Exclusive network management and control method and device based on communication atlas and computer equipment

Abstract

The invention relates to an exclusive network management and control method and device based on a communication atlas and computer equipment. The method comprises the following steps: acquiring network data information of an exclusive network, and identifying physical association data of the exclusive network, logic association data of the exclusive network and security communication data of the exclusive network based on the network data information; on the basis of the physical association data and through a physical association strategy, constructing a physical communication atlas of the exclusive network, and on the basis of the physical communication atlas and the logic association data, generating a logic communication atlas of the exclusive network; and based on the physical communication atlas, the logic communication atlas and the security communication data, constructing a data communication atlas of the exclusive network, and based on the data communication atlas, performing access control processing on the exclusive network. By adopting the method, the management and control efficiency of the private network can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication maps and exclusive network technology, and in particular to an exclusive network management and control method, device and computer equipment based on a communication map. Background Art

[0002] With the deepening of digital transformation, various industries and organizations are not only facing the challenge of explosive growth in data volume, but also need to cope with network requirements in diversified business scenarios, resulting in increasingly complex architectures of their dedicated networks (hereinafter referred to as "dedicated networks"). As the scale of private networks expands and the operation time goes by, network connectivity relationships often become intricate and difficult to sort out and manage. This situation not only increases the complexity and difficulty of operation and maintenance, but may also lead to potential security risks and performance bottlenecks. Therefore, how to improve the management and control efficiency of private networks is the current research focus.

[0003] The traditional way to control private networks is to have a large number of private network operators manage and operate each module of the private network to ensure the control of the private network. However, due to the poor efficiency of manual control and the sharp increase in the number of communication relationships in the network, traditional monitoring and management tools may not be able to effectively cover all connection points, making it impossible for operation and maintenance personnel to discover and solve potential problems in a timely manner, resulting in poor control efficiency of the private network. Summary of the invention

[0004] Based on this, it is necessary to provide a dedicated network management and control method, device, computer equipment, computer-readable storage medium and computer program product based on a communication map to address the above technical problems.

[0005] In a first aspect, the present application provides a dedicated network management and control method based on a communication map, including:

[0006] Acquire network data information of a dedicated network, and based on the network data information, identify physical association data of the dedicated network, logical association data of the dedicated network, and secure communication data of the dedicated network;

[0007] Based on the physical association data and through a physical association strategy, a physical connection map of the dedicated network is constructed, and based on the physical connection map and the logical association data, a logical connection map of the dedicated network is generated;

[0008] Based on the physical communication map, the logical communication map, and the security communication data, a data communication map of the exclusive network is constructed, and based on the data communication map, access control processing is performed on the exclusive network.

[0009] Optionally, the identifying, based on the network data information, the physical association data of the dedicated network, the logical association data of the dedicated network, and the secure communication data of the dedicated network includes:

[0010] Splitting the network data information into network data contents of each data type, and identifying the data meaning represented by each data type;

[0011] The network data content whose data meaning is the data type of the interface address and the network data content whose data meaning is the data type of the subnet mask are used as the physical association data of the exclusive network;

[0012] The data is defined as the network data content of each data type pointed to by the route, which is used as the logical association data of the exclusive network, and the data is defined as the network data content of the data type of access control, which is used as the security communication data of the exclusive network.

[0013] Optionally, the constructing a physical connection map of the exclusive network based on the physical association data and through a physical association strategy includes:

[0014] Based on the network data content of the data type whose data meaning is the interface address and the network data content of the data type whose data meaning is the subnet mask, identifying the association information between each interface address of the dedicated network and each subnet of the dedicated network;

[0015] Based on the association information between each of the interface addresses and each of the subnets, identify the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, and for the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, respectively construct the physical communication information between each of the interface addresses and the physical communication information between each of the subnets;

[0016] The physical communication information between all interface addresses and the physical communication information between all subnets are used as the physical communication map of the dedicated network.

[0017] Optionally, generating a logical connectivity map of the dedicated network based on the physical connectivity map and the logical association data includes:

[0018] Based on the network data content of each data type pointed by the routing, identifying the routing logic of each physical communication information, and based on the routing logic of each physical communication information, screening the target physical communication information with logical association information in each of the physical communication information;

[0019] Based on the routing pointing logic of each target physical communication information, the logical communication information corresponding to each target physical communication information is generated, and based on each logical communication information, the logical communication map of the exclusive network is constructed.

