Method and device for linkage of configuration information and firewall policy

Abstract

The invention provides a configuration information and firewall policy linkage method and device, equipment and a storage medium, and can be applied to the technical field of information security, the technical field of artificial intelligence, the technical field of finance or other related fields. The method comprises the following steps: acquiring source data corresponding to each application in different environments; according to the source data, constructing a knowledge graph which associates configuration information of each application with a firewall policy; under the condition that the target application serves as an access party to access other applications, configuration information and firewall strategies corresponding to other applications in different environments are obtained from the knowledge graph, so that configuration deployment and firewall opening of the target application are achieved; and under the condition that the target application serves as a service provider to provide services externally, changing the configuration information and the firewall policy corresponding to the target application according to the change information corresponding to the target application by using the knowledge graph.

Description

Technical Field

[0001] The present disclosure relates to the fields of information security technology, artificial intelligence technology, financial technology or other related fields, and in particular to a method, apparatus, device, medium and program product for linking configuration information and firewall policies. Background Art

[0002] An organization usually contains multiple application systems, so the realization of a function often requires access and calls between multiple different applications. Application systems often act as service providers for other applications to access and call, and as access parties to call the services of other applications to realize complete functions.

[0003] However, currently, when the application system acts as a service provider, it is difficult to grasp the information of all access applications, which makes it easy to make calls with errors and omissions. In addition, since the information provided to the outside world may change, there is a risk that the access party fails to change the firewall policy or update the configuration information in time, resulting in the risk of application service unavailability and affecting business transactions. When the application system acts as the access party, since it is necessary to deploy applications in multiple environments, the process of obtaining configuration information and firewall policies in multiple environments is time-consuming and there are problems of information omission and errors. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for linking configuration information and firewall policies.

[0005] According to a first aspect of the present disclosure, a method for linking configuration information and firewall policies is provided, comprising:

[0006] Obtain source data corresponding to each application in different environments;

[0007] Based on the above source data, a knowledge graph is constructed that associates the configuration information of the above applications with the firewall policies;

[0008] When the target application accesses other applications as an access party, the configuration information and firewall policies corresponding to the other applications in different environments are obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application; and

[0009] When the target application acts as a service provider to provide services externally, the knowledge graph is used to change the configuration information and firewall policy corresponding to the target application according to the change information corresponding to the target application.

[0010] According to an embodiment of the present disclosure, when the target application accesses other applications as an access party, the configuration information and firewall policies corresponding to the other applications in different environments are obtained from the knowledge graph to implement the configuration deployment and firewall opening of the target application, including:

[0011] Performing configuration deployment on the target application according to the configuration information corresponding to the other application; and

[0012] According to the service address corresponding to the other application determined from the firewall policy, a firewall is opened between the service address corresponding to the other application and the service address corresponding to the target application.

[0013] According to an embodiment of the present disclosure, when the target application provides services externally as a service provider, the configuration information and firewall policy corresponding to the target application are changed by using the knowledge graph according to the change information corresponding to the target application, including:

[0014] In the case where the change information indicates that the service address of the target application has changed, determining, from the knowledge graph, a first server that has an access relationship with the old service address according to the old service address in the change information;

[0015] According to the configuration information corresponding to the old service address, determining from the knowledge graph a second server that uses the configuration information; and

[0016] According to the new service address, the first server and the second server in the change information, the firewall policy corresponding to the target application is changed to obtain a changed firewall policy.

[0017] According to an embodiment of the present disclosure, the method for linking the configuration information with the firewall policy further includes:

[0018] According to the changed firewall policy, a firewall is opened between the new service address and the service address corresponding to the target server, wherein the target server includes the first server and the second server.

[0019] According to an embodiment of the present disclosure, the method for linking the configuration information with the firewall policy further includes:

[0020] In the case where the change information indicates that the configuration information of the target application has changed, determining the target server using the old configuration information from the knowledge graph according to the old configuration information in the change information; and

[0021] According to the new configuration information in the change information, the configuration information used by the target server is changed.

[0022] According to an embodiment of the present disclosure, the method for linking the configuration information with the firewall policy further includes:

[0023] Add the new service address or the new configuration information in the change information as a new node to the knowledge graph to obtain a first knowledge graph;

[0024] According to the target application and the target server, the edges in the first knowledge graph are adjusted to obtain a second knowledge graph.

[0025] According to an embodiment of the present disclosure, the method for linking the configuration information with the firewall policy further includes:

[0026] When the old service address or the old configuration information is not accessed within a preset time range, the old service address or the old configuration information is taken offline, and the nodes and edges related to the old service address or the old configuration information in the second knowledge graph are deleted.

[0027] According to an embodiment of the present disclosure, the knowledge graph associating the configuration information of each application with the firewall policy is constructed based on the source data, including:

[0028] Extracting the source data according to the constructed architecture corresponding to the knowledge graph to obtain extracted information; and

[0029] Based on the above extracted information, the above knowledge graph is constructed.

