Host security policy configuration method and device, electronic equipment and program product

Abstract

A security policy configuration method and apparatus for a host, an electronic device and a program product, the method comprising: displaying a host management page in response to a trigger operation on the host management page, the host management page displaying a plurality of levels of groups for grouping management of hosts; in response to deletion operation for a first group in the multi-level group, at least one first host included in the first group is moved into a preset group of the same level, a security policy corresponding to the at least one first host is changed into a security policy corresponding to the preset group, the first group is deleted, and the preset group is used for recording ungrouped hosts. Therefore, the multi-level grouping management of the security policy of the host can be realized, and the ungrouped hosts are managed through the preset grouping, so that the multi-level grouping can be flexibly adjusted according to requirements, the security policy of the host is more conveniently configured, and the security of the host is protected.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a host security policy configuration method, device, electronic device and program product. Background Art

[0002] Host security products are products that protect host security by installing security agents. Security agents need to receive security policies issued by the console in order to effectively protect hosts. Since users' hosts are usually related to their business architecture and are often adjusted, it is necessary to manage a group of hosts that require the same security policy by grouping.

[0003] In the related art, the security policy of the host is usually configured based on the first-level grouping or based on the static multi-level grouping. The former is not suitable for the scenario with a large number of hosts, and the latter is not suitable for the scenario with frequent host adjustments, and the security policy of the host cannot be configured conveniently. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a method for configuring a security policy of a host, the method comprising: In response to a trigger operation on a host management page, displaying the host management page, wherein the host management page displays multiple levels of groups for grouping hosts; In response to a deletion operation on the first group in the multi-level grouping, at least one first host included in the first group is moved into a preset group at the same level, the security policy corresponding to the at least one first host is changed to the security policy corresponding to the preset group, and the first group is deleted, wherein the preset group is used to record ungrouped hosts.

[0006] In a second aspect, the present disclosure provides a security policy configuration device for a host, the device comprising: A display module, configured to display the host management page in response to a trigger operation on the host management page, wherein the host management page displays multiple levels of groups for grouping the hosts; A deletion module is used to respond to a deletion operation on a first group in the multi-level grouping, move at least one first host included in the first group into a preset group at the same level, change the security policy corresponding to the at least one first host to the security policy corresponding to the preset group, and delete the first group, wherein the preset group is used to record ungrouped hosts.

[0007] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of the method described in the first aspect when the program is executed by a processing device.

[0008] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method in the first aspect.

[0009] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which implements the steps of the method described in the first aspect when executed by a processor.

[0010] Through the above technical solution, first responding to the triggering operation on the host management page, the host management page is displayed, and then responding to the deletion operation of the first group in the multi-level grouping, at least one first host included in the first group can be moved into a preset group of the same level, and the security policy corresponding to the at least one first host is changed to the security policy corresponding to the preset group, and the first group is deleted. Among them, the host management page displays multi-level groups for grouping hosts, so that multi-level group management of host security policies can be achieved, and ungrouped hosts can be managed through preset groups, so that the multi-level groups can be flexibly adjusted according to needs, and the host security policy can be configured more conveniently to protect the host security.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 It is a flowchart of a method for configuring a security policy of a host according to an exemplary embodiment of the present disclosure; Figure 2 is a schematic diagram of a host management page according to an exemplary embodiment of the present disclosure; Figure 3 is a schematic diagram showing a newly added sub-grouping page according to an exemplary embodiment of the present disclosure; Figure 4 is a schematic diagram of a process of moving a host according to an exemplary embodiment of the present disclosure; Figure 5 is a schematic diagram of an installation configuration page according to an exemplary embodiment of the present disclosure; Figure 6 is a schematic diagram of a policy configuration page according to an exemplary embodiment of the present disclosure; Figure 7 is a schematic diagram showing a display of an effective range according to an exemplary embodiment of the present disclosure; Figure 8 is a structural block diagram of a security policy configuration device for a host according to an exemplary embodiment of the present disclosure; Fig. 9 It is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0013] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0014] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0015] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0016] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0020] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0021] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0022] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0023] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0024] In the related art, the security policy of the host is generally managed based on the first-level grouping, but it is not applicable to the scenario of a large number of hosts. Alternatively, the security policy of the host is managed based on static multi-level grouping, but since the user's host will be frequently adjusted with the business architecture, for example, when a group needs to be deleted, if the group includes a host, the group needs to be cleared before it can be deleted. The operation is relatively complex and the security policy of the host cannot be configured conveniently.

[0025] In view of this, the present disclosure provides a host security policy configuration method, device, electronic device and program product to solve the above technical problems.

[0026] The embodiments of the present disclosure are further explained below with reference to the accompanying drawings.

