Configuration method and device of security policy rule, equipment, medium and product

Abstract

The invention discloses a security policy rule configuration method, device, equipment, medium and product, and relates to the technical field of network security, and the method comprises the steps: determining target security policy rule data corresponding to a to-be-protected system according to a rule data obtaining request sent by the to-be-protected system under the condition that the to-be-protected system is started; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage; and sending the target security and protection strategy rule data to the to-be-protected system, so that the to-be-protected system configures a security and protection strategy rule according to the target security and protection strategy rule data. According to the invention, the target security policy rule data is stored in the storage cluster, and when the to-be-protected system is started, the target security policy rule data is directly acquired from the storage cluster for automatic configuration of the security policy rule, so that a technician does not need to repeatedly configure the security policy rule in real time at a system side; the efficiency of security policy rule configuration is improved, and the security of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a configuration method, device, equipment, medium and product for security strategy rules. Background Art

[0002] With the popularization and commercialization of the Internet, the number of system users has increased and diversified, the risks exposed by the system have become greater and greater, the requirements for system security and stability have become higher and higher, and the corresponding system security design and security architecture design have become more and more important. Therefore, it is necessary to configure the security strategy rules of the system to improve the security and stability of the system.

[0003] In the prior art, the technicians usually use the system interface to configure the security policy rules in real time in the system. However, the disadvantage of this method is that once the system is restarted, the previously configured rule data will become invalid, and the technicians need to reconfigure. This undoubtedly greatly affects the efficiency of security policy rule configuration and poses a security risk to the system. Summary of the invention

[0004] The present invention provides a method, device, equipment, medium and product for configuring security policy rules to solve the problems of low configuration efficiency and potential safety hazards in the system when configuring security protection policy rules of the system in the prior art.

[0005] According to one aspect of the present invention, a method for configuring a security policy rule is provided, which is executed by a storage cluster and includes:

[0006] When the system to be protected is started, according to the rule data acquisition request sent by the system to be protected, the target security policy rule data corresponding to the system to be protected is determined; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage;

[0007] The target security policy rule data is sent to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0008] According to another aspect of the present invention, a method for configuring security policy rules is provided, which is executed by a management cluster and includes:

[0009] Generate target security strategy rule data corresponding to the system to be protected;

[0010] Sending the target security policy rule data to a storage cluster so that the storage cluster stores the target security policy rule data;

[0011] The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0012] According to another aspect of the present invention, there is provided a security policy rule configuration device, which is configured in a storage cluster and includes:

[0013] A security policy rule data determination module, used to determine target security policy rule data corresponding to the system to be protected according to a rule data acquisition request sent by the system to be protected when the system to be protected is started; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage;

[0014] The security policy rule data sending module is used to send the target security policy rule data to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0015] According to another aspect of the present invention, there is provided a security policy rule configuration device, which is configured in a management cluster and includes:

[0016] A security strategy rule data generation module is used to generate target security strategy rule data corresponding to the system to be protected;

[0017] A security policy rule data storage module, used for sending the target security policy rule data to a storage cluster so that the storage cluster stores the target security policy rule data;

[0018] The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0019] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for configuring security policy rules described in any one of the embodiments of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for configuring security policy rules according to any one of the present inventions when executed.

[0024] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method for configuring security policy rules according to any one of the present invention.

[0025] The present invention stores the target security policy rule data corresponding to the system to be protected generated by the management cluster in the storage cluster, so that when the system to be protected is started, the target security policy rule data can be directly obtained from the storage cluster for automatic configuration of the security policy rules. There is no need for technical personnel to repeatedly configure the security policy rules in real time on the system side, which improves the efficiency of the system security policy rule configuration, shortens the dangerous period of the system without security policy rules, and improves the security of the system.