[0030] The second aspect of the present disclosure provides a device for linking configuration information and firewall policies, including: a first acquisition module, a construction module, a second acquisition module and a change module. Among them, the first acquisition module is used to obtain source data corresponding to each application in different environments. The construction module is used to construct a knowledge graph that associates the configuration information and firewall policies of each application according to the above source data. The second acquisition module is used to obtain the configuration information and firewall policies corresponding to the above other applications in different environments from the above knowledge graph when the target application accesses other applications as an access party, so as to realize the configuration deployment and firewall activation of the above target application. The change module is used to use the above knowledge graph to change the configuration information and firewall policies corresponding to the above target application according to the change information corresponding to the above target application when the above target application provides services to the outside as a service provider.

[0031] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0032] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0033] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0034] According to the method, device, equipment, medium and program product for the linkage of configuration information and firewall policies provided by the present disclosure, a knowledge graph associating the configuration information and firewall policies of each application can be constructed based on the acquired source data corresponding to each application in different environments. Based on this, when the target application accesses other applications as an access party, the configuration information and firewall policies corresponding to other applications in different environments can be directly obtained from the knowledge graph to achieve configuration deployment and firewall activation, reducing the communication cost during multi-environment operation and maintenance, and also reducing the risk of errors and omissions; when the target application provides services to the outside as a service provider, the knowledge graph can be used to change the configuration information and firewall policies corresponding to the target application according to the change information corresponding to the target application, realizing the timely change of the configuration information or firewall policies of all access parties corresponding to the target application, reducing the risk of environmental unavailability and information security risks caused by missing configuration information and missing firewalls, and ensuring the stability of each environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0036] Figure 1 A schematic diagram showing an application scenario of the method for linking configuration information and firewall policies according to an embodiment of the present disclosure;

[0037] Figure 2 A flowchart schematically illustrates a method for linking configuration information and firewall policies according to an embodiment of the present disclosure;

[0038] Figure 3 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0039] Figure 4A schematic diagram of a graph link in which a target application accesses other applications as an access party according to an embodiment of the present disclosure is schematically shown;

[0040] Figure 5 A flowchart for changing configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown;

[0041] Figure 6 A schematic diagram schematically shows a knowledge graph after the service address and configuration information of a target application are changed according to an embodiment of the present disclosure;

[0042] Figure 7 A system diagram schematically shows a method for realizing linkage between configuration information and firewall policies according to an embodiment of the present disclosure;

[0043] Figure 8 A structural block diagram schematically shows an apparatus for linking configuration information and firewall policies according to an embodiment of the present disclosure; and

[0044] Fig. 9 A block diagram of an electronic device suitable for implementing a method for linking configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0045] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0046] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0047] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0048] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0049] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0050] In the process of implementing this disclosure, it is found that the inter-application call needs to configure information on the access side and open the firewall to the target application before the service call can be made. In the full life cycle management of software development, development, testing and production operation and maintenance personnel need to deploy applications in multiple environments, and the configuration information and firewall opening strategies in different environments are different.

[0051] When the application system is used as the access party to connect to a new application, the development, testing, and production personnel need to conduct multiple rounds of verification of the configuration information and firewall activation policies of multiple environments. This cumbersome process not only consumes time and energy, but is also prone to errors and omissions.

[0052] In the case of application systems acting as service providers, when the configuration of services provided to the outside world or the firewall opening address changes due to various modifications, all connected application systems need to be notified to change the configuration or modify the firewall opening policy. In particular, it is difficult for basic support applications to grasp the information of all connected applications. If all connected applications are not notified to update the configuration information or change the firewall policy in a timely manner, information security risks are likely to occur, affecting business transactions.

[0053] To this end, an embodiment of the present disclosure provides a method for linking configuration information and firewall policies, including: obtaining source data corresponding to each application in different environments; constructing a knowledge graph that associates the configuration information and firewall policies of each application based on the source data; when the target application accesses other applications as an access party, obtaining configuration information and firewall policies corresponding to other applications in different environments from the knowledge graph to implement configuration deployment and firewall activation of the target application; when the target application provides services externally as a service provider, using the knowledge graph to change the configuration information and firewall policies corresponding to the target application based on the change information corresponding to the target application.

[0054] Figure 1 The application scenario diagram of the method for linking configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0055] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0056] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0057] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0058] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0059] For example, source data corresponding to each application in different environments can be obtained through server 105, and a knowledge graph associating configuration information and firewall policies of each application can be constructed based on the source data. Thus, when the target application accesses other applications as an access party, configuration information and firewall policies corresponding to other applications in different environments can be obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application. Furthermore, when the target application provides services externally as a service provider, the knowledge graph can be used to change the configuration information and firewall policies corresponding to the target application according to the change information corresponding to the target application.

[0060] It should be noted that the method for linking configuration information and firewall policies provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for linking configuration information and firewall policies provided in the embodiment of the present disclosure can generally be set in the server 105. The method for linking configuration information and firewall policies provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the device for linking configuration information and firewall policies provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0061] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0062] The following will be based on Figure 1 The scene described by Figure 2 to Figure 7 The method for linking the configuration information and firewall policy of the disclosed embodiment is described in detail.