[0027] Figure 1is a flowchart of a method for configuring a host security policy according to an exemplary embodiment of the present disclosure, referring to Figure 1 , the method may include the following steps: S101: In response to a triggering operation on a host management page, the host management page is displayed, and the host management page displays multiple levels of groups for grouping management of hosts.

[0028] The host may be a physical device such as a server or a computer, or a virtual device such as a container or a virtual machine, and the present disclosure does not limit this.

[0029] In a possible manner, the multi-level grouping is a multi-level tree structure, wherein only the sub-groups corresponding to the leaf nodes in the multi-level tree structure are used to record the hosts, and the number of hosts in the parent group corresponding to the parent node in the multi-level tree structure is the sum of the number of hosts included in the sub-groups corresponding to all leaf nodes under the parent node.

[0030] For example, Figure 2 As shown, the host management page displays multi-level grouping, which can be a multi-level tree structure, can be a three-level grouping, a four-level grouping, etc., which can be set according to needs, and the present disclosure does not limit this. By triggering the multi-level grouping, the host mounted by the corresponding group can be displayed on the host management page, such as Figure 2 All hosts are displayed. You can click to filter and view all groups. If the selected group has sub-groups, you can also filter and view the hosts mounted to the sub-groups. This disclosure does not limit this.

[0031] It is worth noting that, assuming that the parent group has a host mounted, and the child group of the parent group has a host mounted, then setting a security policy for the host mounted by the parent group will affect the host mounted under the child group of the parent group. Therefore, in order to achieve group management of the host's security policy, it can be set that the parent group corresponding to the parent node cannot mount the host, but the group corresponding to the leaf node without a child group mounts the host. The specific setting can be based on demand, and this disclosure does not limit this.

[0032] For example, the number of hosts mounted in each group may also be displayed in the multi-level grouping, and the number of hosts included in the parent group corresponding to the parent node is equal to the total number of hosts mounted in the child groups corresponding to all leaf nodes under the parent group.

[0033] S102: In response to a deletion operation on a first group in a multi-level grouping, at least one first host included in the first group is moved into a preset group of the same level, a security policy corresponding to the at least one first host is changed to a security policy corresponding to the preset group, and the first group is deleted, wherein the preset group is used to record ungrouped hosts.

[0034] For example, Figure 2As shown, assuming that group 1 includes host 1 and host 2, if group 1 is deleted, host 1 and host 2 are moved to the preset group at the same level as group 1, that is, the "ungrouped" subgroup under the secondary group A, and the security policy of host 1 and host 2 moved to the "ungrouped" subgroup is changed from the original security policy to the security policy configured for the "ungrouped" subgroup. It should be noted that if the "ungrouped" subgroup is not configured with a security policy, host 1 and host 2 are also changed to no security policy. In this way, multi-level grouping can be flexibly adjusted according to needs, for example, a group can be deleted when a host is mounted on the group.

[0035] In a possible manner, moving at least one first host included in the first group into a preset group at the same level includes: if there is a second group at the same level as the first group, moving at least one first host included in the first group into a preset group at the same level, wherein the second group does not include the preset group. The method also includes: if there is no second group, moving at least one first host into a parent group of the first group, changing the security policy of the first host to the security policy corresponding to the parent group, and deleting the first group.

[0036] For example, continue to refer to Figure 2 , assuming that there is only one third-level group 1 under the second-level group A, in this case, delete the third-level group 1, and directly mount host 1 and host 2 under the second-level group A, that is, the second-level group A changes from a parent group to a leaf group. Correspondingly, if there is only the third-level group 1 and the "ungrouped" subgroup under the second-level group A, the "ungrouped" subgroup can also be deleted synchronously, and the hosts in the "ungrouped" subgroup as well as host 1 and host 2 can be mounted together under the second-level group A.

[0037] That is to say, all "ungrouped" sub-groups cannot exist in isolation, and need to coexist with other sub-groups of the same level. This is because when the parent group becomes a leaf group, convenient host group management can also be achieved, so there is no need to add or retain "ungrouped" sub-groups, avoiding redundant sub-groups in multi-level groups.

[0038] In a possible manner, the method further comprises: in response to a removal operation on all hosts included in the preset group, deleting the preset group.

[0039] For example, after all hosts in the "ungrouped" subgroup are removed, that is, the "ungrouped" subgroup is an empty group, the "ungrouped" subgroup can be deleted. The specific setting can be based on the needs, and the present disclosure does not limit this. Thus, redundant subgroups can be avoided in multi-level grouping.

[0040] In a possible manner, moving at least one first host included in the first group into a preset group at the same level includes: if there is no preset group at the same level as the first group, adding a preset group and moving at least one first host included in the first group into the preset group.

