Strategy matching method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a strategy matching method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a first policy from a policy storage database of a target gateway according to policy use information, and storing the first policy into a memory database; when the target gateway is started, second policies are determined from the first policies according to the policy use information, the second policies are stored in a program memory, and the number of the second policies is smaller than that of the first policies; and under the condition that the target gateway receives a policy matching task, executing the policy matching task based on the second policy to determine a target policy, the target policy being used for indicating whether to intercept a behavior of acquiring a target component. By adopting the method, the strategy matching efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a policy matching method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of enterprise informatization, business systems and various applications are increasingly relying on open source components in the development, deployment and maintenance of these systems. These components are usually synchronized directly from the official source and stored in the enterprise's private source warehouse for internal use. In the process of synchronizing components from the official source, components with security vulnerabilities may be synchronized to the private source warehouse, so that technicians may use components with security risks, which may lead to security issues.

[0003] In the prior art, when a component acquisition request is received, the policy of the component is first matched, and then it is determined whether to release / intercept the component according to the policy.

[0004] However, as the number of components increases and different versions of components correspond to different strategies, the strategies grow explosively, resulting in a long strategy matching process and low strategy matching efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a more efficient strategy matching method, apparatus, computer device, computer-readable storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides a strategy matching method, comprising:

[0007] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0008] When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0009] In the case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0010] In one of the embodiments, the policy matching task is performed based on the second policy to determine the target policy, including: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0011] In one of the embodiments, determining the target policy from the second policy based on the identification information and the version number includes: determining a policy group corresponding to the target component from the second policy based on the identification information; and determining the target policy from the policy group based on the version number.

[0012] In one of the embodiments, the method also includes: if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, then determining the policy group corresponding to the target component from the in-memory database according to the identification information, and determining the target policy from the policy group according to the version number; if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then determining the policy group corresponding to the target component from the policy storage database according to the identification information, and determining the target policy from the policy group according to the version number.

[0013] In one of the embodiments, the method further includes: after determining the target strategy, adjusting the number of times the target strategy is used, and after a preset time, updating the strategy usage information based on the adjusted number of times used to obtain new strategy usage information; based on the new strategy usage information, executing the step of obtaining the first strategy from the strategy storage database and storing the first strategy in the memory database.

[0014] In one of the embodiments, the method also includes: when the target gateway receives the policy adjustment task, determining whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; if so, adjusting the policy to be adjusted in the program memory, the memory database and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determining whether there is the policy to be adjusted in the memory database; if so, adjusting the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjusting the policy to be adjusted in the policy storage database according to the adjustment information.

[0015] In a second aspect, the present application also provides a strategy matching device, including:

[0016] An acquisition module, configured to acquire a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database;

[0017] A determination module, configured to determine a second policy from the first policy according to the policy usage information when the target gateway is started, and store the second policy in a program memory, wherein the number of the second policies is less than the number of the first policies;

[0018] The execution module is used to execute the policy matching task based on the second policy when the target gateway receives the policy matching task, so as to determine the target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0019] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in any embodiment of the first aspect when executing the computer program.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect above.

[0021] In a fifth aspect, the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect above.

[0022] The above-mentioned policy matching method, device, computer equipment, computer-readable storage medium and computer program product obtain a first policy from the policy storage database of the target gateway according to policy usage information, and store the first policy in the memory database; when the target gateway is started, the second policy is determined from the first policy according to the policy usage information, and the second policy is stored in the program memory, and the number of the second policy is less than the number of the first policy; when the target gateway receives a policy matching task, the policy matching task is executed based on the second policy to determine the target policy, and the target policy is used to indicate whether to intercept the behavior of obtaining the target component. The method provided by the present application determines the first policy from all policies in the policy storage database through policy usage information, and stores the first policy in the memory database, and after the target gateway is started, a part of the policy is determined from the first policy according to the policy usage information as the second policy, and stored in the program memory. In this way, when a policy matching task is received, policy matching can be performed based on the second policy in the program memory, effectively reducing the number of policy matching, so as to shorten the time consumption of policy matching, and thus improve the efficiency of policy matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 An application environment diagram of a strategy matching method in an embodiment;

[0025] Figure 2 A flowchart of a method for performing the policy matching task based on the second policy to determine a target policy in an embodiment;

[0026] Figure 3 is a flow chart of a method for determining the target policy from the second policy according to the identification information and the version number in an embodiment;