[0026] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 A flowchart of a method for configuring security policy rules provided in Embodiment 1 of the present invention;

[0029] Figure 2 A flowchart of a method for configuring security policy rules provided in Embodiment 2 of the present invention;

[0030] Figure 3 A flowchart of a method for configuring security policy rules provided in Embodiment 3 of the present invention;

[0031] Figure 4 A schematic diagram of the structure of a security strategy rule configuration device provided in Embodiment 4 of the present invention;

[0032] Figure 5 A schematic diagram of the structure of a security strategy rule configuration device provided in Embodiment 5 of the present invention;

[0033] Figure 6 It is a structural schematic diagram of an electronic device for implementing the configuration method of the security policy rule of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "target", "candidate", "update", "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] Embodiment 1

[0037] Figure 1 The flowchart of a method for configuring security policy rules provided in the first embodiment of the present invention is applicable to the case where the system to be protected obtains target security policy rule data from a storage cluster to configure security policy rules. The method can be executed by a security policy rule configuration device, which is configured in the storage cluster and can be implemented in the form of hardware and / or software. A storage cluster refers to a cluster composed of storage nodes with data storage capabilities. For example, the storage cluster can be a nacos cluster, etc. Figure 1 As shown, the method includes:

[0038] S101. When the system to be protected is started, target security strategy rule data corresponding to the system to be protected is determined according to a rule data acquisition request sent by the system to be protected.

[0039] Among them, the system to be protected refers to a system with security requirements. The types of systems to be protected include but are not limited to any electronic devices such as application systems, servers, personal computers, and computing clusters. This embodiment does not limit the specific type of the system to be protected. The target security policy rule data is generated by the management cluster and sent to the storage cluster for storage. The security policy rule data refers to the parameter data required for configuring the security policy rules. The security policy rules are also security protection policy rules, which refer to the policy rules formulated to prevent the system from being in a risky state, such as being attacked by a network or having abnormal network traffic. For example, the security protection policy rules may include current limiting rules or fuse downgrade rules, etc. This embodiment does not limit the specific content of the security protection policy rules. It can be understood that the target security policy rule data refers to the parameter data required for configuring the security policy rules of the system to be protected.

[0040] In one embodiment, the management cluster generates target security policy rule data corresponding to the system to be protected, and calls the data storage interface corresponding to the storage cluster to send the target security policy rule data to the storage cluster. The data storage interface refers to an API interface for requesting the storage cluster to store data. The storage cluster obtains the target security policy rule data sent by the management cluster, and stores the target security policy rule data locally in the storage cluster.

[0041] Furthermore, when the system to be protected is started, including restarting or first startup, a rule data acquisition request is generated according to its corresponding candidate system identifier, and the rule data acquisition request is sent to the storage cluster through the data interface provided by the storage cluster SDK (Software Development Kit).

[0042] The storage cluster receives a rule data acquisition request sent by the system to be protected, and parses the rule data acquisition request to obtain a candidate system identifier corresponding to the system to be protected, and then determines the target security policy rule data corresponding to the system to be protected from all stored security policy rule data according to the candidate system identifier.

[0043] S102: Send the target security policy rule data to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0044] In one embodiment, the storage cluster sends the target security policy rule data to the system to be protected through a data interface. The system to be protected receives the target security policy rule data sent by the storage cluster, and configures the security policy rules accordingly according to the target security policy rule data, so that the system to be protected avoids risk states such as network attacks or network traffic anomalies based on the configured security policy rules.

[0045] The embodiment of the present invention stores the target security policy rule data corresponding to the system to be protected generated by the management cluster in the storage cluster, so that when the system to be protected is started, the target security policy rule data can be directly obtained from the storage cluster for automatic configuration of the security policy rules. There is no need for technical personnel to repeatedly configure the security policy rules in real time on the system side, which improves the efficiency of the system security policy rule configuration, shortens the dangerous period when the system is without security policy rules, and improves the security of the system.

[0046] Embodiment 2

[0047] Figure 2 This is a flowchart of a method for configuring security policy rules provided in the second embodiment of the present invention. This embodiment further optimizes and expands the above-mentioned first embodiment and can be combined with the above-mentioned optional implementation methods. Figure 2 As shown, the method includes:

[0048] S201. Obtain a data storage request sent by a management cluster, and parse the data storage request to obtain a candidate system identifier and target security policy rule data corresponding to the system to be protected.

[0049] The candidate system identifier refers to identification information that can uniquely represent the system to be protected, such as a system number or a system development version number, etc. This embodiment does not limit the specific type of the candidate system identifier.

[0050] In one embodiment, after the management cluster generates the target security policy rule data, it determines the candidate system identifier corresponding to the system to be protected, and generates a data storage request according to the candidate system identifier and the target security policy rule data. Further, the management cluster sends the data storage request to the storage cluster.