[0041] For example, continue to refer to Figure 2 , assuming that there is no "ungrouped" subgroup at the same level as the third-level group 1 under the second-level group A, you can first add the "ungrouped" subgroup, and then mount host 1 and host 2 to the "ungrouped" subgroup. In this way, the "ungrouped" subgroup can be automatically created, and the dynamic management of multi-level groups can be realized, which reduces the complexity of user operations and improves the adjustment efficiency of multi-level groups.

[0042] That is to say, the preset group can be set to be controlled by the system, and the user cannot edit, delete, create sub-groups, etc. on this group. The specific settings can be made according to needs, and the present disclosure does not impose any restrictions on this.

[0043] By using the above method, the host management page displays multi-level groups for grouping hosts, thereby realizing multi-level group management of host security policies, and managing ungrouped hosts through preset groups, so that multi-level groups can be flexibly adjusted according to needs, and the host's security policy can be configured more conveniently to protect the host's security.

[0044] In a possible manner, the method also includes: in response to a new subgrouping operation on the fourth group in the multi-level grouping, displaying a new subgrouping page, the new subgrouping page is used to create a subgroup; in response to an editing operation on the new subgrouping page, determining the subgroup name corresponding to the editing operation; in the case that there are no other subgroups with the same subgroup name in the fourth group, generating a target subgroup corresponding to the subgroup name; in the case that there are other subgroups with the same subgroup name in the fourth group, prompting the existence of a subgroup with the same name.

[0045] For example, continue to refer to Figure 2 , you can set the control of adding a sub-group on the host management page, or you can display the control of adding a sub-group in the pop-up window triggered by right-clicking or hovering the mouse in the multi-level group. This disclosure does not limit this. Assume that a sub-group is added to the secondary group A, and the following is displayed: Figure 3 The New Sub-Grouping page is shown.

[0046] For example, the new sub-group page can display the path of the current parent group, an input box for the name of the sub-group to be added, the optional range of hosts for the new sub-group, and the selected range of hosts, etc. Among them, the optional range of hosts can display all hosts. If the selected host already has other groups, a prompt can be given that the host already has other groups. After the user confirms, the host will be moved into the currently added group and the host in other groups will be deleted.

[0047] For example, duplicate name judgment can also be performed, that is, all sub-group names under the same parent group cannot be repeated, and sub-group names under different parent groups can be repeated, that is, the complete path of the group cannot be repeated. If the sub-group name is repeated, a prompt message can be displayed to prompt the user that the current group has a sub-group with the same name. If there is no sub-group with the same name, the sub-group is created successfully. In this way, new groups can be added flexibly according to needs to realize multi-level group management of hosts.

[0048] It should be noted that an empty subgroup may also be added, that is, the host range may not be selected. In addition, an edit operation may also be performed on an existing group, such as editing the "subgroup name", "host range", etc., which is not limited in the present disclosure.

[0049] In a possible manner, the method also includes: after generating a target subgroup corresponding to the subgroup name, when there are no other subgroups in the fourth group and the fourth group includes at least one third host, adding a preset group at the same level as the target subgroup under the fourth group, and moving at least one third host into the preset group at the same level as the target subgroup.

[0050] For example, continue to refer to Figure 2 , the third-level group 1 was originally a leaf group of the multi-level group, including host 1 and host 2. Assume that a fourth-level group Y is added under the third-level group 1, and the third-level group 1 is changed from a leaf group to a parent group. Since the parent group cannot mount the host, host 1 and host 2 can be moved to the preset group under the third-level group 1, that is, the preset group at the same level as the newly added fourth-level group Y. If there is no preset group under the third-level group 1, a preset group can be automatically created, such as a sub-group named "Ungrouped", and host 1 and host 2 can be automatically moved to the "Ungrouped" sub-group, so as to group and manage the hosts originally mounted by the parent group.

[0051] In a possible manner, the method also includes: in response to a move operation of the second host in the third group of the multi-level grouping, displaying a radio button list corresponding to the multi-level grouping, a radio button in the radio button list corresponding to a group in the multi-level grouping that does not include sub-groups; in response to a selection operation of a target radio button in the radio button list, moving the second host into the group corresponding to the target radio button.

[0052] For example, Figure 4 As shown, one or more hosts can be selected for move operation. Multiple hosts can be hosts in the same group or hosts in different groups, and the present disclosure does not limit this. Then the radio option list corresponding to the multi-level grouping is displayed, which can be displayed in the form of a pop-up window, and the present disclosure does not limit this. It should be noted that in order to avoid moving the host into the parent group, the selection control can be not displayed in front of the parent group. The specific setting can be based on the needs, and the present disclosure does not limit this.

[0053] It should be understood that if the host to be moved is already in another group, a corresponding prompt can be given and the host can be moved to a new group after the user confirms.