[0020] Optionally, constructing a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the secure communication data includes:

[0021] Based on the network data content of the data meaning being the data type of access control, identifying the first enabling information corresponding to each of the physical communication information and the second enabling information corresponding to each of the logical communication information;

[0022] Based on the first release information corresponding to each of the physical communication information and the second release information corresponding to each of the logical communication information, a release control strategy for each of the physical communication information and a release control strategy corresponding to each of the logical communication information are constructed, and based on the release control strategy for each of the physical communication information and the release control strategy for each of the logical communication information, the physical communication map and the logical communication map are spliced ​​to obtain a data communication map of the exclusive network.

[0023] Optionally, performing access control processing on the dedicated network based on the data communication graph includes:

[0024] Collecting the current access interface address of the dedicated network and the access requirement information of the current access interface address, and querying the communication information of each target accessible by the current access structure address through the data communication map based on the current access interface address;

[0025] Based on the access requirement information, identifying the access requirement type of the current access interface address and the access data content of the current access interface address, and querying the access query method corresponding to the access requirement type in the database;

[0026] Based on the access data content of the current access interface address, access query processing is performed in each target communication information through the access query method to obtain the access query result of the current access interface address.

[0027] In a second aspect, the present application also provides a dedicated network control device based on a communication map, including:

[0028] An acquisition module, used to acquire network data information of a dedicated network, and based on the network data information, identify physical association data of the dedicated network, logical association data of the dedicated network, and secure communication data of the dedicated network;

[0029] A generating module, configured to construct a physical connection map of the dedicated network based on the physical connection data and a physical connection strategy, and to generate a logical connection map of the dedicated network based on the physical connection map and the logical connection data;

[0030] A construction module is used to construct a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the security communication data, and to perform access control on the exclusive network based on the data communication map.

[0031] Optionally, the acquisition module is specifically used to:

[0032] Splitting the network data information into network data contents of each data type, and identifying the data meaning represented by each data type;

[0033] The network data content whose data meaning is the data type of the interface address and the network data content whose data meaning is the data type of the subnet mask are used as the physical association data of the exclusive network;

[0034] The data is defined as the network data content of each data type pointed to by the route, which is used as the logical association data of the exclusive network, and the data is defined as the network data content of the data type of access control, which is used as the security communication data of the exclusive network.

[0035] Optionally, the generating module is specifically used for:

[0036] Based on the network data content of the data type whose data meaning is the interface address and the network data content of the data type whose data meaning is the subnet mask, identifying the association information between each interface address of the dedicated network and each subnet of the dedicated network;

[0037] Based on the association information between each of the interface addresses and each of the subnets, identify the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, and for the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, respectively construct the physical communication information between each of the interface addresses and the physical communication information between each of the subnets;

[0038] The physical communication information between all interface addresses and the physical communication information between all subnets are used as the physical communication map of the dedicated network.

[0039] Optionally, the generating module is specifically used for:

[0040] Based on the network data content of each data type pointed by the routing, identifying the routing logic of each physical communication information, and based on the routing logic of each physical communication information, screening the target physical communication information with logical association information in each of the physical communication information;

[0041] Based on the routing pointing logic of each target physical communication information, the logical communication information corresponding to each target physical communication information is generated, and based on each logical communication information, the logical communication map of the exclusive network is constructed.

[0042] Optionally, the building module is specifically used for:

[0043] Based on the network data content of the data meaning being the data type of access control, identifying the first enabling information corresponding to each of the physical communication information and the second enabling information corresponding to each of the logical communication information;

[0044] Based on the first release information corresponding to each of the physical communication information and the second release information corresponding to each of the logical communication information, a release control strategy for each of the physical communication information and a release control strategy corresponding to each of the logical communication information are constructed, and based on the release control strategy for each of the physical communication information and the release control strategy for each of the logical communication information, the physical communication map and the logical communication map are spliced ​​to obtain a data communication map of the exclusive network.