[0051] The storage cluster obtains the data storage request sent by the management cluster, and parses the data storage request to obtain the candidate system identifier and target security policy rule data carried in the data storage request.

[0052] S202: Associate and store the candidate system identifier and the target security policy rule data.

[0053] In one embodiment, the storage cluster stores the candidate system identifier and the target security policy rule data locally in the form of associated storage. Optionally, the storage cluster stores the candidate system identifier and the target security policy rule data locally in the form of Key-Value storage, wherein the candidate system identifier is used as the Key value, the target security policy rule data is used as the Value value, and the Key value and the Value value are used to form a Key-Value key-value pair.

[0054] By obtaining the data storage request sent by the management cluster and parsing the data storage request, the candidate system identification and target security policy rule data corresponding to the system to be protected are obtained; the candidate system identification and the target security policy rule data are associated and stored, so that the security policy rule data in the storage cluster is stored in association with the system identification, which is beneficial for directly determining the associated security policy rule data according to the system identification during the rule data issuance stage, ensuring the compatibility between the issued security policy rule data and the system, and further ensuring the accuracy and reliability of the security policy rule configuration.

[0055] S203: When the system to be protected is started, determine the candidate system identifier corresponding to the system to be protected according to the rule data acquisition request sent by the system to be protected.

[0056] In one embodiment, when the system to be protected is started, it generates a rule data acquisition request carrying a candidate system identifier according to its corresponding candidate system identifier, and sends the rule data acquisition request to the storage cluster through a data interface provided by the storage cluster SDK.

[0057] The storage cluster receives the rule data acquisition request sent by the system to be protected, and parses the rule data acquisition request to obtain the candidate system identifier carried therein.

[0058] S204: Determine the security policy rule data corresponding to the candidate system identifier as the target security policy rule data according to the candidate system identifier and the association relationship between the system identifier and the security policy rule data.

[0059] Among them, since the security policy rule data is stored in association with the corresponding system identifier in the storage cluster, an association relationship between the system identifier and the security policy rule data is maintained in the storage cluster, and the security policy rule data associated with any system identifier can be directly determined by using this association relationship.

[0060] In one embodiment, the storage cluster matches the candidate system identifier corresponding to the system to be protected with the association relationship between the maintained system identifier and the security policy rule data, determines the system identifier that is the same as the candidate system identifier in the association relationship as the target system identifier, and then determines the security policy rule data associated with the target system identifier as the target security policy rule data based on the association relationship.

[0061] For example, assuming that the candidate system identifier is "abcd", the system identifier "abcd" in the association relationship is used as the target system identifier. Assuming that the security policy rule data associated with the system identifier "abcd" in the association relationship is "rule data A", "rule data A" is used as the target security policy rule data corresponding to the system to be protected.

[0062] By determining the candidate system identifier corresponding to the system to be protected according to the rule data acquisition request; determining the security policy rule data corresponding to the candidate system identifier as the target security policy rule data according to the candidate system identifier and the association between the system identifier and the security policy rule data, the compatibility between the target security policy rule data and the system to be protected can be guaranteed, further ensuring the accuracy and reliability of the security policy rule configuration in the system to be protected.

[0063] S205: Send the target security policy rule data to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0064] Optionally, also include:

[0065] A1. When the target security policy rule data is updated, the updated target security policy rule data is used as the updated security policy rule data.

[0066] In one embodiment, the system to be protected creates a data listener through the SDK of the storage cluster, and the storage cluster monitors the data update events of the target security policy rule data in real time through the created data listener. When the target security policy rule data is updated, the updated target security policy rule data is used as the updated security policy rule data.

[0067] B1. Determine the system identifier associated with the updated security policy rule data as the candidate system identifier corresponding to the system to be protected, and send the updated security policy rule data to the system to be protected according to the candidate system identifier, so that the system to be protected configures security policy rules according to the updated security policy rule data.

[0068] In one embodiment, the storage cluster determines the system identifier associated with the updated security policy rule data according to the association relationship between the system identifier and the security policy rule data, as the candidate system identifier corresponding to the system to be protected. Further, the storage cluster determines the system to be protected corresponding to the updated security policy rule data from all candidate systems according to the candidate system identifier, and then sends the updated security policy rule data to the system to be protected, so that the system to be protected configures the security policy rules according to the updated security policy rule data.

