, at least one service application IP address running on the network endpoint IP address is obtained from the IP association document as the second target IP address. When the first target IP address is a service application IP address that has changed, the network endpoint IP address that supports the operation of the service application IP address is obtained from the IP association document as the second target IP address.

[0051] In some optional implementations, matching the second target IP address from the IP association document according to the first target IP address may include the following steps:

[0052] If the first target IP address is a network endpoint IP address, matching the service application IP address corresponding to the network endpoint IP address from the IP association document as the second target IP address;

[0053] In this embodiment, if the first target IP address is a network endpoint IP address, that is, the IP address that changes in the IP association document is a network endpoint IP address, then at least one service application IP address running on the network endpoint IP address is matched from the IP association document as the second target IP address.

[0054] If the first target IP address is a service application IP address, the network endpoint IP address corresponding to the service application IP address is matched from the IP association document as the second target IP address.

[0055] In this embodiment, if the first target IP address is a service application IP address, that is, the IP address that changes in the IP association document is a service application IP address, then the network endpoint IP address that supports the operation of the service application IP address is matched from the IP association document as the second target IP address.

[0056] The embodiment of the present application can achieve flexible matching by implementing a two-way association query in the IP association document, whether it is querying the corresponding service application IP address from the network endpoint IP address or querying the corresponding network endpoint IP address from the service application IP address. In particular, when the first target IP address is the network endpoint IP address, at least one service application IP address running on the network endpoint is matched from the IP association document, and the situation of processing multiple service application IP addresses corresponding to one network endpoint IP address can be realized, supporting multi-service application association in complex network architecture, and meeting the processing scenarios of various large networks or cloud environments.

[0057] Step S203, generating a test data packet according to the first target IP address and the second target IP address;

[0058] In this embodiment, a test data packet is generated by matching the first target IP address and the second target IP address, wherein the test data packet may include content such as a source IP address, a destination IP address, a source port, and a destination port.

[0059] More specifically, a test data packet is generated based on the first target IP address and the second target IP address. For example, the first target IP address is set as the source IP address of the test data packet, and the second target IP address is set as the destination IP address of the test data packet. The source port for sending the test data packet is determined based on the port corresponding to the first target IP address, and the destination port for receiving the test data packet is determined based on the port corresponding to the second target IP address. The test data packet is constructed based on the determined source IP address, destination IP address, source port, and destination port.

[0060] Step S204, sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address;

[0061] In this embodiment, the port corresponding to the second target IP address is determined, and the constructed test data packet is sent to the port corresponding to the second target IP address, so as to simulate the test data packet being sent from the port corresponding to the first target IP address to the port corresponding to the second target IP address, so as to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address. The network connection status may be that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, or that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

[0062] It should be noted that if the electronic device that sends the test data packet is the device corresponding to the first target IP address, the test data packet is directly constructed and sent to the port corresponding to the second target IP address through the device corresponding to the first target IP address. If the electronic device that sends the test data packet is a third-party device other than the device corresponding to the first target IP address, it is necessary to obtain the IP address of the third-party device and add the IP address of the third-party device to the test data packet. The IP address of the third-party device is used by the third-party device to identify its own device identity in the network; then, continue to set the source IP address to the first target IP address and the destination IP address to the second target IP address in the test data packet, and simulate the test data packet from the device corresponding to the first target IP address through the third-party device to the port corresponding to the second target IP address.

[0063] In some optional implementations, reference Figure 4 The above-mentioned sending of the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address may include the following steps:

[0064] Step S2041, sending the test data packet to the port corresponding to the second target IP address, and monitoring a response signal returned from the second target IP address;

[0065] In this embodiment, after determining the port corresponding to the second target IP address, the constructed test data packet is sent to the port corresponding to the second target IP address, and at the same time, a specific network packet capture tool is used to monitor the response signal returned from the second target IP address.