[0045] Optionally, the building module is specifically used for:

[0046] Collecting the current access interface address of the dedicated network and the access requirement information of the current access interface address, and querying the communication information of each target accessible by the current access structure address through the data communication map based on the current access interface address;

[0047] Based on the access requirement information, identifying the access requirement type of the current access interface address and the access data content of the current access interface address, and querying the access query method corresponding to the access requirement type in the database;

[0048] Based on the access data content of the current access interface address, access query processing is performed in each target communication information through the access query method to obtain the access query result of the current access interface address.

[0049] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0051] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0052] The above-mentioned exclusive network management and control method, device and computer equipment based on the communication map obtain network data information of the exclusive network, and based on the network data information, identify the physical association data of the exclusive network, the logical association data of the exclusive network, and the security communication data of the exclusive network; based on the physical association data, through the physical association strategy, build the physical communication map of the exclusive network, and based on the physical communication map and the logical association data, generate the logical communication map of the exclusive network; based on the physical communication map, the logical communication map, and the security communication data, build the data communication map of the exclusive network, and based on the data communication map, perform access control processing on the exclusive network. This solution constructs the data communication map of the exclusive network from three perspectives: physical association information, logical association information, and secure communication information of the exclusive network, thereby improving the accuracy of the constructed data communication map. Secondly, when constructing the data communication map, the physical communication map is constructed first, then the logical communication map, and finally the data communication map, so that the communication relationship between the massive assets under the complex network architecture in the constructed data communication map is clearly visible, avoiding the network security risks caused by the use of a large amount of human resources to control the network under disordered communication conditions. Finally, this solution performs access control on the exclusive network based on the data communication map, which not only ensures the accuracy of access control on the exclusive network, but also can query different network access requests from different communication perspectives (i.e. physical communication, logical communication, and secure communication), thereby comprehensively improving the control efficiency of the private network. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1It is a flowchart of a dedicated network management and control method based on a communication map in one embodiment;

[0055] Figure 2 It is a structural block diagram of a dedicated network control device based on a communication map in one embodiment;

[0056] Figure 3 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] The exclusive network control method based on the communication map provided in the embodiment of the present application can be applied to the application environment of exclusive network control. Among them, the method can be applied to the terminal, can also be applied to the server, can also be applied to the system including the terminal and the server, and is realized through the interaction between the terminal and the server. Among them, the terminal can be, but not limited to, various personal computers, laptops, medium-sized computers, etc. Among them, the terminal constructs the data communication map of the exclusive network from three angles of physical association information, logical association information, and secure communication information of the exclusive network, thereby improving the accuracy of the constructed data communication map. Secondly, when constructing the data communication map, the data communication map is constructed in a progressive manner in accordance with the physical communication map first, the logical communication map second, and the data communication map last, so that the communication relationship between the massive assets under the complex network architecture in the constructed data communication map is clearly visible, avoiding the network security risks caused by network control through a large amount of human resources under disordered communication conditions. Finally, this solution performs access control on the private network based on the data communication map, which not only ensures the accuracy of access control on the private network, but also can perform communication queries on different network access requests from different communication angles (i.e. physical communication, logical communication, and secure communication), thereby comprehensively improving the management efficiency of the private network.

[0059] In an exemplary embodiment, Figure 1 As shown, a dedicated network management and control method based on a communication map is provided, and the method is applied to a terminal as an example for explanation, including the following steps S101 to S103. Among them:

[0060] Step S101, obtaining network data information of a dedicated network, and based on the network data information, identifying physical association data of the dedicated network, logical association data of the dedicated network, and secure communication data of the dedicated network.

[0061] In this embodiment, the terminal responds to the staff's information upload operation, collects network and security policy configuration data, and obtains network data information of the exclusive network, wherein the network data information includes but is not limited to device type, subnet, interface address, routing policy, routing table, Network Address Translation (abbreviated as "NAT") policy, Virtual Private Network (abbreviated as "VPN") policy, Access Control List (abbreviated as "ACL"), Load Balancing (abbreviated as "LB") policy, etc. Then, the terminal splits the network data information into physical association data of the exclusive network, logical association data of the exclusive network, and secure communication data of the exclusive network. Among them, the physical association data is the interface IP address and subnet information data of the network and security equipment, wherein the data object of the data is the interface IP address and subnet mask. The logical association data is data such as routing policy, routing table, NAT policy, VPN policy, LB policy, etc. Finally, the secure communication data is the list data of the ACL-bearing devices (generally including routers, switches, and firewalls) that pass through the physical communication and logical communication paths. The specific identification process will be described in detail later.