[0069] By using the updated target security policy rule data as the updated security policy rule data when the target security policy rule data is updated; determining the system identifier associated with the updated security policy rule data as the candidate system identifier corresponding to the system to be protected, and sending the updated security policy rule data to the system to be protected according to the candidate system identifier, so that the system to be protected configures the security policy rules according to the updated security policy rule data, the storage cluster actively sends the updated security policy rule data to the system to be protected when the target security policy rule data is updated, thereby ensuring the timeliness of the update of the security policy rule data in the system to be protected, further ensuring the timeliness of the update of the security policy rules in the system to be protected, and improving the security of the system.

[0070] Embodiment 3

[0071] Figure 3 The flowchart of a method for configuring security policy rules provided in the third embodiment of the present invention is applicable to the situation where the management cluster stores target security policy rule data in the storage cluster for the security policy rule configuration of the system to be protected. The method can be executed by a security policy rule configuration device, which is configured in the management cluster and can be implemented in the form of hardware and / or software. A management cluster refers to a cluster composed of management nodes with data management capabilities. For example, the management cluster can be a sentinel cluster, etc. Figure 3 As shown, the method includes:

[0072] S301. Generate target security strategy rule data corresponding to the system to be protected.

[0073] The system to be protected refers to a system with security requirements. The types of the system to be protected include but are not limited to any electronic devices such as application systems, servers, personal computers, and computing clusters. This embodiment does not limit the specific types of the system to be protected. The target security policy rule data refers to the parameter data required for configuring the security policy rules of the system to be protected.

[0074] In one implementation, all candidate systems send registration requests to the management cluster based on their own system identifiers, and the management cluster parses the system identifiers of each candidate system for registration based on the registration requests sent by each candidate system. After registration is completed, each candidate system periodically reports heartbeat information to the management cluster to maintain the communication connection with the management cluster.

[0075] The management cluster determines the system to be protected in response to the system identifier sent by the technician through the data editing interface, and generates target security strategy rule data corresponding to the system to be protected according to the rule data editing operation performed by the technician through the data editing interface.

[0076] S302: Send the target security policy rule data to the storage cluster, so that the storage cluster stores the target security policy rule data.

[0077] The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures the security policy rules according to the target security policy rule data.

[0078] In one embodiment, the management cluster calls the data storage interface corresponding to the storage cluster to send the target security policy rule data to the storage cluster. When the system to be protected is started, it generates a rule data acquisition request according to its corresponding candidate system identifier, and sends the rule data acquisition request to the storage cluster through the data interface provided by the storage cluster SDK. The storage cluster receives the rule data acquisition request sent by the system to be protected, and parses the candidate system identifier corresponding to the system to be protected from the rule data acquisition request, and then determines the target security policy rule data corresponding to the system to be protected from all the stored security policy rule data according to the candidate system identifier. The storage cluster sends the target security policy rule data to the system to be protected through the data interface. The system to be protected parses the target security policy rule data into rule data in an executable format for the system to be protected through the SDK, and loads it into the context of the system to be protected to complete the configuration of the security policy rules.

[0079] The embodiment of the present invention stores the target security policy rule data corresponding to the system to be protected generated by the management cluster in the storage cluster, so that when the system to be protected is started, the target security policy rule data can be directly obtained from the storage cluster for automatic configuration of the security policy rules. There is no need for technical personnel to repeatedly configure the security policy rules in real time on the system side, which improves the efficiency of the system security policy rule configuration, shortens the dangerous period when the system is without security policy rules, and improves the security of the system.

[0080] Optionally, also include:

[0081] A2. In response to a user's data modification request, determine a first system identifier of a system corresponding to the security policy rule data to be modified, and data content to be modified of the security policy rule data to be modified.

[0082] The user includes but is not limited to a technician. The security policy rule data to be modified refers to the security policy rule data to be modified in the storage cluster, and the data content to be modified refers to the specific data content to be modified in the security policy rule data to be modified.

[0083] In one implementation, the management cluster parses the data modification request initiated by the user, and determines the first system identifier carried in the data modification request, and the data content to be modified of the security policy rule data to be modified.

[0084] B2. Determine the security policy rule data to be modified according to the first system identifier through the data modification interface of the storage cluster, and modify the security policy rule data to be modified according to the content of the data to be modified.