[0066] Step S2042, if a response signal returned by the second target IP address is received within a preset time, the network connection state is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected;

[0067] In this embodiment, a response receiving time range (referred to as preset time) is set in advance. If a response signal returned from the second target IP address is received within the preset time, it indicates that the port corresponding to the first target IP address and the port corresponding to the second target IP address can communicate normally. At this time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected.

[0068] Step S2043, if the response signal returned by the second target IP address is not received within the preset time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

[0069] In this embodiment, if a response signal returned from the second target IP address is not received within the preset time, it indicates that the port corresponding to the first target IP address and the port corresponding to the second target IP address cannot communicate normally. At this time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

[0070] The embodiment of the present application can quickly and accurately reflect the network connection status between the first target IP address and the second target IP address by sending a test data packet to the port corresponding to the second target IP address and monitoring the response signal from the second target IP address based on a set preset time.

[0071] In some optional implementations, after the step of determining the network connection state as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, the following steps may also be included:

[0072] The first target IP address and the second target IP address are marked with a connection success flag, and the connection success flag is stored in the IP association document.

[0073] In this embodiment, when the test result shows that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, the first target IP address and the second target IP address are marked with a successful connection mark to indicate that the network connection between the first target IP and the second target IP has been successfully established. At this time, the successful connection mark between the first target IP address and the second target IP address is stored in the IP association document.

[0074] In the embodiment of the present application, the successfully connected IP address pairs are marked with a connection success identifier and stored in an IP association document, so that the network connections between which IP address pairs are connected can be quickly found out by querying the IP association document later.

[0075] In some optional implementations, after the step of determining the network connection state as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, the following steps may also be included:

[0076] The first target IP address and the second target IP address are marked with a connection failure flag, and the connection failure flag is stored in the IP association document.

[0077] In this embodiment, when the test result is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, the first target IP address and the second target IP address are marked with a connection failure flag, indicating that the network connection between the first target IP and the second target IP has not been successfully established, and there may be a firewall blocking it. At this time, the connection failure flag between the first target IP address and the second target IP address is stored in the IP association document.

[0078] The embodiment of the present application marks the IP address pairs that failed to connect with a connection failure identifier and stores it in an IP association document, so that it is possible to quickly find out which network connections between which IP address pairs are not connected by querying the IP association document, thereby quickly determining the firewall rules that have become invalid due to changes in the network IP.

[0079] Step S205, if the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, a firewall activation request is generated according to the first target IP address and the second target IP address, and the firewall activation request is sent to the operation and maintenance end corresponding to the firewall management.

[0080] In this embodiment, if the network connection status obtained by the test is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, it indicates that the first target IP address and the second target IP address do not meet the preset firewall rules and there is a firewall blockage. At this time, a firewall opening request is generated according to the first target IP address and the second target IP address. The firewall opening request may include but is not limited to the first target IP address and its corresponding port, the second target IP address and its corresponding port, the test disconnection situation, the expected network communication requirements, etc. The firewall opening request is sent to the operation and maintenance end corresponding to the set firewall management. The operation and maintenance end can be an IT service management system.

[0081] In some optional implementations, the generating of the firewall activation request according to the first target IP address and the second target IP address may include the following steps:

[0082] Extracting a plurality of first target IP addresses and second target IP addresses marked with connection failure identifiers from the IP association document;

[0083] A firewall activation request is generated according to the plurality of first target IP addresses and second target IP addresses.

[0084] In this embodiment, according to the connection failure identifier in the IP association document, several first target IP addresses and second target IP addresses marked with the connection failure identifier are extracted from the IP association document, the several first target IP addresses and second target IP addresses that have failed to connect to each other are matched one by one, and firewall activation requests are generated in batches according to the corresponding several first target IP addresses and second target IP addresses.

[0085] The embodiment of the present application can generate firewall activation requests in batches, so that multiple IP address pairs with failed connections can be processed at one time without manual operation one by one, which significantly improves processing efficiency and is particularly suitable for large-scale network environments. By opening a firewall for IP address pairs with failed connections, the configuration of network resources can be optimized. The opening of the firewall can ensure that the network communications between these IP address pairs are properly protected and filtered, thereby improving the overall security and performance of the network.