[0063] Figure 2 The flowchart of the method for linking configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0064] like Figure 2 As shown, the method 200 includes operations S210 to S240.

[0065] In operation S210, source data corresponding to each application in different environments is acquired.

[0066] According to an embodiment of the present disclosure, different environments may include development environment, test environment and production environment. Source data may include configuration information of each application in different environments, firewall policies, correspondence between applications and servers, groups and nodes, and network traffic information between different applications.

[0067] According to an embodiment of the present disclosure, configuration information may include configuration information of the application as a service provider providing services to the outside world and configuration information required for the application system's own services, wherein the configuration information may include multiple configuration items and corresponding configuration values. Firewall policies may include the source address, destination address, destination port, service type, protocol, allow / reject, effective time range, etc. of the firewall, wherein the source address may represent the service address of the application as the access party, and the destination address may represent the service address of the application as the service provider. Network traffic information may be used to determine whether there is an access relationship between different applications.

[0068] According to an embodiment of the present disclosure, each application may include multiple groups, each group may include multiple nodes, and each node may include multiple servers, that is, there is a hierarchical relationship between applications, groups, nodes, and servers.

[0069] In operation S220, a knowledge graph is constructed based on the source data, which associates the configuration information of each application with the firewall policy.

[0070] According to an embodiment of the present disclosure, a knowledge graph that can associate configuration information of each application with firewall policies can be constructed based on the acquired source data and using an architecture corresponding to the knowledge graph. A graph database can be used to store and manage the knowledge graph that associates configuration information and firewall policies in multiple environments.

[0071] In operation S230, when the target application accesses other applications as an access party, configuration information and firewall policies corresponding to other applications in different environments are obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application.

[0072] According to the embodiments of the present disclosure, when the target application accesses other applications as an access party, the configuration information and firewall policies of the other applications in the corresponding environment can be obtained from the knowledge graph, and the configuration information and firewall policies of other environments can also be obtained synchronously. Among them, the other applications accessed by the target application are selected and determined by the architect of the application.

[0073] For example, when the application manager in the development environment selects application A as the other application that the target application needs to access, he can obtain the service address, configuration items and configuration values ​​of application A in the development environment through the knowledge graph. The application managers in the test environment and production environment can also synchronously obtain the service address, configuration items and configuration values ​​of application A in multiple environments such as the test environment and production environment.

[0074] In operation S240, when the target application provides services externally as a service provider, the knowledge graph is used to change the configuration information and firewall policy corresponding to the target application according to the change information corresponding to the target application.

[0075] According to an embodiment of the present disclosure, the change information may include a service address change and a configuration information change, wherein the configuration change may include a configuration item change and a configuration value change. In the case where the target application provides services externally as a service provider, a query is performed through the knowledge graph based on the change information to obtain all access parties that access the target application, so that the configuration information and firewall policies corresponding to the access party and the target application can be changed.

[0076] According to the embodiments of the present disclosure, based on the acquired source data corresponding to each application in different environments, a knowledge graph associating the configuration information and firewall policies of each application can be constructed. Based on this, when the target application accesses other applications as an access party, the configuration information and firewall policies corresponding to other applications in different environments can be directly obtained from the knowledge graph to achieve configuration deployment and firewall activation, reducing the communication cost during multi-environment operation and maintenance, and also reducing the risk of errors and omissions; when the target application provides services to the outside as a service provider, the knowledge graph can be used to change the configuration information and firewall policies corresponding to the target application according to the change information corresponding to the target application, realizing the timely change of the configuration information or firewall policies of all access parties corresponding to the target application, reducing the risk of environmental unavailability and information security risks caused by missing configuration information and missing firewalls, and ensuring the stability of each environment.

[0077] According to an embodiment of the present disclosure, a knowledge graph associating configuration information of each application with firewall policies is constructed based on source data, including: extracting source data according to a constructed architecture corresponding to the knowledge graph to obtain extracted information; and constructing a knowledge graph based on the extracted information.

[0078] According to an embodiment of the present disclosure, the constructed architecture corresponding to the knowledge graph may include the following Tables 1 to 4. Table 1 may represent the entity architecture corresponding to the knowledge graph, and may reflect the entity type and the entity attribute type corresponding to the entity type.

[0079] Table 1

[0080] Entity Type Entity attribute type application Application name, application abbreviation Application Manager Name, environment, email address server Environment, IP address, operating system Groups Group Name node Node Name Service Address Environment, IP address, port, protocol Configuration items Configuration item name, environment, configuration value

[0081] According to an embodiment of the present disclosure, Table 2 can represent the relational architecture corresponding to the knowledge graph, and can reflect the entity types and the relation types corresponding to the entity types.

[0082] Table 2

[0083]

[0084] According to an embodiment of the present disclosure, Table 3 may represent another relational architecture corresponding to the knowledge graph, which may reflect relational types and relational attributes corresponding to the relational types.