[0085] In one implementation, the management cluster determines the security policy rule data to be modified from the security policy rule data stored in the storage cluster according to the first system identifier through the data modification interface of the storage cluster, and further modifies the security policy rule data to be modified according to the content of the data to be modified.

[0086] By responding to the user's data modification request, the first system identifier of the system corresponding to the security policy rule data to be modified and the data content to be modified of the security policy rule data to be modified are determined; the security policy rule data to be modified is determined according to the first system identifier through the data modification interface of the storage cluster, and the security policy rule data to be modified is modified according to the data content to be modified, thereby achieving the effect that the security policy rule data stored in the storage cluster can be modified in real time, meeting the user's business needs for security policy rule data modification and ensuring user experience.

[0087] Optionally, also include:

[0088] A3. In response to the user's data query request, determine the second system identifier of the system corresponding to the security policy rule data to be queried.

[0089] In one implementation, the management cluster parses the data query request initiated by the user and determines the second system identifier carried in the data query request.

[0090] B3. Obtain the security policy rule data to be queried according to the second system identifier through the data query interface of the storage cluster, and display the security policy rule data to be queried to the user.

[0091] In one embodiment, the management cluster determines the security policy rule data to be queried from the security policy rule data stored in the storage cluster according to the second system identifier through the data query interface of the storage cluster, further obtains the security policy rule data to be queried from the storage cluster, and then displays the security policy rule data to be queried to the user, for example, by displaying the security policy rule data to be queried in the form of a page.

[0092] By responding to the user's data query request, the second system identifier of the system corresponding to the security policy rule data to be queried is determined; the security policy rule data to be queried is obtained according to the second system identifier through the data query interface of the storage cluster, and the security policy rule data to be queried is displayed to the user, thereby achieving the effect of real-time query of the security policy rule data stored in the storage cluster, meeting the user's business needs for security policy rule data query, and ensuring user experience.

[0093] Optionally, also include:

[0094] A4. Obtain the security policy rule data corresponding to the system to be verified stored in the storage cluster as the first security policy rule data, and obtain the security policy rule data stored in the system to be verified as the second security policy rule data.

[0095] In one implementation, the management cluster obtains the security policy rule data corresponding to the system to be verified stored in the storage cluster as the first security policy rule data through the data query interface of the storage cluster. In addition, the management cluster obtains the security policy rule data stored in the system to be verified from the system to be verified as the second security policy rule data through the data query interface of the system to be verified.

[0096] B4. Compare the first security policy rule data with the second security policy rule data, and generate alarm information if the first security policy rule data and the second security policy rule data are different.

[0097] The alarm information is used to prompt the technical personnel to manually update the second security strategy rule data.

[0098] In one embodiment, the management cluster compares the first security policy rule data and the second security policy rule data. If it is determined that the first security policy rule data and the second security policy rule data are the same, it means that the system to be protected has stored the same security policy rule data as those in the storage cluster, and no operation is required at this time; if it is determined that the first security policy rule data and the second security policy rule data are different, it means that the system to be protected has not yet stored the same security policy rule data as those in the storage cluster. For example, due to network reasons, the system to be protected cannot obtain the target security policy rule data from the storage cluster, etc., and manual intervention is required at this time. Therefore, if it is determined that the first security policy rule data and the second security policy rule data are different, the management cluster generates an alarm message accordingly to prompt the technician to manually update the security policy rule data (second security policy rule data) stored in the system to be protected.

[0099] By obtaining the security policy rule data corresponding to the system to be verified from the storage cluster as the first security policy rule data, and obtaining the stored security policy rule data from the system to be verified as the second security policy rule data; comparing the first security policy rule data and the second security policy rule data, and generating an alarm message when the first security policy rule data and the second security policy rule data are different, the effect of determining whether the rule data stored between the storage cluster and the system to be protected are consistent is achieved. This is beneficial for prompting technical personnel to update the security policy rule data stored in the system to be protected in a timely manner when the stored rule data are inconsistent, thereby ensuring the security of the system to be protected.