[0027] Figure 4 A flowchart of a method for determining, according to identification information, that a policy group corresponding to a target component does not exist in the second policy in an embodiment;

[0028] Figure 5 is a flow chart of a method after determining a target strategy in one embodiment;

[0029] Figure 6 A flowchart of a method in an embodiment when a target gateway receives a policy adjustment task;

[0030] Figure 7 A schematic diagram of a flow chart of a strategy matching method in another embodiment;

[0031] Figure 8 is a structural block diagram of a strategy matching device in an embodiment;

[0032] Fig. 9 is an internal structure diagram of a computer device in one embodiment;

[0033] Fig.10 is an internal structure diagram of a computer device in another embodiment;

[0034] Fig.11 A schematic diagram of a policy storage database, a memory database, and a program memory in one embodiment. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0036] With the development of enterprise informatization, business systems and various applications are increasingly relying on open source components in the development, deployment and maintenance of these systems. These components are usually synchronized directly from the official source and stored in the enterprise's private source warehouse for internal use. In the process of synchronizing components from the official source, components with security vulnerabilities may be synchronized to the private source warehouse, so that technicians may use components with security risks, which may lead to security issues.

[0037] In the prior art, when a component acquisition request is received, the policy of the component is first matched, and then it is determined whether to release / intercept the component according to the policy.

[0038] However, as the number of components increases and different versions of components correspond to different strategies, the number of strategies has exploded.

[0039] In the process of policy matching, the component indicated by the current component acquisition request needs to be matched with all the policies one by one, which makes the policy matching process time-consuming and leads to low efficiency of policy matching.

[0040] In view of this, the present application provides a policy matching method, which determines a first policy from all policies in a policy storage database through policy usage information, and stores the first policy in a memory database. After the target gateway is started, a part of the policy is determined from the first policy as a second policy based on the policy usage information, and stored in the program memory. In this way, when a policy matching task is received, policy matching can be performed based on the second policy in the program memory, which effectively reduces the number of policy matches, shortens the time of policy matching, and thereby improves the efficiency of policy matching.

[0041] The policy matching method provided in the present application can be executed by a computer device, which can be a terminal or a server.

[0042] In an exemplary embodiment, Figure 1 As shown, a strategy matching method is provided, the method comprising the following steps:

[0043] Step 101: Obtain a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database.

[0044] Optionally, the target gateway may be a private source security gateway. A private source security gateway refers to a network security device or software system deployed in a private network environment to ensure the security of private source data and to perform secure management and control of private source access.

[0045] The policy storage database may be a MySQL database, which is a relational database management system. The relational database may store data (policies) in different tables instead of placing all data (policies) in a large warehouse, so as to increase speed and flexibility.

[0046] The memory database may be a Redis database, which is a memory-based data structure storage system and can be used as a database, cache, message queue, etc.

[0047] The policy usage information can be used to characterize the usage frequency of the policy within a preset time period. The preset time period can be a time period set by a technician according to actual needs.

[0048] In some exemplary embodiments, the policy usage information of the policies stored in the policy storage database may be collected first, for example, the policy usage information may be determined based on historical usage information of the policy storage database.

[0049] Further, after the policy usage information of the policy storage database is determined, the first policy may be determined from the policy storage database according to the policy usage information.

[0050] Specifically, as described above, the policy usage information is used to characterize the usage frequency of the policy within a preset time period, and therefore, the first policy can be determined from the policies stored in the policy storage database according to the first preset usage frequency threshold. For example, a policy whose usage frequency is greater than the first preset usage frequency is determined as the first policy.

[0051] The policies stored in the policy storage database may also be sorted according to the usage frequency indicated by the policy usage information, and the policy before the first preset sequence number may be determined as the first policy.

[0052] Further, after determining the first policy from the policy storage database according to the policy usage information, the first policy can be stored in the memory database. Exemplarily, the first policy is stored in the memory database to take advantage of its fast read and write characteristics. When the first policies need to be frequently queried later, they can be quickly obtained from the memory database, thereby reducing the policy matching time and improving the response speed.

[0053] Step 102: When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory.

[0054] The number of the second strategies is smaller than the number of the first strategies.

[0055] Optionally, the program memory refers to the memory space occupied by the computer program of the target gateway during operation.