[0085] Table 3

[0086] Relationship Type Relationship properties There is network traffic Protocol, timestamp, or time range Firewall policy exists Allow / deny, protocol, time range Have access relationship Timestamp or time range Configuration changes Change type, change version, timestamp Changes to the Service Change type, change version, timestamp

[0087] According to an embodiment of the present disclosure, Table 4 may represent another relational architecture corresponding to the knowledge graph, which may reflect the relationship types between different entity types.

[0088] Table 4

[0089] Entity Type Relationship Type Entity Type server There is network traffic Service Address server Firewall policy exists Service Address application Corresponding person in charge Application Manager Configuration items correspond Service Address IP address Have access relationship Service Address

[0090] According to the embodiments of the present disclosure, the acquired source data may be first preprocessed to unify the format of the source data, and then the source data may be extracted with respect to entities, relationships, and attribute information related to configuration information and firewall policies using the architectures related to the knowledge graphs in Tables 1 to 4 above to obtain extracted information.

[0091] According to the embodiments of the present disclosure, the extracted information can be integrated through knowledge fusion and knowledge reasoning to obtain a knowledge graph to ensure the consistency of entities and relationships.

[0092] Among them, knowledge reasoning can include logic-based reasoning and knowledge graph-based reasoning, which is to enrich the knowledge graph.

[0093] For example, reasoning 1: based on the fact that node Aa in application A contains a server with IP address ip_a, and configuration node Aa contains configuration item cfg_Aa, it can be concluded that the server with ip_a is configured with configuration item cfg_Aa and its corresponding configuration value; reasoning 2: based on the fact that there is network traffic or firewall policy between the IP address and the service address within the time range, it can be concluded that the IP address has an access relationship with the corresponding service address.

[0094] According to an embodiment of the present disclosure, source data is extracted according to the constructed architecture corresponding to the knowledge graph, so that extracted information that is more relevant to configuration information and firewall policies can be obtained, reducing the use of data in the source data that is not related to configuration information and firewall policies, and making the constructed knowledge graph more accurate and effective.

[0095] Figure 3 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown.

[0096] like Figure 3 As shown, the knowledge graph 300 can represent a portion of the knowledge graph involving application A and application B.

[0097] According to an embodiment of the present disclosure, application A310 may represent an access party, and application B may represent a service provider. The multiple groups included in application A310 may include group A311, the multiple nodes included in group A311 may include node A312, and the multiple servers included in node A312 may include server A313.

[0098] According to the embodiments of the present disclosure, since the application, group, node, and server are in a hierarchical relationship, when server A313 has a calling relationship with application B320, the upper node A312, group A311, and application A310 of server A313 will also have a calling relationship with application B320. The service address of the service provided by application B320 to the outside world can be service address B321, and the configuration item corresponding to the service address B321 is configuration item B322. Node A312 and server A313 can configure configuration item 322 of application B320.

[0099] According to an embodiment of the present disclosure, the edges in the knowledge graph 300 may reflect the relationships between entities.

[0100] According to an embodiment of the present disclosure, when the target application accesses other applications as an access party, configuration information and firewall policies corresponding to other applications in different environments are obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application, including: performing configuration deployment on the target application according to the configuration information corresponding to other applications; and activating the firewall between the service addresses corresponding to other applications and the service address corresponding to the target application according to the service addresses corresponding to other applications determined from the firewall policy.

[0101] According to an embodiment of the present disclosure, when the configuration information and service address of the accessed application are obtained, the corresponding configuration information can be correctly configured on the server corresponding to the target application, and the firewall between the target application and the accessed application can be automatically opened according to the service address of the accessed application.

[0102] According to the embodiments of the present disclosure, when the target application accesses other applications as an access party, all configuration information and firewall policies corresponding to other applications in different environments can be directly obtained from the knowledge graph to implement configuration deployment and firewall activation, thereby reducing communication costs during multi-environment operation and maintenance, and reducing the risk of errors and omissions.

[0103] Figure 4 A diagram schematically shows a graph link diagram in which a target application accesses other applications as an access party according to an embodiment of the present disclosure.

[0104] like Figure 4 As shown, the knowledge graph 400 can represent the graph link for the target application to obtain multi-environment configuration information and service addresses when accessing other applications as an access party.

[0105] According to an embodiment of the present disclosure, application A410 may represent a target application, and application B420 may represent other connected applications. Among them, the multiple groups included in application A410 may include group A411, the multiple nodes included in group A411 may include node A412, and the multiple servers included in node A412 may include server A413.

[0106] According to an embodiment of the present disclosure, application A410, group A411, node A412 and server A413 can all call application B420. The service addresses provided by application B420 to the outside world may include service address B421_1 in a development environment, service address B422_1 in a test environment and service address B423_1 in a production environment. The configuration item corresponding to service address B421_1 is configuration item B421_2, the configuration item corresponding to service address B422_1 is configuration item B422_2, and the configuration item corresponding to service address B423_1 is configuration item B423_2.