[0086] The embodiment of the present application adopts the above scheme, specifically by monitoring the changes of IP-related documents, and when the IP address in the document is monitored to change, it can immediately respond and obtain the changed first target IP address, thereby realizing instant perception and response to the IP address change, and greatly reducing the delay of manual investigation; by matching the second target IP address associated with the first target IP address from the IP-related document, it is possible to establish an accurate association between the network port and the service application; by generating a test data packet based on the first target IP address and the second target IP address, and sending it to the port corresponding to the second target IP address for network connection testing, it is possible to accurately determine whether the network connection between the first target IP address and the second target IP address is connected, and quickly identify the problem of firewall rule failure caused by the original IP change; and by automatically generating a firewall activation request and sending the request to the operation and maintenance end corresponding to the firewall management when testing that the network connection is not connected, the efficiency of firewall rule investigation and operation and maintenance is further improved.

[0087] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned IP association documents, the first target IP address, the second target IP address and other relevant data, the above-mentioned IP association documents, the first target IP address, the second target IP address and other relevant data can also be stored in a blockchain node.

[0088] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0089] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0090] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0091] Further references Figure 5 , as a response to the above Figure 2 The present application provides an embodiment of a communication protocol management device, and the device embodiment is Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0092] like Figure 5 As shown, the communication protocol management device 400 described in this embodiment includes: an acquisition module 401, a matching module 402, a generation module 403, a test module 404 and a request module 405. Among them:

[0093] An acquisition module 401 is used to respond to a change signal of an Internet Protocol IP associated document and acquire a changed first target IP address according to the change signal;

[0094] A matching module 402, configured to match a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of a service application running on the network endpoint IP address;

[0095] A generating module 403, configured to generate a test data packet according to the first target IP address and the second target IP address;

[0096] The testing module 404 is used to send the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address;

[0097] The request module 405 is used to generate a firewall activation request based on the first target IP address and the second target IP address if the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, and send the firewall activation request to the operation and maintenance end corresponding to the firewall management.

[0098] In this embodiment, IP (Internet Protocol) changes refer to the situation where the IP address changes when data is transmitted between devices connected to the Internet (such as computers, mobile phones, servers, etc.). The network endpoint IP address refers to a unique identifier used to locate and identify network devices (such as routers, switches, servers, personal computers, etc.) in the network. The service application IP address refers to the IP address of a device that provides a specific service or application (such as distributed computing platform Hadoop, big data log access, MYSQL / Oracle database, REDIS development environment, DSP test environment, ES test environment, customer relationship management CRM test environment, security platform, etc.). The IP association document is a document that records the association between each network endpoint IP address in the network and the service or application (i.e., service application IP address) running on the network endpoint IP address. The IP association document may include at least one network endpoint IP address and the service application IP address corresponding to the network endpoint IP address.

[0099] Specifically, the acquisition module 401 is used to receive and respond to the change signal for the IP association document. For example, when the IP address changes, the IP address in the IP association document is modified accordingly. At this time, a change signal is generated corresponding to the change of the IP address in the IP association document, and the change signal includes the changed IP address. The acquisition module 401 is also used to respond to the change signal and obtain the changed IP address as the first target IP address according to the change signal. The first target IP address can be a network endpoint IP address or a service application IP address.

[0100] Specifically, the matching module 402 is used to match the second target IP address from the IP association document according to the obtained first target IP address. For example, when the first target IP address is a network endpoint IP address that has changed, at least one service application IP address running on the network endpoint IP address is obtained from the IP association document as the second target IP address. When the first target IP address is a service application IP address that has changed, the network endpoint IP address that supports the operation of the service application IP address is obtained from the IP association document as the second target IP address.

[0101] Specifically, the generating module 403 is used to generate a test data packet using the matched first target IP address and second target IP address, wherein the test data packet may include the source IP address, the destination IP address, the source port, the destination port and the like.