[0056] Exemplarily, since the stored policies in the program memory will be lost when the target gateway is restarted, each time the target gateway is started, it is necessary to re-determine the second policy from the first policy based on the policy usage information and store the second policy in the program memory.

[0057] In some exemplary embodiments, as described above, the first policy is determined from policies stored in a policy storage database according to policy usage information.

[0058] Specifically, it may be determined according to a first preset usage frequency threshold, and then the second policy is determined from the first policy according to the policy usage information, it may be determined according to a second preset usage frequency threshold, or the first policy whose usage frequency indicated by the policy usage information is greater than the second preset usage frequency threshold is determined as the second policy. The second preset usage frequency threshold is greater than the first preset usage frequency threshold.

[0059] Alternatively, the second strategy may be determined from the first strategy according to the strategy usage information after being sorted according to the usage frequency indicated by the strategy usage information and determined according to the first preset sequence number, or the first strategy may be sorted according to the usage frequency indicated by the strategy usage information and the first strategy whose sequence number is before the second preset sequence number is determined as the second strategy. The second preset sequence number is smaller than the first preset sequence number.

[0060] Further, after determining the second policy from the first policy according to the policy usage information, the second policy is stored in the program memory. Exemplarily, storing the second policy in the program memory can facilitate direct and fast access to these policies.

[0061] Exemplarily, the policy relationship stored in the policy storage database, the memory database, and the program memory can be as follows: Fig.11 shown.

[0062] Step 103: When the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine the target policy.

[0063] The target strategy is used to indicate whether to intercept the behavior of obtaining the target component.

[0064] Optionally, the policy matching task refers to a process of matching a policy corresponding to a target component, where the target component refers to a component indicated by a component acquisition request, and the component acquisition request is used to acquire a component in a private source repository.

[0065] In some exemplary embodiments, when the target gateway receives a policy matching task, it may first determine the target component according to the policy matching task, and then match the target component with the second policy stored in the program memory.

[0066] Specifically, the identifiers of the target components may be matched with the second policies one by one to determine the target policy from the second policies.

[0067] The above-mentioned policy matching method obtains the first policy from the policy storage database of the target gateway according to the policy usage information, and stores the first policy in the memory database; when the target gateway is started, the second policy is determined from the first policy according to the policy usage information, and the second policy is stored in the program memory, and the number of the second policy is less than the number of the first policy; when the target gateway receives a policy matching task, the policy matching task is executed based on the second policy to determine the target policy, and the target policy is used to indicate whether to intercept the behavior of obtaining the target component. The method provided by the present application determines the first policy from all the policies in the policy storage database through the policy usage information, and stores the first policy in the memory database, and after the target gateway is started, a part of the policy is determined from the first policy according to the policy usage information as the second policy, and stored in the program memory. In this way, when a policy matching task is received, policy matching can be performed based on the second policy in the program memory, effectively reducing the number of policy matching, so as to shorten the time consumption of policy matching, and thus improve the efficiency of policy matching.

[0068] In an exemplary embodiment, Figure 2 As shown, the strategy matching task is performed based on the second strategy to determine the target strategy, including the following steps:

[0069] Step 201: Determine the identification information and version number of the target component according to the policy matching task.

[0070] Optionally, the identification information can be used to represent the name of the target component.

[0071] In some exemplary embodiments, when the target gateway receives a policy matching task, the identification information and version number of the target component may be first determined according to the policy matching task.

[0072] Step 202: Determine the target policy from the second policy according to the identification information and the version number.

[0073] In some exemplary embodiments, after the identification information and the version number of the target component are determined, the target policy may be determined from the second policy based on a keyword algorithm, the identification information, and the version number.

[0074] Specifically, a candidate policy may be determined from the second policy based on the keyword algorithm and the identification information, and then the target policy may be determined from the candidate policies based on the keyword algorithm and the version number.

[0075] In an exemplary embodiment, Figure 3 As shown, determining the target policy from the second policy according to the identification information and the version number includes the following steps:

[0076] Step 301: Determine the policy group corresponding to the target component from the second policy according to the identification information.

[0077] Exemplarily, in the program memory, there are multiple policy groups, different policy groups correspond to different components, and each policy group stores the policy of the component corresponding to the policy group.

[0078] In some exemplary embodiments, after the identification information and the version number of the target component are determined, a policy group corresponding to the target component may be determined from a plurality of policy groups according to the identification information.