[0107] According to an embodiment of the present disclosure, when the server A413 is in a production environment, it is possible to access a service address B423_1 in the production environment and configure a configuration item B423_2 in the production environment.

[0108] Among them, the knowledge graph 400 can associate the configuration information and firewall policies of applications and their external services in multiple environments such as development, testing, and production.

[0109] Figure 5 A flowchart of changing configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0110] like Figure 5 As shown, the method 500 includes operations S510 to S530.

[0111] In operation S510, when the change information indicates that the service address of the target application has changed, a first server having an access relationship with the old service address is determined from the knowledge graph according to the old service address in the change information.

[0112] According to an embodiment of the present disclosure, the first server that has an access relationship with the old service address within a specified time range can be determined from the knowledge graph according to the old service address in the change information, and the application, node and group to which the first server belongs can also be determined. The first server may include multiple servers, and the specified time range can be determined by the person in charge of the application.

[0113] For example, Figure 4 For example, the target application may represent application B420. When the service address B423_1 of application B420 in the production environment changes, the first server that has an access relationship with the old service address B423_1 within a specified time range, namely server A413, can be determined through the knowledge graph 400.

[0114] In operation S520, based on the configuration information corresponding to the old service address, a second server using the configuration information is determined from the knowledge graph.

[0115] According to an embodiment of the present disclosure, there is an access relationship between different servers, but because the access time interval between some servers is relatively long and exceeds the specified time range, the server will be omitted. In order to avoid the omission of the server that has an access relationship with the old service address, the second server using the configuration information can be determined from the knowledge graph, and the application, node and group to which the second server belongs can also be determined. Among them, the second server can include multiple servers.

[0116] In operation S530, the firewall policy corresponding to the target application is changed according to the new service address, the first server, and the second server in the change information to obtain a changed firewall policy.

[0117] According to an embodiment of the present disclosure, based on the determined first server and second server, all servers having access relations with the old service address can be determined, so that the firewall policy corresponding to the target application can be changed to obtain the changed firewall policy.

[0118] According to the embodiments of the present disclosure, when the service address of the target application as a service provider that provides services to the outside world changes, the knowledge graph can be used to determine all servers that have access relationships with the old service address, thereby achieving timely changes to the firewall policies of all access parties corresponding to the target application, reducing the risk of environmental unavailability and information security risks caused by firewall leakage, and ensuring the stability of each environment.

[0119] According to an embodiment of the present disclosure, the method of linking the above configuration information and firewall policy also includes: according to the changed firewall policy, opening a firewall between the new service address and the service address corresponding to the target server, wherein the target server may include a first server and a second server.

[0120] According to an embodiment of the present disclosure, the destination address in the firewall policy before the change can represent the old service address, and the destination address in the firewall policy after the change can represent the new service address. Based on this, the firewall between the new service address and the target server can be opened according to the destination address and source address in the firewall policy after the change.

[0121] According to an embodiment of the present disclosure, when the target application acts as a service provider, if the service address providing external services changes, all involved access parties need to be opened to the firewall of the new service address without the need for the access parties to modify configuration information.

[0122] According to the embodiments of the present disclosure, based on the changed firewall policy, the firewall between the target server and the new service address can be opened in time, reducing the risk of environmental unavailability and information security risks caused by firewall leakage, and ensuring the stability of each environment.

[0123] According to an embodiment of the present disclosure, the method of linking the above-mentioned configuration information and firewall policy also includes: when the change information represents that the configuration information of the target application has changed, determining the target server using the old configuration information from the knowledge graph based on the old configuration information in the change information; and changing the configuration information used by the target server based on the new configuration information in the change information.

[0124] According to an embodiment of the present disclosure, the target server using the old configuration information can be queried from the knowledge graph based on the old configuration information in the change information, and the application, node and group to which the target server belongs can also be determined. The target server may include multiple servers; the old configuration information may include old configuration items and old configuration values.

[0125] For example, Figure 4 For example, the target application may represent application B420. When configuration item B423_1 of application B420 in the production environment is changed, the target server that has an access relationship with the old configuration item B423_1, namely server A413, may be determined through knowledge graph 400.

[0126] According to an embodiment of the present disclosure, the target server can represent the access party involved. The configuration items or configuration values ​​used by the target server can be modified according to the new configuration information. The new configuration information can include new configuration items and new configuration values.

[0127] According to an embodiment of the present disclosure, when the configuration information of the target application as a service provider that provides services to the outside world changes, the knowledge graph can be used to determine all servers that use the old configuration information, thereby achieving timely changes in the configuration information of all access parties corresponding to the target application and reducing the risk of environmental unavailability caused by missed configuration changes.

[0128] According to an embodiment of the present disclosure, the method of linking the above-mentioned configuration information and firewall policy also includes: adding the new service address or new configuration information in the change information as a new node to the knowledge graph to obtain a first knowledge graph; adjusting the edges in the first knowledge graph according to the target application and the target server to obtain a second knowledge graph.