[0100] Embodiment 4

[0101] Figure 4 This is a schematic diagram of the structure of a security policy rule configuration device provided in the fourth embodiment of the present invention, and the device is configured in a storage cluster. Figure 4 As shown, the device comprises:

[0102] The security policy rule data determination module 41 is used to determine the target security policy rule data corresponding to the system to be protected according to the rule data acquisition request sent by the system to be protected when the system to be protected is started; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage;

[0103] The security policy rule data sending module 42 is used to send the target security policy rule data to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0104] Optionally, the security strategy rule data determination module 41 is specifically used to:

[0105] Determine the candidate system identifier corresponding to the system to be protected according to the rule data acquisition request;

[0106] According to the candidate system identifier and the association relationship between the system identifier and the security policy rule data, the security policy rule data corresponding to the candidate system identifier is determined as the target security policy rule data.

[0107] Optionally, the device further includes an associated storage module, specifically configured to:

[0108] Obtaining a data storage request sent by the management cluster, and parsing the data storage request to obtain a candidate system identifier corresponding to the system to be protected and the target security policy rule data;

[0109] The candidate system identifier and the target security policy rule data are associated and stored.

[0110] Optionally, the device further includes a rule data sending module, which is specifically used to:

[0111] When the target security policy rule data is updated, the updated target security policy rule data is used as the updated security policy rule data;

[0112] Determine the system identifier associated with the updated security policy rule data as a candidate system identifier corresponding to the system to be protected, and send the updated security policy rule data to the system to be protected according to the candidate system identifier, so that the system to be protected configures security policy rules according to the updated security policy rule data.

[0113] The security policy rule configuration device provided in the fourth embodiment of the present invention can execute the security policy rule configuration method provided in the first and second embodiments of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0114] Embodiment 5

[0115] Figure 5 This is a schematic diagram of the structure of a security policy rule configuration device provided in Embodiment 5 of the present invention, and the device is configured in a management cluster. Figure 5 As shown, the device comprises:

[0116] The security strategy rule data generation module 51 is used to generate target security strategy rule data corresponding to the system to be protected;

[0117] A security policy rule data storage module 52, used for sending the target security policy rule data to a storage cluster so that the storage cluster stores the target security policy rule data;

[0118] The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures security policy rules according to the target security policy rule data.

[0119] Optionally, the device further includes a data modification module, specifically configured to:

[0120] In response to a user's data modification request, determining a first system identifier of a system corresponding to the security policy rule data to be modified, and data content to be modified of the security policy rule data to be modified;

[0121] The security policy rule data to be modified is determined according to the first system identifier through the data modification interface of the storage cluster, and the security policy rule data to be modified is modified according to the content of the data to be modified.

[0122] Optionally, the device further includes a data query module, specifically configured to:

[0123] In response to a data query request from a user, determining a second system identifier of a system corresponding to the security policy rule data to be queried;

[0124] The security policy rule data to be queried is acquired according to the second system identifier through the data query interface of the storage cluster, and the security policy rule data to be queried is displayed to the user.

[0125] Optionally, the device further comprises an alarm module, which is specifically used for:

[0126] Acquire the security policy rule data corresponding to the system to be verified stored in the storage cluster as the first security policy rule data, and acquire the security policy rule data stored in the system to be verified as the second security policy rule data;

[0127] The first security policy rule data and the second security policy rule data are compared, and when the first security policy rule data and the second security policy rule data are different, an alarm message is generated; wherein the alarm message is used to prompt a technician to manually update the second security policy rule data.

[0128] The security policy rule configuration device provided in the fifth embodiment of the present invention can execute the security policy rule configuration method provided in the third embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0129] Embodiment 6

[0130] Figure 6 A schematic diagram of an electronic device 60 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0131] like Figure 6As shown, the electronic device 60 includes at least one processor 61, and a memory connected to the at least one processor 61 in communication, such as a read-only memory (ROM) 62, a random access memory (RAM) 63, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 61 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 62 or the computer program loaded from the storage unit 68 to the random access memory (RAM) 63. In the RAM 63, various programs and data required for the operation of the electronic device 60 can also be stored. The processor 61, the ROM 62, and the RAM 63 are connected to each other via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0132] A number of components in the electronic device 60 are connected to the I / O interface 65, including: an input unit 66, such as a keyboard, a mouse, etc.; an output unit 67, such as various types of displays, speakers, etc.; a storage unit 68, such as a disk, an optical disk, etc.; and a communication unit 69, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 69 allows the electronic device 60 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0133] The processor 61 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 61 executes the various methods and processes described above, such as the configuration method of the security policy rules.