[0062] Step S102, based on the physical association data and through the physical association strategy, a physical connection map of the exclusive network is constructed, and based on the physical connection map and the logical association data, a logical connection map of the exclusive network is generated.

[0063] In this embodiment, the terminal constructs a physical communication map of the exclusive network based on the physical association data and the physical association strategy, and generates a logical communication map of the exclusive network based on the physical communication map and the logical association data, wherein the physical communication map is a physical connection relationship map obtained by constructing a physical connection relationship based on the interface IP address and subnet information of the network and the security device, wherein the physical connection relationship map includes physical communication information between different interfaces, wherein the physical communication information not only includes the communication information between the interfaces with actual physical connection, but also includes the communication information between the interfaces with physical communication relationship, for example, the IPs of different interfaces are in the same subnet, and a physical communication relationship can be constructed. The logical communication map is a communication map of the actual existing logical communication relationship constructed based on the routing direction. Among them, the logical communication relationship is a subset of the physical communication relationship. Although there is a physical connection between some network assets, there is no actual logical communication relationship due to the lack of routing direction at the logical layer. Therefore, the logical communication map is a communication map constructed by screening physical communication information with logical communication relationships based on the physical communication map. The specific construction process will be described in detail later.

[0064] Step S103, constructing a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the security communication data, and performing access control on the exclusive network based on the data communication map.

[0065] In this embodiment, the terminal constructs a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the security communication data, and performs access control on the exclusive network based on the data communication map. Among them, the security communication data is the communication information from the perspective of network access control, wherein the network access control is mainly based on the whitelist strategy, that is, by default, all assets are not allowed to access each other (under this mechanism, all physical communications and logical communications will become unable to communicate from a security perspective), and then the whitelist ACL is used to release the communication needs that need to access each other, and the constructed data communication map contains both physical communication information, logical communication information, and access control information between each communication information. Finally, the terminal performs access control on the exclusive network through the data communication map to ensure efficient and accurate network access control for each access requirement.

[0066] Based on the above scheme, the data communication map of the exclusive network is constructed from three perspectives: the physical association information, logical association information, and secure communication information of the exclusive network, which improves the accuracy of the constructed data communication map. Secondly, when constructing the data communication map, the physical communication map is constructed first, then the logical communication map, and finally the data communication map, so as to progressively construct the data communication map, so that the communication relationship between the massive assets under the complex network architecture in the constructed data communication map is clearly visible, avoiding the network security risks caused by the network control through a large amount of human resources under the condition of disordered communication. Finally, this scheme performs access control on the exclusive network based on the data communication map, which not only ensures the accuracy of access control on the exclusive network, but also can query different network access requests from different communication perspectives (i.e. physical communication, logical communication, and secure communication), thereby comprehensively improving the control efficiency of the private network.

[0067] Optionally, based on the network data information, the physical associated data of the exclusive network, the logical associated data of the exclusive network, and the secure communication data of the exclusive network are identified, including: splitting the network data information into network data contents of each data type, and identifying the data meaning represented by each data type; using the network data content of the data type whose data meaning is the interface address, and the network data content of the data type whose data meaning is the subnet mask, as the physical associated data of the exclusive network; using the network data content of each data type pointed to by the route as the logical associated data of the exclusive network, and using the network data content of the data type whose data meaning is the access control as the secure communication data of the exclusive network.

[0068] In this embodiment, the terminal splits the network data information into network data contents of each data type, and identifies the data meaning represented by each data type. Among them, each data type is a data type corresponding to a data identifier preset by a staff member, and the data type includes but is not limited to a device type, a subnet type, an interface address type, a routing policy type, a routing table type, a network address translation policy type, a virtual private network policy type, an access control list type, a load balancing policy type, etc.