[0054] In a possible manner, at least one first host included in the first group is configured in the following manner: in response to an installation configuration operation on the first host, an installation configuration page is displayed, and the installation configuration page is used to group the hosts; in response to the group configuration operation on the first host in the installation configuration page, a target group path corresponding to the group configuration operation is determined; when the grouping of the target group path represents the first group, the first host is moved into the first group.

[0055] For example, you can group hosts in the installation configuration page, such as Figure 5 As shown, assuming that group 1 is selected, host 1 is mounted to group 1. Each host can be set when the host is installed, or it can be set when the host group is modified later, and the present disclosure does not limit this. In addition, a default group can also be set, that is, when the host is installed, it is mounted to the default group by default, so that when installing the host, it is not necessary to set each host, simplifying user operations and improving host installation efficiency.

[0056] In a possible manner, the method further includes: when the group represented by the target group path does not exist, searching for a target parent group existing in the target group path, and moving at least one first host into the target parent group or a preset group below the target parent group.

[0057] For example, if the set group does not exist, or originally existed but was subsequently deleted, taking the setting group path as "first-level group / second-level group / third-level group" as an example, if the third-level group does not exist, then search for the second-level group, if the second-level group exists, then determine whether the second-level group has a sub-group, if there is a sub-group, then mount the host to the "ungrouped" sub-group under the second-level group, if there is no sub-group, then directly mount the host to the second-level group. Similarly, if the second-level group does not exist, then continue to search for the first-level group upwards, and the present disclosure will not repeat it here.

[0058] In a possible manner, the security policy corresponding to at least one first host included in the first group is configured in the following manner: in response to a trigger operation on a policy configuration page, the policy configuration page is displayed, and the policy configuration page displays all configured security policies; in response to a range configuration operation for a target security policy among all security policies, a range configuration page is displayed, and the range configuration page is used to configure the effective scope of the target security policy; in response to a range selection operation for the first group, the target security policy is determined to be the security policy corresponding to at least one first host included in the first group.

[0059] For example, Figure 6 As shown, the policy configuration page displays all configured security policies. If a range is configured for one of the security policies, the corresponding range configuration page is displayed. The first group can be selected as the effective range of the security policy. Relatively speaking, the security policy of the first group is configured as this security policy.

[0060] It should be noted that you can specify the global scope as the effective scope of the security policy, that is, the security policy is effective for all hosts, you can specify the group as the effective scope of the security policy, and you can also specify the host as the effective scope of the security policy. If there is a scope conflict in the security policy of the host, for example, group 1 is configured with security policy 1, and host 1 in group 1 is configured with security policy 2, then other hosts in group 1 except host 1 use security policy 1, and host 1 uses security policy 2. It can be set specifically according to needs, and this disclosure does not limit this.

[0061] In a possible manner, the effective range includes a designated group range for configuring a security policy for a host of a designated group. In response to a selection operation on a first group, determining a target security policy as a security policy corresponding to at least one first host included in the first group includes: in response to a selection operation on a designated group range, displaying a multi-level option corresponding to the multi-level group one by one; in response to a selection operation on a target option corresponding to the first group in the multi-level option, determining the target security policy as a security policy corresponding to at least one first host included in the first group.

[0062] For example, Figure 6 As shown in the figure, after selecting the specified group range, multiple options corresponding to the multi-level groups are displayed, and one or more groups can be selected. Thus, the effective range of the security policy can be set, and the security policy of the selected group is configured as the security policy. Similarly, after selecting the specified host range, multiple options corresponding to all hosts are displayed, and one or more hosts can be selected.

[0063] For example, the first group may be selected as the effective scope of the security policy, and accordingly, the security policy of the first group is configured as the security policy.

[0064] For example, after selecting a group, the host to which the group is mounted can be displayed on the page, and a search function can be provided, which is not limited by the present disclosure.

[0065] In a possible manner, in response to a selection operation on a target option corresponding to a first group in a multi-level option, a target security policy is determined as a security policy corresponding to at least one first host included in the first group, including: in response to a selection operation on a target option corresponding to a first group in a multi-level option, a first effective option and a second effective option are displayed, the second effective option is used to control the target security policy to take effect on the hosts currently included in the first group, and the second effective option is used to control the target security policy to take effect on the hosts currently included in the first group and the hosts subsequently added to the first group; in response to a selection operation on the first effective option, the target security policy is determined as a security policy corresponding to at least one first host currently included in the first group; in response to a selection operation on the second effective option, the target security policy is determined as a security policy corresponding to at least one first host currently included in the first group and the hosts subsequently added to the first group.

