Policy matching method, device, computer equipment, readable storage medium and program product

Abstract

The present application relates to a policy matching method, apparatus, computer device, computer-readable storage medium, and computer program product. The method comprises: obtaining a first policy from a policy storage database of a target gateway according to policy usage information, and storing the first policy in a memory database; when the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policies is less than the number of the first policies; when the target gateway receives a policy matching task, executing the policy matching task based on the second policy to determine a target policy, wherein the target policy is used to indicate whether to intercept the behavior of obtaining the target component. The use of this method can effectively improve the efficiency of policy matching.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a policy matching method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of enterprise informatization, business systems and various applications are increasingly relying on open source components for development, deployment, and maintenance. These components are often synchronized directly from official repositories and stored in the company's private repositories for internal use. However, during the synchronization process, components with security vulnerabilities may be synchronized to the private repositories, potentially allowing technical personnel to use components with security risks, leading to security issues.

[0003] In the prior art, when a component acquisition request is received, the component's policy is first matched, and then a determination is made based on the policy whether to release or intercept the component.

[0004] However, as the number of components increases and different versions of components correspond to different strategies, the strategies grow explosively, resulting in a long strategy matching process and low strategy matching efficiency. Summary of the Invention

[0005] Based on this, it is necessary to provide a more efficient strategy matching method, apparatus, computer device, computer-readable storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides a strategy matching method, comprising:

[0007] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0008] When the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0009] When the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0010] In one embodiment, the policy matching task is performed based on the second policy to determine the target policy, including: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0011] In one embodiment, determining the target policy from the second policy based on the identification information and the version number includes: determining the policy group corresponding to the target component from the second policy based on the identification information; and determining the target policy from the policy group based on the version number.

[0012] In one embodiment, the method further includes: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then determining the policy group corresponding to the target component from the in-memory database based on the identification information, and determining the target policy from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then determining the policy group corresponding to the target component from the policy storage database based on the identification information, and determining the target policy from the policy group based on the version number.

[0013] In one embodiment, the method further includes: after determining the target policy, adjusting the number of times the target policy is used, and after a preset time, updating the policy usage information based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, executing the step of obtaining the first policy from the policy storage database and storing the first policy in the memory database.

[0014] In one embodiment, the method further includes: when the target gateway receives a policy adjustment task, determining whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, adjusting the policy to be adjusted in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determining whether the policy to be adjusted exists in the memory database; if so, adjusting the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjusting the policy to be adjusted in the policy storage database according to the adjustment information.

[0015] In a second aspect, the present application further provides a strategy matching device, comprising:

[0016] an acquisition module, configured to acquire a first policy from a policy storage database of a target gateway according to the policy usage information, and store the first policy in a memory database;

[0017] a determination module, configured to determine, when the target gateway is started, a second policy from the first policy according to the policy usage information, and store the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0018] The execution module is used to execute the policy matching task based on the second policy when the target gateway receives the policy matching task, so as to determine the target policy, where the target policy is used to indicate whether to intercept the behavior of obtaining the target component.

[0019] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in any embodiment of the first aspect are implemented.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect above.

[0021] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect above.

[0022] The above-mentioned policy matching method, apparatus, computer device, computer-readable storage medium and computer program product obtain a first policy from a policy storage database of a target gateway according to policy usage information and store the first policy in a memory database; when the target gateway is started, a second policy is determined from the first policy according to the policy usage information and the second policy is stored in a program memory, wherein the number of the second policy is less than the number of the first policy; when the target gateway receives a policy matching task, the policy matching task is executed based on the second policy to determine a target policy, wherein the target policy is used to indicate whether to intercept the behavior of obtaining the target component. The method provided in the present application determines a first policy from all policies in a policy storage database according to policy usage information and stores the first policy in a memory database, and after the target gateway is started, determines a part of the policies from the first policy according to the policy usage information as a second policy and stores it in a program memory. In this way, when a policy matching task is received, policy matching can be performed based on the second policy in the program memory first, effectively reducing the number of policy matches, thereby shortening the time consumed by policy matching and improving the efficiency of policy matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 A diagram of an application environment of a strategy matching method in one embodiment;

[0025] Figure 2 A flowchart of a method for performing the policy matching task based on the second policy to determine a target policy in one embodiment;

[0026] Figure 3 is a flowchart of a method for determining the target policy from the second policy according to the identification information and the version number in one embodiment;

[0027] Figure 4 A flowchart of a method for determining, based on identification information, that no policy group corresponding to a target component exists in the second policy in one embodiment;

[0028] Figure 5 is a flow chart of a method after determining a target strategy in one embodiment;

[0029] Figure 6 1 is a flow chart of a method in one embodiment when a target gateway receives a policy adjustment task;