[0069] Then, the terminal uses the network data content of the data type whose data meaning is the interface address and the network data content of the data type whose data meaning is the subnet mask as the physical associated data of the exclusive network. The terminal uses the network data content of each data type pointed to by the route as the logical associated data of the exclusive network, and uses the network data content of the data type whose data meaning is the access control as the security communication data of the exclusive network. The database stores the correspondence between different data meanings and data types, and the terminal queries the correspondence in the database to identify the data type corresponding to each data meaning, and uses the network data content of the data type corresponding to each data meaning as the associated data corresponding to the data meaning.

[0070] Based on the above scheme, by splitting the network data information into network data content of each data type, and then splitting it according to the meaning of the data, the physical association data of the exclusive network, the logical association data of the exclusive network, and the security communication data of the exclusive network are obtained, thereby improving the accuracy and comprehensiveness of the identification of various data of the exclusive network.

[0071] Optionally, based on the physical association data, a physical communication map of the exclusive network is constructed through a physical association strategy, including: identifying the association information between each interface address of the exclusive network and each subnet of the exclusive network based on network data content whose data meaning is the data type of the interface address, and network data content whose data meaning is the data type of the subnet mask; identifying the physical connection relationship between each interface address and the physical connection relationship between each subnet based on the association information between each interface address and each subnet, and respectively constructing the physical communication information between each interface address and the physical connection information between each subnet for the physical connection relationship between each interface address and the physical connection relationship between each subnet; and using the physical communication information between all interface addresses and the physical communication information between all subnets as the physical communication map of the exclusive network.

[0072] In this embodiment, the terminal identifies the association information between each interface address of the exclusive network and each subnet of the exclusive network based on the network data content of the data type of the interface address and the network data content of the data type of the subnet mask. Specifically, there is association information between each interface address and each subnet mask, and each interface address corresponds to a subnet mask, and the subnet mask corresponding to the interface address is used to represent the subnet to which the interface address is connected.

[0073] Then, based on the association information between each interface address and each subnet, the terminal identifies the physical connection relationship between each interface address and the physical connection relationship between each subnet. Among them, the physical connection relationship between each interface address includes, in addition to the interface addresses with actual physical connection, the interface addresses connected to the same subnet are assumed to be physically connected by default. Among them, the physical connection relationship between each subnet is the connection relationship between subnets with actual physical connection.

[0074] According to the physical connection relationship between each interface address and the physical connection relationship between each subnet, the physical communication information between each interface address and the physical communication information between each subnet are respectively constructed. The physical communication information also includes the physical communication information between each interface address and each subnet. Finally, the terminal uses the physical communication information between all interface addresses and the physical communication information between all subnets as the physical communication map of the exclusive network.

[0075] Based on the above solution, by identifying the physical connection relationship between each interface address and the physical connection relationship between each subnet, a physical communication map of the exclusive network is constructed, thereby improving the comprehensiveness of the constructed physical communication map.

[0076] Optionally, a logical communication map of an exclusive network is generated based on the physical communication map and logically associated data, including: identifying the routing pointing logic of each physical communication information based on the network data content of each data type pointed to by the routing, and based on the routing pointing logic of each physical communication information, screening the target physical communication information with logically associated information in each physical communication information; based on the routing pointing logic of each target physical communication information, generating logical communication information corresponding to each target physical communication information, and constructing a logical communication map of the exclusive network based on each logical communication information.

[0077] In this embodiment, the terminal identifies the routing logic of each physical communication information based on the network data content of each data type pointed to by the routing, and based on the routing logic of each physical communication information, screens the target physical communication information with logical association information in each physical communication information. Wherein, each routing logic is a logical connection relationship with a routing pointing. Wherein, the logical connection relationship is one or more connection relationships in routing pointing including routing policy, routing table, NAT policy, VPN policy, LB policy, etc.

[0078] Then, the terminal generates logical communication information corresponding to each target physical communication information based on the routing pointing logic of each target physical communication information, and constructs a logical communication map of the exclusive network based on each logical communication information. The generated logical communication information is the routing pointing communication information constructed based on the logical connection relationship on the basis of each target physical communication information, and based on the routing pointing communication information, the subnet and interface address that have a logical relationship with each interface address can be effectively located.