[0134] In some embodiments, the configuration method of security policy rules may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 60 via the ROM 62 and / or the communication unit 69. When the computer program is loaded into the RAM 63 and executed by the processor 61, one or more steps of the configuration method of security policy rules described above may be performed. Alternatively, in other embodiments, the processor 61 may be configured to execute the configuration method of security policy rules in any other appropriate manner (e.g., by means of firmware).

[0135] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0136] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0137] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0139] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0140] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0141] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0142] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for configuring security policy rules, characterized in that: Executed by the storage cluster, including: When the system to be protected is started, according to the rule data acquisition request sent by the system to be protected, the target security policy rule data corresponding to the system to be protected is determined; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage; The target security policy rule data is sent to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

2. The method according to claim 1, characterized in that The step of determining target security strategy rule data corresponding to the system to be protected according to the rule data acquisition request sent by the system to be protected includes: Determine the candidate system identifier corresponding to the system to be protected according to the rule data acquisition request; According to the candidate system identifier and the association relationship between the system identifier and the security policy rule data, the security policy rule data corresponding to the candidate system identifier is determined as the target security policy rule data.

3. The method according to claim 1, wherein when the system to be protected is started, before determining the target security strategy rule data corresponding to the system to be protected according to the rule data acquisition request sent by the system to be protected, the method further comprises: Obtaining a data storage request sent by the management cluster, and parsing the data storage request to obtain a candidate system identifier corresponding to the system to be protected and the target security policy rule data; The candidate system identifier and the target security policy rule data are associated and stored.

4. The method according to claim 1, further comprising: When the target security policy rule data is updated, the updated target security policy rule data is used as the updated security policy rule data; Determine the system identifier associated with the updated security policy rule data as a candidate system identifier corresponding to the system to be protected, and send the updated security policy rule data to the system to be protected according to the candidate system identifier, so that the system to be protected configures security policy rules according to the updated security policy rule data.

5. A method for configuring security policy rules, characterized in that: Executed by the management cluster, including: Generate target security strategy rule data corresponding to the system to be protected; Sending the target security policy rule data to a storage cluster so that the storage cluster stores the target security policy rule data; The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures security policy rules according to the target security policy rule data.

6. The method according to claim 5, further comprising: In response to a user's data modification request, determining a first system identifier of a system corresponding to the security policy rule data to be modified, and data content to be modified of the security policy rule data to be modified; The security policy rule data to be modified is determined according to the first system identifier through the data modification interface of the storage cluster, and the security policy rule data to be modified is modified according to the content of the data to be modified.

7. The method according to claim 5, further comprising: In response to a data query request from a user, determining a second system identifier of a system corresponding to the security policy rule data to be queried; The security policy rule data to be queried is acquired according to the second system identifier through the data query interface of the storage cluster, and the security policy rule data to be queried is displayed to the user.

8. The method according to claim 5, further comprising: Acquire the security policy rule data corresponding to the system to be verified stored in the storage cluster as the first security policy rule data, and acquire the security policy rule data stored in the system to be verified as the second security policy rule data; The first security policy rule data and the second security policy rule data are compared, and when the first security policy rule data and the second security policy rule data are different, an alarm message is generated; wherein the alarm message is used to prompt a technician to manually update the second security policy rule data.

9. A security strategy rule configuration device, characterized in that: Configured in the storage cluster, including: A security policy rule data determination module, used to determine target security policy rule data corresponding to the system to be protected according to a rule data acquisition request sent by the system to be protected when the system to be protected is started; wherein the target security policy rule data is generated by the management cluster and sent to the storage cluster for storage; The security policy rule data sending module is used to send the target security policy rule data to the system to be protected, so that the system to be protected configures security policy rules according to the target security policy rule data.

10. A security strategy rule configuration device, characterized in that: Configuration in the management cluster, including: A security strategy rule data generation module is used to generate target security strategy rule data corresponding to the system to be protected; A security policy rule data storage module, used for sending the target security policy rule data to a storage cluster so that the storage cluster stores the target security policy rule data; The target security policy rule data is used to be sent by the storage cluster to the system to be protected when the system to be protected is started, so that the system to be protected configures security policy rules according to the target security policy rule data.

11. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for configuring security policy rules described in any one of claims 1-4 and / or 5-8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method for configuring security policy rules according to any one of claims 1-4 and / or 5-8.

13. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method for configuring security policy rules according to any one of claims 1-4 and / or 5-8.

Images