[0030] Figure 7 A schematic flow chart of a policy matching method according to another embodiment;

[0031] Figure 8 is a structural block diagram of a strategy matching device in one embodiment;

[0032] Figure 9 is a diagram of the internal structure of a computer device in one embodiment;

[0033] Figure 10 is a diagram showing the internal structure of a computer device in another embodiment;

[0034] Figure 11 A schematic diagram of a policy storage database, a memory database, and a program memory in one embodiment. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0036] With the development of enterprise informatization, business systems and various applications are increasingly relying on open source components for development, deployment, and maintenance. These components are often synchronized directly from official repositories and stored in the company's private repositories for internal use. However, during the synchronization process, components with security vulnerabilities may be synchronized to the private repositories, potentially allowing technical personnel to use components with security risks, leading to security issues.

[0037] In the prior art, when a component acquisition request is received, the component's policy is first matched, and then a determination is made based on the policy whether to release or intercept the component.

[0038] However, as the number of components increases and different versions of components correspond to different strategies, the number of strategies has exploded.

[0039] In the process of policy matching, the component indicated by the current component acquisition request needs to be matched with all policies one by one, which results in a long policy matching process and thus low policy matching efficiency.

[0040] In view of this, the present application provides a policy matching method, which determines the first policy from all policies in the policy storage database through policy usage information, and stores the first policy in the memory database. After the target gateway is started, a part of the policy is determined from the first policy as the second policy based on the policy usage information, and stored in the program memory. In this way, when a policy matching task is received, policy matching can be performed first based on the second policy in the program memory, effectively reducing the number of policy matches, thereby shortening the time spent on policy matching and improving the efficiency of policy matching.

[0041] The policy matching method provided in this application can be executed by a computer device, which can be a terminal or a server.

[0042] In an exemplary embodiment, Figure 1 As shown, a strategy matching method is provided, which includes the following steps:

[0043] Step 101: Obtain a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database.

[0044] Optionally, the target gateway may be a private source security gateway. A private source security gateway refers to a network security device or software system deployed in a private network environment to ensure the security of private source data and to securely manage and control access to private sources.

[0045] The policy storage database may be a MySQL database. The MySQL database is a relational database management system. The relational database can store data (policies) in different tables instead of placing all data (policies) in a large warehouse, so as to increase speed and improve flexibility.

[0046] The memory database may be a Redis database, which is a memory-based data structure storage system that can be used as a database, cache, message queue, etc.

[0047] The policy usage information can be used to characterize the frequency of policy usage within a preset time period, which can be a time period set by a technician based on actual needs.

[0048] In some exemplary embodiments, policy usage information of policies stored in the policy storage database may be collected first, for example, the policy usage information may be determined based on historical usage information of the policy storage database.

[0049] Furthermore, after determining the policy usage information of the policy storage database, the first policy may be determined from the policy storage database according to the policy usage information.

[0050] Specifically, as described above, the policy usage information is used to represent the frequency of policy usage within a preset time period. Therefore, the first policy can be determined from the policies stored in the policy storage database based on a first preset usage frequency threshold. For example, a policy with a usage frequency greater than the first preset usage frequency can be determined as the first policy.

[0051] The policies stored in the policy storage database may also be sorted according to the usage frequency indicated by the policy usage information, and the policy before the first preset sequence number may be determined as the first policy.

[0052] Furthermore, after determining the first policy from the policy storage database based on the policy usage information, the first policy can be stored in the in-memory database. For example, the first policy is stored in the in-memory database to take advantage of its fast read and write characteristics. When the first policy is frequently queried later, it can be quickly retrieved from the in-memory database, thereby reducing policy matching time and improving response speed.

[0053] Step 102: When the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in a program memory.

[0054] The number of the second strategies is smaller than the number of the first strategies.

[0055] Optionally, the program memory refers to the memory space occupied by the computer program of the target gateway during operation.

[0056] Exemplarily, since the stored policy in the program memory will be lost when the target gateway is restarted, each time the target gateway is started, it is necessary to re-determine the second policy from the first policy based on the policy usage information and store the second policy in the program memory.

[0057] In some exemplary embodiments, as described above, the first policy is determined from policies stored in a policy storage database according to policy usage information.

[0058] Specifically, the second policy may be determined based on a first preset usage frequency threshold, and then the second policy may be determined from the first policy based on the policy usage information. The second policy may be determined based on a second preset usage frequency threshold, and the first policy having a usage frequency indicated by the policy usage information greater than the second preset usage frequency threshold may be determined as the second policy. The second preset usage frequency threshold is greater than the first preset usage frequency threshold.