[0102] More specifically, the generation module 403 is used to generate a test data packet based on the first target IP address and the second target IP address, and is specifically used to set the first target IP address as the source IP address of the test data packet, set the second target IP address as the destination IP address of the test data packet, determine the source port for sending the test data packet according to the port corresponding to the first target IP address, determine the destination port for receiving the test data packet according to the port corresponding to the second target IP address, and construct a test data packet based on the determined source IP address, destination IP address, source port, and destination port.

[0103] Specifically, the test module 404 is used to determine the port corresponding to the second target IP address, and send the constructed test data packet to the port corresponding to the second target IP address, so as to simulate sending the test data packet from the port corresponding to the first target IP address to the port corresponding to the second target IP address, so as to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address. The network connection status can be that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, or the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

[0104] It should be noted that if the electronic device that sends the test data packet is the device corresponding to the first target IP address, the test data packet is directly constructed and sent to the port corresponding to the second target IP address through the device corresponding to the first target IP address. If the electronic device that sends the test data packet is a third-party device other than the device corresponding to the first target IP address, it is necessary to obtain the IP address of the third-party device and add the IP address of the third-party device to the test data packet. The IP address of the third-party device is used by the third-party device to identify its own device identity in the network; then, continue to set the source IP address to the first target IP address and the destination IP address to the second target IP address in the test data packet, and simulate the test data packet from the device corresponding to the first target IP address through the third-party device to the port corresponding to the second target IP address.

[0105] Specifically, the request module 405 is used for, if the network connection status obtained by the test is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, it indicates that the first target IP address and the second target IP address do not meet the preset firewall rules and there is a firewall blockage. At this time, a firewall opening request is generated according to the first target IP address and the second target IP address. The firewall opening request may include but is not limited to the first target IP address and its corresponding port, the second target IP address and its corresponding port, the test disconnection situation, the expected network communication requirements and the like. The firewall opening request is sent to the operation and maintenance end corresponding to the set firewall management. The operation and maintenance end may be an IT service management system.

[0106] The communication protocol management device of the embodiment of the present application monitors the changes of the IP-related documents. When the IP address in the document is detected to have changed, it can immediately respond and obtain the changed first target IP address, thereby realizing instant perception and response to the IP address change and greatly reducing the delay of manual troubleshooting. By matching the second target IP address associated with the first target IP address from the IP-related document, it can establish an accurate association between the network port and the service application. By generating a test data packet based on the first target IP address and the second target IP address and sending it to the port corresponding to the second target IP address for network connection testing, it can accurately determine whether the network connection between the first target IP address and the second target IP address is connected, and quickly identify the problem of firewall rule failure caused by the original IP change. And by automatically generating a firewall activation request and sending the request to the operation and maintenance end corresponding to the firewall management when testing that the network connection is not connected, the efficiency of firewall rule troubleshooting and operation and maintenance is further improved.

[0107] In some optional implementations of this embodiment, the communication protocol management device 400 may further include: a monitoring module and a determination module.

[0108] A monitoring module, used to monitor whether there is any change in the IP list in the IP association document, wherein the IP list includes a network endpoint IP address list and a service application IP address list corresponding to each network endpoint IP address;

[0109] The determination module is used to determine the changed IP address as the first target IP address if the IP list changes, and generate a change signal according to the first target IP address.

[0110] Specifically, the monitoring module is used to monitor whether the IP list in the IP association document has changed based on a set signal collection period after setting the monitoring of a specific IP list in the IP association document, wherein the IP list includes a network endpoint IP address list and a service application IP address list corresponding to each network endpoint IP address list. The method of monitoring whether the IP list in the IP association document has changed may be, for example, collecting the IP list in the current IP association document as baseline data, collecting the IP list in the IP association document again after the set signal collection period, and comparing the baseline data with the IP list collected again to identify the IP address that has changed; if there is an IP address that has changed, it is determined that the IP list in the IP association document has changed.

[0111] Specifically, the determination module is used to determine the IP address that has changed as the first target IP address when the IP list in the IP association document changes, and generate a change signal for the IP association document according to the first target IP address. The change signal may include the first target IP address, the type of change, the time of the change, and the details before and after the change.