[0066] For example, Figure 6 As shown in the figure, after selecting a group, the first effective option "All" and the second effective option "Specify this group" are displayed. Selecting "All" means that the security policy is effective for the hosts currently included in the group, that is, it is applied to all hosts currently mounted on the group or all hosts currently mounted on the subgroups of the group. Selecting "Specify this group" means that the security policy is effective for both the hosts currently included in the group and the subsequently added hosts, that is, it is applied to all hosts currently mounted on the group and the subsequently mounted hosts or all hosts currently mounted on the subgroups of the group and the subsequently mounted hosts. By providing two effective modes, the effective scope of the security policy can be flexibly controlled.

[0067] In a possible manner, the effective scope includes a specified group scope for configuring security policies for hosts in a specified group, a global scope for configuring security policies for all hosts, and a specified host scope for configuring security hosts for specified hosts. The method also includes: displaying the effective scope corresponding to each security policy on the policy configuration page in at least one of the following ways: for a first security policy with a global scope, displaying a global scope identifier; for a second security policy with a single specified group scope, displaying a first interactive control, the first interactive control is used to display the hosts included in the group corresponding to the single specified group scope when triggered; for a third security policy with multiple specified group scopes, displaying a second interactive control, the second interactive control is used to display the hosts included in the group corresponding to multiple specified group scopes when triggered; for a fourth security policy with a single specified host scope, displaying a third interactive control, the third interactive control is used to display a single host corresponding to the single specified host scope when triggered; for a fifth security policy with multiple specified host scopes, displaying a fourth interactive control, the fourth interactive control is used to display multiple hosts corresponding to multiple specified host scopes when triggered.

[0068] For example, the scope of effectiveness of a security policy can display different contents according to different types. Figure 7 As shown, the global scope displays a text label, such as "Global", which is not clickable. A single specified group range displays the group identifier and group name, and provides interactive controls. For example, the group name can be clicked to display the host list mounted on the group. Multiple specified group ranges display the group identifier and the number of groups, and provide interactive controls. For example, the number of groups can be clicked to display multiple group lists, and continue to click on a single group to display the host list mounted on the group. The number of hosts mounted on each group can be displayed in the group list, and then the number can be clicked to display the host list mounted on the group. The specific settings can be based on needs, and the present disclosure does not limit this.

[0069] For example, a single designated host range and multiple designated host ranges can refer to the page interaction of a single designated group range and multiple designated group ranges respectively, which will not be described in detail in this disclosure. Thus, different display effects of different effective ranges can be achieved, the page is more intuitive, and the operation is more convenient.

[0070] In a possible manner, the method also includes: in response to a trigger operation on the fifth group in the multi-level grouping, displaying all hosts included in the fifth group; in response to a search operation on the hosts in the fifth group, determining search conditions corresponding to the search operation, and switching to display the hosts in the fifth group that meet the search conditions.

[0071] For example, the host management page, policy configuration page and other pages provided by the present disclosure can be pages of the host security management system. By clicking different menus to enter different pages, different pages can provide page search functions. Taking the host management page as an example, the group search condition items can be displayed in the page, that is, the user can select group 1 and configure other search conditions, and the page will display the hosts in group 1 that meet the other search conditions.

[0072] For example, other pages of the host security management system, such as the security vulnerability page for displaying the security vulnerability list, if a certain vulnerability affects host 1 mounted by group 1 and host 2 mounted by group 2, then after selecting group 1, host 1 mounted by group 1 will be displayed, and so on. This disclosure will not go into details. Thus, the function of displaying and searching dynamic multi-level groups can be provided, which is convenient for users to manage groups.

[0073] It should be noted that when searching, you need to search based on the current latest grouping situation to avoid the situation where the search results do not match the actual situation.

[0074] Based on the same concept, the present disclosure provides a host security policy configuration device, such as Figure 8 As shown, the host security policy configuration device 800 includes: A display module 801 is used to display the host management page in response to a trigger operation on the host management page, wherein the host management page displays multiple levels of groups for grouping the hosts; The deletion module 802 is used to respond to the deletion operation of the first group in the multi-level grouping, move at least one first host included in the first group into a preset group of the same level, change the security policy corresponding to the at least one first host to the security policy corresponding to the preset group, and delete the first group, wherein the preset group is used to record ungrouped hosts.

[0075] Optionally, the deleting module 802 is used to: In the case where there is a second group at the same level as the first group, moving at least one first host included in the first group into a preset group at the same level, wherein the second group does not include the preset group; The host security policy configuration device 800 also includes: The first deletion submodule is used to move the at least one first host into the parent group of the first group when the second group does not exist, change the security policy of the at least one first host to the security policy corresponding to the parent group, and delete the first group.

[0076] Optionally, the deleting module 802 is used to: In the case that there is no preset group at the same level as the first group, the preset group is added, and at least one first host included in the first group is moved into the preset group.