[0129] According to an embodiment of the present disclosure, when the configuration information or service address of the target application changes, the change information needs to be recorded in the knowledge graph.

[0130] According to an embodiment of the present disclosure, the new service address or new configuration information in the change information can be added as a new node to the knowledge graph, and the edges between the target application, the target server and the new node and the old node can be adjusted to obtain a second knowledge graph. The old node can represent the old service address or the old configuration information.

[0131] According to the embodiments of the present disclosure, the knowledge graph can be updated in real time according to the change information to maintain the accuracy and timeliness of the data and information in the knowledge graph, so that the corresponding configuration information and service address can be obtained subsequently according to the latest knowledge graph.

[0132] Figure 6 A schematic diagram schematically shows a knowledge graph after the service address and configuration information of the target application are changed according to an embodiment of the present disclosure.

[0133] like Figure 6 As shown, the knowledge graph 600 may represent a portion of the knowledge graph after the service address and configuration information of the target application are changed. Among them, the target application may represent application B 610.

[0134] According to an embodiment of the present disclosure, before the service address and configuration information of application B610 are changed, the service address corresponding to application B610 is service address B1611, and the configuration item is configuration item B1612. After the service address and configuration information of application B610 are changed, service address B2613 and configuration item B2612 can be used as new nodes in the knowledge graph, and the edges between the nodes representing application B610, service address B1611, configuration item B1612, service address B2613, and configuration item B2612 in the knowledge graph are adjusted to obtain knowledge graph 600.

[0135] According to an embodiment of the present disclosure, the method of linking the above-mentioned configuration information and firewall policy also includes: when the old service address or old configuration information is not accessed within a preset time range, the old service address or old configuration information is taken offline, and the nodes and edges related to the old service address or old configuration information in the second knowledge graph are deleted.

[0136] According to an embodiment of the present disclosure, if the old service address or old configuration information is not accessed within a preset time range, the old service address or old configuration information can be taken offline, and the nodes and edges related to the old service address or old configuration information in the second knowledge graph can be deleted. The preset time range can be determined by the person in charge of the application.

[0137] For example, Figure 6 Taking the knowledge graph 600 in as an example, when the old service address 611 has no access within a preset time range, the node of the old service address 611 and the edges between the old service address 611 and the application B 610 and the configuration item 612 can be deleted.

[0138] According to an embodiment of the present disclosure, when the old service address or old configuration information is not accessed within a preset time range, the old service address or old configuration information is taken offline in time to avoid affecting the business due to the access party using the old configuration information and opening a firewall between the old service address.

[0139] Figure 7 A system diagram of a method for realizing linkage between configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0140] like Figure 7 As shown, the system 700 for implementing the method of linking configuration information and firewall policies may include a configuration management module 710 , a network management module 720 , a graph management module 730 and an information push module 740 .

[0141] According to an embodiment of the present disclosure, the system 700 may further include a rights management module. The rights management module may be used to manage the roles of users, that is, rights, that is, to determine user management rights according to the user roles and user types of the accessing users.

[0142] Among them, user roles and user types can represent operation and maintenance personnel or application managers in different environments.

[0143] According to the embodiments of the present disclosure, operation and maintenance personnel in different environments only have the authority to maintain and manage configuration information and firewall policies in the corresponding environments.

[0144] For example, the operation and maintenance personnel in the development environment have the authority to maintain and modify the configuration information and firewall policies in the development environment, but do not have the authority to maintain and manage the configuration information and firewall policies in the test, production and other environments.

[0145] According to the embodiments of the present disclosure, the person in charge of the application in the development, testing, and production environments of each application system can maintain and modify the configuration information and firewall policies of the external services provided by the application in charge. The person in charge of the application in the development, testing, and production environments of each application system can also obtain the configuration information and firewall policies of other applications accessed by the application in charge in the corresponding environment to configure the configuration information and firewall policies of the accessed application, and open the firewall between the service provider and the access party, so that the service provider and the access party can have network access.

[0146] According to an embodiment of the present disclosure, the configuration management module 710 can enable the application manager to perform configuration management on an operable display interface, such as adding, modifying and querying configurations.

[0147] According to the embodiments of the present disclosure, the person in charge of the application can configure and maintain the configuration information and firewall policies for the services provided by the application to the outside through the configuration management module 710. The configuration information required for the application's own services can also be configured and maintained through the configuration management module 710, and can be uniformly configured according to the node group, and special configuration items can be set for the service address corresponding to the specified node in the node group. The corresponding relationship between the service address in each environment and its corresponding application, group, and node can also be configured through the configuration management module 710.

[0148] Among them, the node group can represent a group; the configuration information required by the configured application's own service can be directly used when installing the application in each environment version.

[0149] According to an embodiment of the present disclosure, the network management module 720 can be used to configure the mapping relationship between the service address and the configuration information, and can also be used to collect network traffic information or firewall policies between terminals and network devices, wherein the configuration items in the configuration information can include domain names. The network management module 720 can also be used to implement automatic addition and implementation of firewall policies based on the firewall change information received from the information push module 740. The firewall change information can represent the changed firewall policy, and the firewall change information can include the service address of the target server and the new service address of the target application.