[0112] More specifically, the determination module is used to determine the changed IP address as the first target IP address if the IP list changes, and is specifically used to identify the changed IP address after comparing the above baseline data with the IP list collected again, wherein the type of change may include but is not limited to adding an IP, deleting an IP, or modifying an IP, and the type of the changed IP address may be a network endpoint IP address or a service application IP address. The identified changed IP address is marked to obtain the first target IP address.

[0113] The communication protocol management device of the embodiment of the present application can instantly perceive any changes in IP addresses by continuously monitoring the IP list in the IP association document. This real-time monitoring mechanism ensures that changes in network configuration can be responded to quickly. When the IP address in the IP list changes, the changed IP address can be accurately identified, and a corresponding change signal can be quickly generated according to the changed IP address, ensuring the accuracy and timeliness of the signal.

[0114] In some optional implementations of this embodiment, the matching module 402 may include a first matching submodule and a second matching submodule.

[0115] A first matching submodule, configured to match a service application IP address corresponding to the network endpoint IP address from the IP association document as a second target IP address if the first target IP address is a network endpoint IP address;

[0116] The second matching submodule is used to match the network endpoint IP address corresponding to the service application IP address from the IP association document as the second target IP address if the first target IP address is a service application IP address.

[0117] Specifically, the first matching submodule is used to match at least one service application IP address running on the network endpoint IP address from the IP association document as the second target IP address if the first target IP address is a network endpoint IP address, that is, the IP address that changes in the IP association document is the network endpoint IP address.

[0118] Specifically, the second matching submodule is used to match the network endpoint IP address that supports the operation of the service application IP address from the IP association document as the second target IP address if the first target IP address is a service application IP address, that is, the IP address that changes in the IP association document is a service application IP address.

[0119] The matching module of the embodiment of the present application can achieve flexible matching by implementing a two-way association query in the IP association document, whether it is querying the corresponding service application IP address from the network endpoint IP address or querying the corresponding network endpoint IP address from the service application IP address. In particular, when the first target IP address is the network endpoint IP address, at least one service application IP address running on the network endpoint is matched from the IP association document, and the situation of processing multiple service application IP addresses corresponding to one network endpoint IP address can be realized, supporting multi-service application association in a complex network architecture, and meeting the processing scenarios of various large networks or cloud environments.

[0120] In some optional implementations of this embodiment, the test module 404 may include a sending submodule, a first state determination submodule, and a second state determination submodule. The sending submodule is configured to send the test data packet to the port corresponding to the second target IP address and monitor the response signal returned from the second target IP address;

[0121] A first state determination submodule, configured to determine the network connection state as a network connection between a port corresponding to the first target IP address and a port corresponding to the second target IP address being connected if a response signal returned by the second target IP address is received within a preset time;

[0122] The second status determination submodule is used to determine the network connection status as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected if the response signal returned by the second target IP address is not received within a preset time.

[0123] Specifically, the sending submodule is used to send the constructed test data packet to the port corresponding to the second target IP address after determining the port corresponding to the second target IP address, and at the same time, use a specific network packet capture tool to monitor the response signal returned from the second target IP address.

[0124] Specifically, the first status determination submodule is used to pre-set a response reception time range (referred to as the preset time). If a response signal returned from the second target IP address is received within the preset time, it indicates that the port corresponding to the first target IP address and the port corresponding to the second target IP address can communicate normally. At this time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected.

[0125] Specifically, the second status determination submodule is used to pre-set a response reception time range (referred to as the preset time). If no response signal returned from the second target IP address is received within the preset time, it indicates that the port corresponding to the first target IP address and the port corresponding to the second target IP address cannot communicate normally. At this time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

[0126] The test module 404 of the embodiment of the present application can quickly and accurately reflect the network connection status between the first target IP address and the second target IP address by sending a test data packet to the port corresponding to the second target IP address and listening to the response signal from the second target IP address based on the set preset time.