[0077] Optionally, the host security policy configuration device 800 further includes: The second deleting submodule is configured to delete the preset group in response to a removal operation on all hosts included in the preset group.

[0078] Optionally, the security policy corresponding to at least one first host included in the first group is obtained through the following module configuration: A first response module, configured to display the policy configuration page in response to a trigger operation on the policy configuration page, wherein the policy configuration page displays all configured security policies; A second response module, configured to respond to a range configuration operation for a target security policy among all the security policies and display a range configuration page, wherein the range configuration page is used to configure an effective range of the target security policy; The third response module is configured to determine, in response to a range selection operation on the first group, the target security policy as a security policy corresponding to at least one first host included in the first group.

[0079] Optionally, the effective range includes a specified group range for configuring a security policy for hosts in a specified group; The third response module is used for: In response to a selection operation on the specified grouping range, displaying a multi-level selection corresponding to the multi-level groups one by one; In response to a selection operation on a target option corresponding to the first group in the multi-level options, the target security policy is determined to be a security policy corresponding to at least one first host included in the first group.

[0080] Optionally, the third response module is used to: In response to a selection operation on a target option corresponding to the first group in the multi-level options, a first effective option and a second effective option are displayed, wherein the second effective option is used to control the target security policy to take effect on hosts currently included in the first group, and the second effective option is used to control the target security policy to take effect on hosts currently included in the first group and hosts subsequently added to the first group; In response to a selection operation on the first effective option, determining the target security policy as a security policy corresponding to at least one first host currently included in the first group; In response to the selection operation of the second effective option, the target security policy is determined to be a security policy corresponding to at least one first host currently included in the first group and a host subsequently added to the first group.

[0081] Optionally, the effective range includes a specified group range for configuring security policies for hosts in a specified group, a global range for configuring security policies for all hosts, and a specified host range for configuring secure hosts for specified hosts. The host security policy configuration device 800 further includes a display submodule, which is used to: The effective scope of each security policy is displayed on the policy configuration page in at least one of the following ways: For the first security policy having the global scope, displaying a global scope identifier; For a second security policy having a single specified group range, displaying a first interactive control, wherein the first interactive control is used to display hosts included in a group corresponding to the single specified group range when triggered; For a third security policy having multiple specified group ranges, display a second interactive control, wherein the second interactive control is used to display hosts included in groups corresponding to the multiple specified group ranges when triggered; For a fourth security policy having a single specified host range, displaying a third interactive control, wherein the third interactive control is used to display a single host corresponding to the single specified host range when triggered; For a fifth security policy having multiple specified host ranges, a fourth interactive control is displayed, where the fourth interactive control is used to display multiple hosts corresponding to the multiple specified host ranges when triggered.

[0082] Optionally, at least one first host included in the first group is obtained through the following module configuration: a fourth response module, configured to display an installation configuration page in response to the installation configuration operation on the first host, wherein the installation configuration page is used to group the hosts; a fifth response module, configured to, in response to a group configuration operation on the first host in the installation configuration page, determine a target group path corresponding to the group configuration operation; The moving-in module is used to move the first host into the first group when the group of the target group path represents the first group.

[0083] Optionally, the host security policy configuration device 800 further includes: A search module is used to search for a target parent group existing in the target group path when the group represented by the target group path does not exist, and move the at least one first host into the target parent group or a preset group under the target parent group.

[0084] Optionally, the host security policy configuration device 800 further includes a moving module, and the moving module is used to: In response to a move operation on a second host in a third group of the multi-level grouping, displaying a radio button list corresponding to the multi-level grouping, wherein a radio button in the radio button list corresponds to a group in the multi-level grouping that does not include a subgroup; In response to a selection operation on a target radio item in the radio item list, the second host is moved into a group corresponding to the target radio item.

[0085] Optionally, the host security policy configuration device 800 further includes a newly added sub-grouping module, and the newly added sub-grouping module is used to: In response to a sub-grouping operation for a fourth group in the multi-level grouping, displaying a sub-grouping page, wherein the sub-grouping page is used to create a sub-group; In response to an editing operation on the newly added sub-group page, determining a sub-group name corresponding to the editing operation; If there is no other subgroup with the same subgroup name as the subgroup in the fourth group, generating a target subgroup corresponding to the subgroup name; When there is another sub-group with the same name as the sub-group in the fourth group, it is indicated that there is a sub-group with the same name.

[0086] Optionally, the host security policy configuration device 800 further includes a newly added preset grouping module, and the newly added preset grouping module is used to: After generating the target subgroup corresponding to the subgroup name, if there are no other subgroups in the fourth group and the fourth group includes at least one third host, a preset group at the same level as the target subgroup is added under the fourth group, and the at least one third host is moved into the preset group at the same level as the target subgroup.