[0079] Step 302: Determine the target policy from the policy group according to the version number.

[0080] In some exemplary embodiments, after determining the policy group corresponding to the target component from a plurality of policy groups according to the identification information, the target policy may be determined from the policy groups according to the version number.

[0081] In an optional embodiment of the present application, in order to improve the efficiency of policy matching, the policies corresponding to each version of the component will be transformed into a policy group of a single component in the policy storage database, memory database and program memory, and the transformation results will be cached in the form of a KV dictionary to facilitate policy matching.

[0082] For example, component A has 10 versions, 1.0.0 to 1.0.9, and the policies corresponding to these 10 versions can be used. Since the number of open source components in the current cyberspace is in the billions, the corresponding policies may exceed hundreds of millions or even billions. Therefore, using identification information for convergence first, and then matching according to the version number after hitting the identification information can effectively improve the efficiency of policy matching.

[0083] In an optional embodiment of the present application, the policies in the policy storage database, the memory database, and the program memory can also be merged, that is, the overlapping policies are merged to reduce the number of policies and improve the efficiency of policy matching. Specifically, when the version ranges of multiple policies of a component overlap, the multiple policies can be merged.

[0084] In an exemplary embodiment, Figure 4As shown, if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, the method further includes the following steps:

[0085] Step 401: determine the policy group corresponding to the target component from the memory database according to the identification information, and determine the target policy from the policy group according to the version number.

[0086] In some exemplary embodiments, in the process of executing the policy matching task based on the second policy, it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, and then the policy matching task is executed based on the first policy.

[0087] Specifically, it can be determined first according to the identification information whether there is a policy group corresponding to the target component in the memory database. If so, the target policy is determined from the policy group according to the version number.

[0088] Step 402: If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the memory database, the policy group corresponding to the target component is determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

[0089] In some exemplary embodiments, if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, the policy matching task is performed based on the policy storage database.

[0090] Specifically, the policy group corresponding to the target component is directly determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

[0091] In an exemplary embodiment, Figure 5 As shown, after determining the target strategy, the method further includes the following steps:

[0092] Step 501: Adjust the usage times of the target policy, and after a preset time, update the policy usage information based on the adjusted usage times to obtain new policy usage information.

[0093] Exemplarily, each policy corresponds to a value, and the value can be used to represent the number of times the policy is used, and the number of times the policy is used can be used to determine policy usage information.

[0094] In some exemplary embodiments, after the target policy is determined, the number of times the target policy is used may be adjusted. For example, the number of times the target policy is used is originally 0, and after being used once, it may be adjusted to 1.

[0095] Furthermore, the number of times each strategy is used may be obtained at a preset time interval, and new strategy use information may be determined according to the number of times each strategy is used.

[0096] Step 502: Based on the new policy usage information, the first policy is obtained from the policy storage database, and the first policy is stored in the memory database.

[0097] In some exemplary embodiments, after the policy usage information is updated, the first policy and the second policy in the memory database and the program memory database need to be updated according to the new policy usage information to improve the accuracy of the first policy and the second policy, thereby improving the efficiency of policy matching.

[0098] In an optional embodiment of the present application, a value may be set for each component to represent the number of times the component's strategy is used, and the frequency of use of the component may be determined based on the number of times it is used. The frequency of use may be expressed as .

[0099] Furthermore, the large language model can be used to calculate the general usage frequency of each component within a preset time period. ,according to and The target usage frequency of each component within a preset time period can be determined, that is, , where i represents the identification information of the component, and The first strategy and the second strategy may also be determined according to the target usage frequency.

[0100] In an exemplary embodiment, Figure 6 As shown, when the target gateway receives a policy adjustment task, the method further includes the following steps:

[0101] Step 601: Determine whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory.

[0102] Optionally, the policy adjustment task may be to adjust the policy, such as adjusting the content indicated by the policy.

[0103] In some exemplary embodiments, when the target gateway receives a policy adjustment task, it may first determine whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory.

[0104] Step 602: If so, adjust the to-be-adjusted policies in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task.

[0105] In some exemplary embodiments, if it is determined that the policy to be adjusted indicated by the policy adjustment task exists in the program memory, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted directly according to the adjustment information indicated by the policy adjustment task.

[0106] Step 603: If not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information.