[0127] In some optional implementations of this embodiment, the test module 404 may further include a first marking submodule, wherein the first marking submodule is used to mark the first target IP address and the second target IP address with a connection success flag, and store the connection success flag in the IP association document.

[0128] Specifically, the first marking submodule is used to mark the first target IP address and the second target IP address with a connection success mark when the test result shows that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, thereby indicating that the network connection between the first target IP and the second target IP has been successfully established. At this time, the connection success mark between the first target IP address and the second target IP address is stored in the IP association document.

[0129] The test module 404 of the embodiment of the present application marks the successfully connected IP address pairs with a connection success identifier and stores it in the IP association document, so that the network connections between which IP address pairs are connected can be quickly understood by querying the IP association document later.

[0130] In some optional implementations of this embodiment, the test module 404 may further include a second marking submodule, wherein the second marking submodule is configured to mark the first target IP address and the second target IP address with a connection failure flag, and store the connection failure flag in the IP association document.

[0131] Specifically, the second marking submodule is used to mark the first target IP address and the second target IP address with a connection failure flag when the test result shows that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, thereby indicating that the network connection between the first target IP and the second target IP has not been successfully established, and there may be a firewall blocking it. At this time, the connection failure flag between the first target IP address and the second target IP address is stored in the IP association document.

[0132] The test module 404 of the embodiment of the present application marks the IP address pairs that failed to connect with a connection failure identifier and stores it in the IP association document, so that it can subsequently quickly understand which network connections between which IP address pairs are not connected by querying the IP association document, thereby quickly determining the firewall rules that have become invalid due to changes in the network IP.

[0133] In some optional implementations of this embodiment, the request module 405 may also include an identification extraction submodule and a request generation submodule.

[0134] An identifier extraction submodule, used for extracting a plurality of first target IP addresses and second target IP addresses marked with a connection failure identifier from the IP association document;

[0135] The request generation submodule is used to generate a firewall activation request according to the plurality of first target IP addresses and second target IP addresses.

[0136] Specifically, the identifier extraction submodule is used to extract a plurality of first target IP addresses and second target IP addresses marked with connection failure identifiers from the IP association document according to the connection failure identifiers in the IP association document. The request generation submodule is used to correspond the plurality of first target IP addresses and second target IP addresses that have failed to connect to each other one by one, and to generate firewall activation requests in batches according to the plurality of first target IP addresses and second target IP addresses after the correspondence.

[0137] The request module 405 of the embodiment of the present application can generate firewall activation requests in batches, so that multiple IP address pairs with failed connections can be processed at one time without manual operation one by one, which significantly improves the processing efficiency and is particularly suitable for large-scale network environments. By opening a firewall for IP address pairs with failed connections, the configuration of network resources can be optimized. The opening of the firewall can ensure that the network communications between these IP address pairs are properly protected and filtered, thereby improving the overall security and performance of the network.

[0138] To solve the above technical problems, the present application also provides a computer device. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0139] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 6 with a memory 61, a processor 62, and a network interface 63, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0140] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0141] The memory 61 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 61 can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store the operating system and various application software installed on the computer device 6, such as computer-readable instructions of the communication protocol management method, etc. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or are to be output.

[0142] The processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to run computer-readable instructions stored in the memory 61 or process data, such as computer-readable instructions for running the communication protocol management method.

[0143] The network interface 63 may include a wireless network interface or a wired network interface. The network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0144] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the communication protocol management method as described above.