[0087] Optionally, the host security policy configuration device 800 further includes a search module, and the search module is used to: In response to a trigger operation on a fifth group in the multi-level grouping, displaying all hosts included in the fifth group; In response to a search operation for hosts in the fifth group, a search condition corresponding to the search operation is determined, and hosts in the fifth group that meet the search condition are switched for display.

[0088] Based on the same concept, an embodiment of the present disclosure further provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processing device, the steps of the security policy configuration method of the above host are implemented.

[0089] Based on the same concept, the present disclosure also provides an electronic device, which may include: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the security policy configuration method of the host.

[0090] Based on the same concept, an embodiment of the present disclosure also provides a computer program product, including a computer program, which implements the steps of the above-mentioned host security policy configuration method when executed by a processor.

[0091] Reference below Fig. 9 , which shows a schematic diagram of the structure of an electronic device 900 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0092] like Fig. 9 As shown, the electronic device 900 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the electronic device 900 are also stored. The processing device 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0093] Typically, the following devices may be connected to the I / O interface 905: an input device 906 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 907 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 908 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 909. The communication device 909 may allow the electronic device 900 to communicate with other devices wirelessly or by wire to exchange data. Although Fig. 9 The electronic device 900 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0094] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 909, or installed from a storage device 908, or installed from a ROM 902. When the computer program is executed by the processing device 901, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0095] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0096] In some embodiments, any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol) can be used for communication, and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0097] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0098] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to a trigger operation on the host management page, displays the host management page, and the host management page displays multi-level groups for grouping management of hosts; in response to a deletion operation on the first group in the multi-level grouping, moves at least one first host included in the first group into a preset group of the same level, changes the security policy corresponding to the at least one first host to the security policy corresponding to the preset group, and deletes the first group, wherein the preset group is used to record ungrouped hosts.

[0099] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0100] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0101] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a module does not, in some cases, limit the module itself.

[0102] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0103] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0104] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0105] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0106] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A method for configuring a host security policy, characterized in that: The method comprises: In response to a triggering operation on a host management page, displaying the host management page, wherein the host management page displays a multi-level grouping for grouping management of hosts; In response to a deletion operation on the first group in the multi-level grouping, at least one first host included in the first group is moved into a preset group at the same level, the security policy corresponding to the at least one first host is changed to the security policy corresponding to the preset group, and the first group is deleted, wherein the preset group is used to record ungrouped hosts.

2. The host security policy configuration method according to claim 1, characterized in that: The step of moving at least one first host included in the first group into a preset group at the same level includes: In the case where there is a second group at the same level as the first group, moving at least one first host included in the first group into a preset group at the same level, wherein the second group does not include the preset group; The method further comprises: In the case that the second group does not exist, the at least one first host is moved into a parent group of the first group, a security policy of the at least one first host is changed to a security policy corresponding to the parent group, and the first group is deleted.

3. The method for configuring a host security policy according to claim 1 or 2, characterized in that: The step of moving at least one first host included in the first group into a preset group at the same level includes: In the case that there is no preset group at the same level as the first group, the preset group is added, and at least one first host included in the first group is moved into the preset group.

4. The method for configuring a host security policy according to claim 1 or 2, characterized in that: The method further comprises: In response to a removal operation on all hosts included in the preset group, the preset group is deleted.

5. The method for configuring a host security policy according to claim 1 or 2, characterized in that: The security policy corresponding to at least one first host included in the first group is configured in the following manner: In response to a triggering operation on a policy configuration page, displaying the policy configuration page, wherein the policy configuration page displays all configured security policies; In response to a scope configuration operation for a target security policy among all the security policies, displaying a scope configuration page, wherein the scope configuration page is used to configure an effective scope of the target security policy; In response to a range selection operation on the first group, the target security policy is determined to be a security policy corresponding to at least one first host included in the first group.

6. The method for configuring a host security policy according to claim 5, characterized in that: The effective range includes a specified group range for configuring a security policy for hosts in a specified group; In response to the selection operation on the first group, determining the target security policy as a security policy corresponding to at least one first host included in the first group includes: In response to a selection operation on the specified grouping range, displaying a multi-level selection corresponding to the multi-level groups one by one; In response to a selection operation on a target option corresponding to the first group in the multi-level options, the target security policy is determined to be a security policy corresponding to at least one first host included in the first group.