[0150] According to the embodiments of the present disclosure, the above operations S210 and S220 can be performed using the graph management module 730. The graph management module 730 can obtain the following data from the configuration management module 710: configuration information of the services provided by the application to the outside and the firewall activation address; configuration information required for the application system's own services; the corresponding relationship between the configuration server IP address and its corresponding application, group, and node. The graph management module 730 can also obtain the following data from the network management module 720: network traffic information between terminals; the mapping relationship between network domain names and IP addresses; and firewall policy information.

[0151] According to the embodiment of the present disclosure, the graph management module 730 can also add and modify entities and relationships in the knowledge graph according to the change information from the configuration management module 710 and the network management module 720, that is, update the changes of configuration information and service addresses to the knowledge graph in real time, and update the access relationship corresponding to network traffic and firewalls based on preset knowledge fusion and knowledge reasoning. And regularly maintain and update the expired network policies to maintain the accuracy of data and information in the knowledge graph, where the network policies can include service addresses and configuration information.

[0152] The application manager can modify the service address, configuration items, and configuration values ​​of the external services in the configuration management module 710 .

[0153] According to the embodiments of the present disclosure, when the application acts as a service provider, if the service address or configuration information of the service provided to the outside is changed, the information push module 740 can be used to push the information output in the knowledge graph stored in the graph management module 730 to the application person in charge of the corresponding environment, so that the application person in charge can timely understand the changes in the configuration information or firewall policy, and verify the new service address and new configuration information, that is, verification in the network and business scenarios.

[0154] According to the embodiments of the present disclosure, when the application serves as the access party, the configuration information and firewall policies corresponding to other applications in the corresponding environment output in the knowledge graph stored in the graph management module 730 can be used, and the information push module 740 can push the output information to the application person in charge of the corresponding environment, so that the application person in charge can quickly understand the scope of the changed configuration items, including the group, node and server scope, so as to accurately and quickly modify the configuration information. If the configuration information changes and the application needs to be accessed for program modification, the access party can also quickly locate the program modification node range. According to the embodiments of the present disclosure, the information push module 740 can also send the service address information output in the graph management module 730 to the network management module 720, so that the network management module 720 can automatically open the firewall, wherein the service address information may include the source address and the target address.

[0155] Based on the above configuration information and firewall policy linkage method, the present disclosure also provides a configuration information and firewall policy linkage device. Figure 8 The device is described in detail.

[0156] Figure 8 The structural block diagram of the device for linking configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0157] like Figure 8 As shown, the device 800 for linking configuration information and firewall policies in this embodiment includes a first acquisition module 810 , a construction module 820 , a second acquisition module 830 and a change module 840 .

[0158] The first acquisition module 810 is used to acquire source data corresponding to each application in different environments. In one embodiment, the first acquisition module 810 can be used to perform the operation S210 described above, which will not be described in detail here.

[0159] The construction module 820 is used to construct a knowledge graph that associates the configuration information of each application with the firewall policy according to the source data. In one embodiment, the construction module 820 can be used to perform the operation S220 described above, which will not be described in detail here.

[0160] The second acquisition module 830 is used to obtain configuration information and firewall policies corresponding to other applications in different environments from the knowledge graph when the target application accesses other applications as an access party, so as to implement configuration deployment and firewall activation of the target application. In one embodiment, the second acquisition module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0161] The change module 840 is used to change the configuration information and firewall policy corresponding to the target application according to the change information corresponding to the target application by using the knowledge graph when the target application provides services externally as a service provider. In one embodiment, the change module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0162] According to an embodiment of the present disclosure, the second acquisition module 830 includes a deployment unit and a first activation unit.

[0163] The deployment unit is used to perform configuration deployment on the target application according to configuration information corresponding to other applications.

[0164] The first opening unit is used to open a firewall between the service address corresponding to other applications and the service address corresponding to the target application according to the service address corresponding to other applications determined from the firewall policy.

[0165] According to an embodiment of the present disclosure, the changing module 840 includes a first determining unit, a second determining unit, and a first changing unit.

[0166] The first determination unit is used to determine, from the knowledge graph, a first server that has an access relationship with the old service address according to the old service address in the change information when the change information indicates that the service address of the target application has changed.

[0167] The second determination unit is used to determine a second server using the configuration information from the knowledge graph based on the configuration information corresponding to the old service address.

[0168] The first changing unit is used to change the firewall policy corresponding to the target application according to the new service address, the first server and the second server in the change information to obtain the changed firewall policy.

[0169] According to an embodiment of the present disclosure, the changing module 840 further includes a second opening unit.

[0170] The second opening unit is used to open a firewall between the new service address and the service address corresponding to the target server according to the changed firewall policy, wherein the target server includes the first server and the second server.

[0171] According to an embodiment of the present disclosure, the changing module 840 further includes a third determining unit and a second changing unit.