[0079] Based on the above solution, through the network data content of each data type pointed to by the routing, various logical communication information is constructed on the basis of the target physical communication information, ensuring the comprehensiveness and accuracy of the constructed logical communication information.

[0080] Optionally, a data communication map of an exclusive network is constructed based on the physical communication map, the logical communication map, and the security communication data, including: identifying first release information corresponding to each physical communication information and second release information corresponding to each logical communication information based on network data content whose data meaning is a data type of access control; constructing a release control strategy for each physical communication information and a release control strategy for each logical communication information based on the first release information corresponding to each physical communication information and the second release information corresponding to each logical communication information; and based on the release control strategy for each physical communication information and the release control strategy for each logical communication information, performing map splicing processing on the physical communication map and the logical communication map to obtain the data communication map of the exclusive network.

[0081] In this embodiment, the terminal identifies the first enabling information corresponding to each physical communication information and the second enabling information corresponding to each logical communication information based on the network data content of the data meaning as the data type of access control. The enabling information is a list of the access permission between each physical communication information or the logical communication information, wherein the access permission mode includes one-way access and two-way mutual access and other access modes.

[0082] Then, based on the first release information corresponding to each physical communication information and the second release information corresponding to each logical communication information, the terminal constructs the release control strategy of each physical communication information and the release control strategy corresponding to each logical communication information, and based on the release control strategy of each physical communication information and the release control strategy corresponding to each logical communication information, the physical communication map and the logical communication map are spliced ​​to obtain the data communication map of the exclusive network. Among them, the release control strategy is the data access release permission restriction strategy at both ends of each physical communication information or logical communication information. That is, the access permission restriction information such as the access type, access amount, access time period, and access range that can be released for data access at both ends.

[0083] Based on the above solution, a release control strategy is constructed for each physical communication information or logical communication information, thereby improving the security control effect of access to each subnet.

[0084] Optionally, based on the data communication map, access control and management are performed on the exclusive network, including: collecting the current access interface address of the exclusive network, and the access requirement information of the current access interface address, and based on the current access interface address, querying the target communication information that can be accessed by the current access structure address through the data communication map; based on the access requirement information, identifying the access requirement type of the current access interface address, and the access data content of the current access interface address, and querying the database for the access query method corresponding to the access requirement type; based on the access data content of the current access interface address, performing access query processing in each target communication information through the access query method to obtain the access query result of the current access interface address.

[0085] In this embodiment, the terminal collects the current access interface address of the exclusive network and the access requirement information of the current access interface address, and based on the current access interface address, queries the target communication information that can be accessed by the current access structure address through the data communication map. Among them, the target communication information includes but is not limited to physical communication information, logical communication information, and release control strategy. Among them, the target communication information that can be accessed by the current access interface address is the access interface addresses allowed to be accessed and the subnets allowed to be accessed in the communication information associated with the current access interface.

[0086] Then, based on the access requirement information, the terminal identifies the access requirement type of the current access interface address and the access data content of the current access interface address, and queries the access query method corresponding to the access requirement type in the database. The database stores the access query methods corresponding to each access requirement type. For example, the input of the access requirement type corresponding to the communication path query is: source address, destination address, source port, destination port, and protocol. Output: details of the access path from source to destination based on the query protocol and port. This access query method is a path access query method. The input of the access requirement type corresponding to the threat domain query is: the threatened IP address. Output: the range of assets that can access the IP address and the detailed path from each threat subject to the threatened asset. This access query method is a traversal access query method. The input of the access requirement type corresponding to the attack domain query is: the threat subject IP address. Output: the range of assets that the threat subject can threaten and the detailed path from the threat subject to each threatened asset. This access query method is an associated access query method.

[0087] Finally, the terminal performs access query processing in each target communication information based on the access data content of the current access interface address through an access query method to obtain an access query result of the current access interface address.

[0088] Based on the above solution, by performing access queries and access permission management on different access interface addresses through the data communication map, the access query efficiency of the exclusive network can be effectively improved, and the network security risks caused by disordered communication can be avoided, thereby improving the risk prevention and control effect of the exclusive network on network security risks.