[0107] In some exemplary embodiments, if it is determined that the policy to be adjusted indicated by the policy adjustment task does not exist in the program memory, it is then determined whether the policy to be adjusted exists in the memory database.

[0108] Further, if it is determined that the policy to be adjusted exists in the memory database, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information.

[0109] Step 604: If it does not exist, adjust the to-be-adjusted policy in the policy storage database according to the adjustment information.

[0110] In some exemplary embodiments, if it is determined that the policy to be adjusted does not exist in the memory database, the policy to be adjusted in the policy storage database is adjusted directly according to the adjustment information.

[0111] In an optional embodiment of the present application, the present application also provides a policy generation method. Specifically, since there are many secondary components in actual applications, that is, components developed and combined based on components in a private source warehouse, when determining the strategy corresponding to the secondary component, the components involved in the secondary component can be determined first based on the SBOM (Software Composition Analysis) of the secondary component, and the strategy of the secondary component can be determined based on the strategies of these components.

[0112] For example, secondary component A is composed of A1, A2 and A3. If any of the strategies of A1, A2 and A3 is interception, then the strategy of secondary component A can be determined to be interception. If the strategies of A1, A2 and A3 are all release, then the strategy of secondary component A can be determined to be release.

[0113] The SBOM refers to a detailed list of all components, libraries, and dependencies used in the software build process, which can be obtained by software composition analysis.

[0114] In an exemplary embodiment, Figure 7As shown, another strategy matching method is provided, which includes the following steps:

[0115] Step 701: Obtain a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database; when the target gateway is started, determine a second policy from the first policy according to the policy usage information, and store the second policy in a program memory, wherein the number of the second policies is less than the number of the first policies;

[0116] Step 702: when the target gateway receives the policy matching task, determine the identification information and version number of the target component according to the policy matching task; determine the policy group corresponding to the target component from the second policy according to the identification information; determine the target policy from the policy group according to the version number, and the target policy is used to indicate whether to intercept the behavior of obtaining the target component;

[0117] Step 703: If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, the policy group corresponding to the target component is determined from the in-memory database according to the identification information, and the target policy is determined from the policy group according to the version number; if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the in-memory database, the policy group corresponding to the target component is determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number;

[0118] Step 704: after determining the target policy, adjusting the number of times the target policy is used, and after a preset time, updating the policy usage information based on the adjusted number of times of use to obtain new policy usage information; based on the new policy usage information, executing the step of obtaining the first policy from the policy storage database and storing the first policy in the memory database;

[0119] Step 705: When the target gateway receives the policy adjustment task, determine whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, adjust the policy to be adjusted in the program memory, the memory database and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0120] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0121] Based on the same inventive concept, the embodiment of the present application also provides a strategy matching device for implementing the strategy matching method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more strategy matching device embodiments provided below can refer to the limitations on the strategy matching method above, and will not be repeated here.

[0122] In an exemplary embodiment, Figure 8 As shown, a strategy matching device 800 is provided, comprising: an acquisition module 801, a determination module 802 and an execution module 803, wherein:

[0123] An acquisition module 801 is used to acquire a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database;

[0124] A determination module 802 is used to determine a second policy from the first policy according to the policy usage information when the target gateway is started, and store the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0125] The execution module 803 is used to execute the policy matching task based on the second policy when the target gateway receives the policy matching task, so as to determine the target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0126] In one embodiment, the execution module 803 is specifically configured to determine the identification information and version number of the target component according to the policy matching task; and determine the target policy from the second policy according to the identification information and the version number.

[0127] In one embodiment, the execution module 803 is specifically configured to determine the policy group corresponding to the target component from the second policy according to the identification information; and determine the target policy from the policy group according to the version number.

[0128] In one embodiment, the execution module 803 is also used to determine the policy group corresponding to the target component from the in-memory database according to the identification information, and determine the target policy from the policy group according to the version number if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy; if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then determine the policy group corresponding to the target component from the policy storage database according to the identification information, and determine the target policy from the policy group according to the version number.

[0129] In one embodiment, the execution module 803 is also used to adjust the number of times the target policy is used after determining the target policy, and after a preset time, update the policy usage information based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, execute the step of obtaining the first policy from the policy storage database and storing the first policy in the memory database.

[0130] In one embodiment, the execution module 803 is also used to determine whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory when the target gateway receives the policy adjustment task; if so, adjust the policy to be adjusted in the program memory, the memory database and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0131] Each module in the above-mentioned strategy matching device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0132] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a strategy matching method is implemented.