[0145] The computer device, computer-readable storage medium and computer-readable instructions thereof provided in the embodiments of the present application monitor the changes of IP-related documents through the execution of a processor. When a change in the IP address in the document is detected, the computer device can immediately respond and obtain the changed first target IP address, thereby realizing instant perception and response to the change of the IP address and greatly reducing the delay of manual troubleshooting. By matching the second target IP address associated with the first target IP address from the IP-related document, an accurate association between the network port and the service application can be established. By generating a test data packet based on the first target IP address and the second target IP address and sending the test data packet to the port corresponding to the second target IP address for network connection testing, it is possible to accurately determine whether the network connection between the first target IP address and the second target IP address is connected, and quickly identify the problem of firewall rule failure caused by the original IP change. By automatically generating a firewall activation request and sending the request to the operation and maintenance end corresponding to the firewall management when the network connection is not connected, the efficiency of firewall rule troubleshooting and operation and maintenance is further improved.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0147] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to replace some of the technical features therein with equivalents. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

[0148] The non-Company software tools or components appearing in the embodiments of this application are merely examples and do not represent actual use.

Claims

1. A communication protocol management method, characterized in that: The steps include: In response to a change signal of an Internet Protocol (IP) associated document, acquiring a changed first target IP address according to the change signal; matching a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of the service application running on the network endpoint IP address; Generate a test data packet according to the first target IP address and the second target IP address; Sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address; If the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, a firewall activation request is generated based on the first target IP address and the second target IP address, and the firewall activation request is sent to the operation and maintenance end corresponding to the firewall management.

2. The communication protocol management method according to claim 1, characterized in that: Before the step of responding to the change signal of the Internet Protocol IP association document and acquiring the changed first target IP address according to the change signal, the step further includes: Monitor whether there is any change in the IP list in the IP association document, wherein the IP list includes a network endpoint IP address list and a service application IP address list corresponding to each network endpoint IP address; If the IP list changes, the changed IP address is determined as the first target IP address, and a change signal is generated according to the first target IP address.

3. The communication protocol management method according to claim 1, characterized in that: The step of matching the second target IP address from the IP association document according to the first target IP address comprises: If the first target IP address is a network endpoint IP address, matching the service application IP address corresponding to the network endpoint IP address from the IP association document as the second target IP address; If the first target IP address is a service application IP address, the network endpoint IP address corresponding to the service application IP address is matched from the IP association document as the second target IP address.

4. The communication protocol management method according to claim 1, characterized in that: The step of sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address includes: Sending the test data packet to the port corresponding to the second target IP address, and monitoring a response signal returned from the second target IP address; If a response signal returned by the second target IP address is received within a preset time, the network connection state is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected; If the response signal returned by the second target IP address is not received within the preset time, the network connection status is determined as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected.

5. The communication protocol management method according to claim 4, characterized in that: After the step of determining the network connection state as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is connected, the method further includes: The first target IP address and the second target IP address are marked with a connection success flag, and the connection success flag is stored in the IP association document.

6. The communication protocol management method according to claim 4, characterized in that: After the step of determining the network connection state as the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, the method further includes: The first target IP address and the second target IP address are marked with a connection failure flag, and the connection failure flag is stored in the IP association document.

7. The communication protocol management method according to claim 6, characterized in that: The step of generating a firewall activation request according to the first target IP address and the second target IP address comprises: Extracting a plurality of first target IP addresses and second target IP addresses marked with connection failure identifiers from the IP association document; A firewall activation request is generated according to the plurality of first target IP addresses and second target IP addresses.

8. A communication protocol management device, characterized in that: The device comprises: An acquisition module, configured to respond to a change signal of an Internet Protocol (IP) associated document and acquire a changed first target IP address according to the change signal; a matching module, configured to match a second target IP address from the IP association document according to the first target IP address, wherein the IP association document is a document recording the association between each network endpoint IP address in the network and the IP address of a service application running on the network endpoint IP address; A generating module, configured to generate a test data packet according to the first target IP address and the second target IP address; A test module, used for sending the test data packet to the port corresponding to the second target IP address to test the network connection status between the port corresponding to the first target IP address and the port corresponding to the second target IP address; A request module is used to generate a firewall activation request based on the first target IP address and the second target IP address if the network connection status is that the network connection between the port corresponding to the first target IP address and the port corresponding to the second target IP address is not connected, and send the firewall activation request to the operation and maintenance end corresponding to the firewall management.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the communication protocol management method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the communication protocol management method according to any one of claims 1 to 7 are implemented.

Images