[0172] The third determination unit is used to determine a target server using old configuration information from the knowledge graph based on the old configuration information in the change information when the change information represents that the configuration information of the target application has changed.

[0173] The second changing unit is used to change the configuration information used by the target server according to the new configuration information in the change information.

[0174] According to an embodiment of the present disclosure, the changing module 840 further includes an adding unit and an adjusting unit.

[0175] An adding unit is used to add the new service address or new configuration information in the change information as a new node to the knowledge graph to obtain a first knowledge graph.

[0176] An adjustment unit is used to adjust the edges in the first knowledge graph according to the target application and the target server to obtain the second knowledge graph.

[0177] According to an embodiment of the present disclosure, the changing module 840 further includes an offline unit.

[0178] The offline unit is used to take the old service address or old configuration information offline when there is no access to the old service address or old configuration information within a preset time range, and delete the nodes and edges related to the old service address or old configuration information in the second knowledge graph.

[0179] According to an embodiment of the present disclosure, the construction module 820 includes an extraction unit and a construction unit.

[0180] The extraction unit is used to extract the source data according to the constructed architecture corresponding to the knowledge graph to obtain the extracted information.

[0181] The construction unit is used to construct a knowledge graph based on the extracted information.

[0182] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 810, the construction module 820, the second acquisition module 830 and the change module 840 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 810, the construction module 820, the second acquisition module 830 and the change module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the first acquisition module 810 , the construction module 820 , the second acquisition module 830 , and the change module 840 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be executed.

[0183] Fig. 9 A block diagram of an electronic device suitable for implementing a method for linking configuration information and firewall policies according to an embodiment of the present disclosure is schematically shown.

[0184] like Fig. 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0185] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0186] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0187] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0188] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0189] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0190] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0191] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0192] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0193] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0194] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0195] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0196] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for linking configuration information and firewall policies, comprising: Obtain source data corresponding to each application in different environments; Based on the source data, construct a knowledge graph associating the configuration information of each application with the firewall policy; When the target application accesses other applications as an access party, configuration information and firewall policies corresponding to the other applications in different environments are obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application; as well as In the case where the target application provides services externally as a service provider, the knowledge graph is used to change the configuration information and firewall policy corresponding to the target application according to the change information corresponding to the target application.

2. The method according to claim 1, wherein: When the target application accesses other applications as an access party, configuration information and firewall policies corresponding to the other applications in different environments are obtained from the knowledge graph to implement configuration deployment and firewall activation of the target application, including: Performing configuration deployment on the target application according to the configuration information corresponding to the other application; and According to the service address corresponding to the other application determined from the firewall policy, a firewall is opened between the service address corresponding to the other application and the service address corresponding to the target application.

3. The method according to claim 1, wherein: In the case where the target application provides services externally as a service provider, using the knowledge graph, according to the change information corresponding to the target application, changing the configuration information and firewall policy corresponding to the target application, includes: In a case where the change information indicates that the service address of the target application has changed, determining, from the knowledge graph, a first server that has an access relationship with the old service address according to the old service address in the change information; According to the configuration information corresponding to the old service address, determining from the knowledge graph a second server that uses the configuration information; and According to the new service address, the first server and the second server in the change information, the firewall policy corresponding to the target application is changed to obtain a changed firewall policy.

4. The method according to claim 3, further comprising: According to the changed firewall policy, a firewall is opened between the new service address and a service address corresponding to a target server, wherein the target server includes the first server and the second server.

5. The method according to claim 4, further comprising: In a case where the change information indicates that the configuration information of the target application has changed, determining the target server using the old configuration information from the knowledge graph according to the old configuration information in the change information; as well as The configuration information used by the target server is changed according to the new configuration information in the change information.

6. The method according to claim 5, further comprising: Add the new service address or the new configuration information in the change information as a new node to the knowledge graph to obtain a first knowledge graph; According to the target application and the target server, the edges in the first knowledge graph are adjusted to obtain a second knowledge graph.

7. The method according to claim 6, further comprising: If the old service address or the old configuration information is not accessed within a preset time range, the old service address or the old configuration information is taken offline, and the nodes and edges related to the old service address or the old configuration information in the second knowledge graph are deleted.

8. The method according to claim 1, wherein: The step of constructing a knowledge graph associating the configuration information of each application with the firewall policy according to the source data includes: Extracting the source data according to the constructed architecture corresponding to the knowledge graph to obtain extraction information; and The knowledge graph is constructed based on the extracted information.

9. A device for linking configuration information and firewall policies, comprising: A first acquisition module is used to acquire source data corresponding to each application in different environments; A construction module, used to construct a knowledge graph associating the configuration information of each application with the firewall policy according to the source data; The second acquisition module is used to obtain configuration information and firewall policies corresponding to other applications in different environments from the knowledge graph when the target application accesses other applications as an access party, so as to realize configuration deployment and firewall activation of the target application; as well as The change module is used to use the knowledge graph to change the configuration information and firewall policy corresponding to the target application according to the change information corresponding to the target application when the target application provides services externally as a service provider.

10. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 8.

Images