[0133] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a policy matching method is implemented. Those skilled in the art can understand that Fig. 9 and Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0134] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0135] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0136] When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0137] In the case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0138] In one embodiment, when the processor executes the computer program, the following steps are further implemented: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0139] In one embodiment, when the processor executes the computer program, the following steps are further implemented: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0140] In one embodiment, the processor further implements the following steps when executing the computer program: if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database according to the identification information, and the target policy is determined from the policy group according to the version number; if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

[0141] In one embodiment, the processor also implements the following steps when executing the computer program: after determining the target strategy, adjusting the number of times the target strategy is used, and after a preset time, updating the strategy usage information based on the adjusted number of times used to obtain new strategy usage information; based on the new strategy usage information, executing the step of obtaining the first strategy from the strategy storage database and storing the first strategy in the memory database.

[0142] In one embodiment, the processor also implements the following steps when executing the computer program: when the target gateway receives a policy adjustment task, determine whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; if so, adjust the policy to be adjusted in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determine whether there is the policy to be adjusted in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0143] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0144] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0145] When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0146] In the case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0147] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0148] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0149] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: after determining the target strategy, the number of times the target strategy is used is adjusted, and after a preset time, the strategy usage information is updated based on the adjusted number of times used to obtain new strategy usage information; based on the new strategy usage information, the step of obtaining the first strategy from the strategy storage database and storing the first strategy in the memory database is executed.

[0151] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the target gateway receives a policy adjustment task, it is determined whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; if so, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted according to the adjustment information indicated by the policy adjustment task; if not, it is determined whether there is the policy to be adjusted in the memory database; if so, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information; if not, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

[0152] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0153] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0154] When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0155] In the case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0156] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0157] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0158] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0159] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: after determining the target strategy, the number of times the target strategy is used is adjusted, and after a preset time, the strategy usage information is updated based on the adjusted number of times used to obtain new strategy usage information; based on the new strategy usage information, the step of obtaining the first strategy from the strategy storage database and storing the first strategy in the memory database is executed.

[0160] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the target gateway receives a policy adjustment task, it is determined whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; if so, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted according to the adjustment information indicated by the policy adjustment task; if not, it is determined whether there is the policy to be adjusted in the memory database; if so, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information; if not, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

[0161] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0162] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A strategy matching method, characterized in that: The method comprises: Acquire a first policy from a policy storage database of the target gateway according to the policy usage information, and store the first policy in a memory database; When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory, wherein the number of the second policies is less than the number of the first policies; In the case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

2. The method according to claim 1, characterized in that The performing the policy matching task based on the second policy to determine the target policy includes: Determining the identification information and version number of the target component according to the strategy matching task; The target policy is determined from the second policy according to the identification information and the version number.

3. The method according to claim 2, characterized in that The determining the target policy from the second policy according to the identification information and the version number includes: Determining a policy group corresponding to the target component from the second policy according to the identification information; The target policy is determined from the policy group according to the version number.

4. The method according to claim 3, characterized in that The method further comprises: If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, then determining the policy group corresponding to the target component from the memory database according to the identification information, and determining the target policy from the policy group according to the version number; If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the memory database, the policy group corresponding to the target component is determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

5. The method according to claim 1, characterized in that The method further comprises: After determining the target strategy, adjusting the number of times the target strategy is used, and after a preset time, updating the strategy usage information based on the adjusted number of times used to obtain new strategy usage information; The steps of acquiring the first policy from the policy storage database and storing the first policy in the memory database are performed based on the new policy usage information.

6. The method according to claim 1, characterized in that The method further comprises: When the target gateway receives the policy adjustment task, determining whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; If so, adjusting the to-be-adjusted policies in the program memory, the memory database and the policy storage database according to the adjustment information indicated by the policy adjustment task; If not, determining whether the policy to be adjusted exists in the memory database; if so, adjusting the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; If it does not exist, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

7. A strategy matching device, characterized in that: The device comprises: An acquisition module, configured to acquire a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database; a determination module, configured to determine a second policy from the first policy according to the policy usage information when the target gateway is started, and store the second policy in a program memory, wherein the number of the second policies is less than the number of the first policies; An execution module is used to execute the policy matching task based on the second policy when the target gateway receives the policy matching task to determine a target policy, wherein the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images