[0089] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0090] Based on the same inventive concept, the embodiment of the present application also provides a dedicated network control device based on a communication map for implementing the dedicated network control method based on a communication map involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the dedicated network control device based on the communication map provided below can refer to the limitations of the dedicated network control method based on the communication map above, and will not be repeated here.

[0091] In an exemplary embodiment, Figure 2 As shown, a dedicated network management and control device based on a communication map is provided, including: an acquisition module 210, a generation module 220 and a construction module 230, wherein:

[0092] The acquisition module 210 is used to acquire network data information of the dedicated network, and based on the network data information, identify the physical association data of the dedicated network, the logical association data of the dedicated network, and the secure communication data of the dedicated network;

[0093] A generating module 220, configured to construct a physical connection map of the dedicated network based on the physical connection data and a physical connection strategy, and to generate a logical connection map of the dedicated network based on the physical connection map and the logical connection data;

[0094] The construction module 230 is used to construct a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the security communication data, and perform access control processing on the exclusive network based on the data communication map.

[0095] Optionally, the acquisition module 210 is specifically configured to:

[0096] Splitting the network data information into network data contents of each data type, and identifying the data meaning represented by each data type;

[0097] The network data content whose data meaning is the data type of the interface address and the network data content whose data meaning is the data type of the subnet mask are used as the physical association data of the exclusive network;

[0098] The data is defined as the network data content of each data type pointed to by the route, which is used as the logical association data of the exclusive network, and the data is defined as the network data content of the data type of access control, which is used as the security communication data of the exclusive network.

[0099] Optionally, the generating module 220 is specifically configured to:

[0100] Based on the network data content of the data type whose data meaning is the interface address and the network data content of the data type whose data meaning is the subnet mask, identifying the association information between each interface address of the dedicated network and each subnet of the dedicated network;

[0101] Based on the association information between each of the interface addresses and each of the subnets, identify the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, and for the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, respectively construct the physical communication information between each of the interface addresses and the physical communication information between each of the subnets;

[0102] The physical communication information between all interface addresses and the physical communication information between all subnets are used as the physical communication map of the dedicated network.

[0103] Optionally, the generating module 220 is specifically configured to:

[0104] Based on the network data content of each data type pointed by the routing, identifying the routing logic of each physical communication information, and based on the routing logic of each physical communication information, screening the target physical communication information with logical association information in each of the physical communication information;

[0105] Based on the routing pointing logic of each target physical communication information, the logical communication information corresponding to each target physical communication information is generated, and based on each logical communication information, the logical communication map of the exclusive network is constructed.

[0106] Optionally, the construction module 230 is specifically used to:

[0107] Based on the network data content of the data meaning being the data type of access control, identifying the first enabling information corresponding to each of the physical communication information and the second enabling information corresponding to each of the logical communication information;

[0108] Based on the first release information corresponding to each of the physical communication information and the second release information corresponding to each of the logical communication information, a release control strategy for each of the physical communication information and a release control strategy corresponding to each of the logical communication information are constructed, and based on the release control strategy for each of the physical communication information and the release control strategy for each of the logical communication information, the physical communication map and the logical communication map are spliced ​​to obtain a data communication map of the exclusive network.

[0109] Optionally, the construction module 230 is specifically used to:

[0110] Collecting the current access interface address of the dedicated network and the access requirement information of the current access interface address, and querying the communication information of each target accessible by the current access structure address through the data communication map based on the current access interface address;

[0111] Based on the access requirement information, identifying the access requirement type of the current access interface address and the access data content of the current access interface address, and querying the access query method corresponding to the access requirement type in the database;

[0112] Based on the access data content of the current access interface address, access query processing is performed in each target communication information through the access query method to obtain the access query result of the current access interface address.

[0113] Each module in the above-mentioned dedicated network control device based on the communication map can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0114] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 3 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a dedicated network control method based on a communication map is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0115] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0116] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of implementing a dedicated network management and control method based on a communication map are implemented.

[0117] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of implementing a dedicated network management and control method based on a communication map are implemented.

[0118] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of a dedicated network management and control method based on a communication map.