7. The host security policy configuration method according to claim 6, characterized in that: In response to the selection operation of the target option corresponding to the first group in the multi-level options, determining the target security policy as a security policy corresponding to at least one first host included in the first group includes: In response to a selection operation on a target option corresponding to the first group in the multi-level options, a first effective option and a second effective option are displayed, wherein the second effective option is used to control the target security policy to take effect on hosts currently included in the first group, and the second effective option is used to control the target security policy to take effect on hosts currently included in the first group and hosts subsequently added to the first group; In response to a selection operation on the first effective option, determining the target security policy as a security policy corresponding to at least one first host currently included in the first group; In response to the selection operation of the second effective option, the target security policy is determined to be a security policy corresponding to at least one first host currently included in the first group and a host subsequently added to the first group.

8. The host security policy configuration method according to claim 5, characterized in that: The effective range includes a specified group range for configuring security policies for hosts in a specified group, a global range for configuring security policies for all hosts, and a specified host range for configuring a secure host for a specified host. The method further includes: The effective scope of each security policy is displayed on the policy configuration page in at least one of the following ways: For the first security policy having the global scope, displaying a global scope identifier; For a second security policy having a single specified group range, displaying a first interactive control, wherein the first interactive control is used to display hosts included in a group corresponding to the single specified group range when triggered; For a third security policy having multiple specified group ranges, display a second interactive control, wherein the second interactive control is used to display hosts included in groups corresponding to the multiple specified group ranges when triggered; For a fourth security policy having a single specified host range, displaying a third interactive control, wherein the third interactive control is used to display a single host corresponding to the single specified host range when triggered; For a fifth security policy having multiple specified host ranges, a fourth interactive control is displayed, where the fourth interactive control is used to display multiple hosts corresponding to the multiple specified host ranges when triggered.

9. The method for configuring a host security policy according to claim 1 or 2, characterized in that: The at least one first host included in the first group is configured in the following manner: In response to the installation configuration operation on the first host, displaying an installation configuration page, the installation configuration page is used to group the hosts; In response to a group configuration operation on the first host in the installation configuration page, determining a target group path corresponding to the group configuration operation; In case the packets of the target packet path represent the first packet, the first host is moved into the first packet.

10. The host security policy configuration method according to claim 9, characterized in that: The method further comprises: In the case that the group represented by the target group path does not exist, the target parent group existing in the target group path is searched, and the at least one first host is moved into the target parent group or a preset group under the target parent group.

11. The method for configuring a host security policy according to claim 1 or 2, characterized in that: The method further comprises: In response to a move operation on a second host in a third group of the multi-level grouping, displaying a radio button list corresponding to the multi-level grouping, wherein a radio button in the radio button list corresponds to a group in the multi-level grouping that does not include a subgroup; In response to a selection operation on a target radio item in the radio item list, the second host is moved into a group corresponding to the target radio item.

12. The host security policy configuration method according to claim 1 or 2, characterized in that: The method further comprises: In response to a sub-grouping operation for a fourth group in the multi-level grouping, displaying a sub-grouping page, wherein the sub-grouping page is used to create a sub-group; In response to an editing operation on the newly added sub-group page, determining a sub-group name corresponding to the editing operation; If there is no other subgroup with the same subgroup name as the subgroup in the fourth group, generating a target subgroup corresponding to the subgroup name; When there is another sub-group with the same name as the sub-group in the fourth group, it is indicated that there is a sub-group with the same name.

13. The host security policy configuration method according to claim 12, characterized in that: The method further comprises: After generating the target subgroup corresponding to the subgroup name, if there are no other subgroups in the fourth group and the fourth group includes at least one third host, a preset group at the same level as the target subgroup is added under the fourth group, and the at least one third host is moved into the preset group at the same level as the target subgroup.

14. The host security policy configuration method according to claim 1 or 2, characterized in that: The method further comprises: In response to a trigger operation on a fifth group in the multi-level grouping, displaying all hosts included in the fifth group; In response to a search operation for hosts in the fifth group, a search condition corresponding to the search operation is determined, and hosts in the fifth group that meet the search condition are switched for display.

15. The host security policy configuration method according to claim 1 or 2, characterized in that: The multi-level grouping is a multi-level tree structure, wherein only the sub-groups corresponding to the leaf nodes in the multi-level tree structure are used to record the hosts, and the number of hosts in the parent group corresponding to the parent node in the multi-level tree structure is the sum of the number of hosts included in the sub-groups corresponding to all leaf nodes under the parent node.

16. A host security policy configuration device, characterized in that: The device comprises: A display module, configured to display the host management page in response to a trigger operation on the host management page, wherein the host management page displays multiple levels of groups for grouping the hosts; A deletion module is used to respond to a deletion operation on a first group in the multi-level grouping, move at least one first host included in the first group into a preset group at the same level, change the security policy corresponding to the at least one first host to the security policy corresponding to the preset group, and delete the first group, wherein the preset group is used to record ungrouped hosts.

17. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 15 are implemented.

18. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 15.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images