[0119] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0121] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A dedicated network management and control method based on a communication map, characterized in that: The method comprises: Acquire network data information of a dedicated network, and based on the network data information, identify physical association data of the dedicated network, logical association data of the dedicated network, and secure communication data of the dedicated network; Based on the physical association data and through a physical association strategy, a physical connection map of the dedicated network is constructed, and based on the physical connection map and the logical association data, a logical connection map of the dedicated network is generated; Based on the physical communication map, the logical communication map, and the security communication data, a data communication map of the exclusive network is constructed, and based on the data communication map, access control processing is performed on the exclusive network.

2. The method according to claim 1, characterized in that The identifying, based on the network data information, the physical association data of the dedicated network, the logical association data of the dedicated network, and the secure communication data of the dedicated network includes: Splitting the network data information into network data contents of each data type, and identifying the data meaning represented by each data type; The network data content whose data meaning is the data type of the interface address and the network data content whose data meaning is the data type of the subnet mask are used as the physical association data of the exclusive network; The data is defined as the network data content of each data type pointed to by the route, which is used as the logical association data of the exclusive network, and the data is defined as the network data content of the data type of access control, which is used as the security communication data of the exclusive network.

3. The method according to claim 2, characterized in that The step of constructing a physical connection map of the exclusive network based on the physical association data and through a physical association strategy includes: Based on the network data content of the data type whose data meaning is the interface address and the network data content of the data type whose data meaning is the subnet mask, identifying the association information between each interface address of the dedicated network and each subnet of the dedicated network; Based on the association information between each of the interface addresses and each of the subnets, identify the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, and for the physical connection relationship between each of the interface addresses and the physical connection relationship between each of the subnets, respectively construct the physical communication information between each of the interface addresses and the physical communication information between each of the subnets; The physical communication information between all interface addresses and the physical communication information between all subnets are used as the physical communication map of the dedicated network.

4. The method according to claim 3, characterized in that The generating of the logical connection map of the dedicated network based on the physical connection map and the logical association data includes: Based on the network data content of each data type pointed by the routing, identifying the routing logic of each physical communication information, and based on the routing logic of each physical communication information, screening the target physical communication information with logical association information in each of the physical communication information; Based on the routing pointing logic of each target physical communication information, the logical communication information corresponding to each target physical communication information is generated, and based on each logical communication information, the logical communication map of the exclusive network is constructed.

5. The method according to claim 4, characterized in that The step of constructing the data communication map of the exclusive network based on the physical communication map, the logical communication map, and the secure communication data includes: Based on the network data content of the data meaning being the data type of access control, identifying the first enabling information corresponding to each of the physical communication information and the second enabling information corresponding to each of the logical communication information; Based on the first release information corresponding to each of the physical communication information and the second release information corresponding to each of the logical communication information, a release control strategy for each of the physical communication information and a release control strategy corresponding to each of the logical communication information are constructed, and based on the release control strategy for each of the physical communication information and the release control strategy for each of the logical communication information, the physical communication map and the logical communication map are spliced ​​to obtain a data communication map of the exclusive network.

6. The method according to claim 1, characterized in that The access control processing of the dedicated network based on the data communication graph includes: Collecting the current access interface address of the dedicated network and the access requirement information of the current access interface address, and querying the communication information of each target accessible by the current access structure address through the data communication map based on the current access interface address; Based on the access requirement information, identifying the access requirement type of the current access interface address and the access data content of the current access interface address, and querying the access query method corresponding to the access requirement type in the database; Based on the access data content of the current access interface address, access query processing is performed in each target communication information through the access query method to obtain the access query result of the current access interface address.

7. A dedicated network control device based on a communication map, characterized in that: The device comprises: An acquisition module, used to acquire network data information of a dedicated network, and based on the network data information, identify physical association data of the dedicated network, logical association data of the dedicated network, and secure communication data of the dedicated network; A generating module, configured to construct a physical connection map of the dedicated network based on the physical connection data and a physical connection strategy, and to generate a logical connection map of the dedicated network based on the physical connection map and the logical connection data; A construction module is used to construct a data communication map of the exclusive network based on the physical communication map, the logical communication map, and the security communication data, and to perform access control on the exclusive network based on the data communication map.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images