[0059] Alternatively, after sorting the policies according to the usage frequencies indicated by the policy usage information, the second policy may be determined according to a first preset sequence number. Alternatively, the first policies may be sorted according to the usage frequencies indicated by the policy usage information, and the first policy with a sequence number before the second preset sequence number may be determined as the second policy. The second preset sequence number is smaller than the first preset sequence number.

[0060] Furthermore, after determining the second policy from the first policy according to the policy usage information, the second policy is stored in the program memory. Exemplarily, storing the second policy in the program memory can facilitate direct and rapid access to these policies.

[0061] For example, the policy relationship stored in the policy storage database, the memory database and the program memory can be as follows: Figure 11 shown.

[0062] Step 103: When the target gateway receives the policy matching task, the target gateway executes the policy matching task based on the second policy to determine the target policy.

[0063] The target policy is used to indicate whether to intercept the behavior of obtaining the target component.

[0064] Optionally, the policy matching task refers to a process of matching a policy corresponding to a target component, where the target component refers to a component indicated by a component acquisition request, and the component acquisition request is used to acquire a component in a private source repository.

[0065] In some exemplary embodiments, when the target gateway receives a policy matching task, it may first determine a target component according to the policy matching task, and then match the target component with the second policy stored in the program memory.

[0066] Specifically, the identifiers of the target components may be matched against the second policies one by one to determine the target policy from the second policies.

[0067] The above-mentioned policy matching method obtains a first policy from the policy storage database of the target gateway according to the policy usage information, and stores the first policy in the memory database; when the target gateway is started, a second policy is determined from the first policy according to the policy usage information, and the second policy is stored in the program memory, and the number of the second policy is less than the number of the first policy; when the target gateway receives a policy matching task, the policy matching task is executed based on the second policy to determine the target policy, and the target policy is used to indicate whether to intercept the behavior of obtaining the target component. The method provided in this application determines the first policy from all the policies in the policy storage database according to the policy usage information, and stores the first policy in the memory database, and after the target gateway is started, determines a part of the policy from the first policy according to the policy usage information as the second policy, and stores it in the program memory. In this way, when a policy matching task is received, policy matching can be performed first based on the second policy in the program memory, effectively reducing the number of policy matches, thereby shortening the time consumed by policy matching, and thus improving the efficiency of policy matching.

[0068] In an exemplary embodiment, Figure 2 As shown, performing the policy matching task based on the second policy to determine the target policy includes the following steps:

[0069] Step 201: Determine the identification information and version number of the target component according to the policy matching task.

[0070] Optionally, the identification information can be used to represent the name of the target component.

[0071] In some exemplary embodiments, when the target gateway receives a policy matching task, it may first determine the identification information and version number of the target component according to the policy matching task.

[0072] Step 202: Determine the target policy from the second policy according to the identification information and the version number.

[0073] In some exemplary embodiments, after the identification information and the version number of the target component are determined, the target policy may be determined from the second policy based on a keyword algorithm, the identification information, and the version number.

[0074] Specifically, a candidate policy may be determined from the second policy based on the keyword algorithm and the identification information, and then the target policy may be determined from the candidate policies based on the keyword algorithm and the version number.

[0075] In an exemplary embodiment, Figure 3 As shown, determining the target policy from the second policy according to the identification information and the version number includes the following steps:

[0076] Step 301: Determine the policy group corresponding to the target component from the second policy according to the identification information.

[0077] Exemplarily, there are multiple policy groups in the program memory, different policy groups correspond to different components, and each policy group stores the policy of the component corresponding to the policy group.

[0078] In some exemplary embodiments, after the identification information and version number of the target component are determined, a policy group corresponding to the target component may be determined from multiple policy groups based on the identification information.

[0079] Step 302: Determine the target policy from the policy group according to the version number.

[0080] In some exemplary embodiments, after determining the policy group corresponding to the target component from multiple policy groups according to the identification information, the target policy may be determined from the policy groups according to the version number.

[0081] In an optional embodiment of the present application, in order to improve the efficiency of policy matching, the policies corresponding to each version of the component will be transformed into a policy group for a single component in the policy storage database, memory database and program memory, and the transformation results will be cached in the form of a KV dictionary to facilitate policy matching.

[0082] For example, component A has 10 versions, 1.0.0 to 1.0.9. The policies corresponding to these 10 versions can be used. Since there are hundreds of millions of open source components in the current cyberspace, the corresponding policies may exceed hundreds of millions or even billions. Therefore, using identification information for convergence and then matching based on version numbers after the identification information is hit can effectively improve the efficiency of policy matching.

[0083] In an optional embodiment of the present application, policies in the policy storage database, in-memory database, and program memory can be merged, that is, overlapping policies can be merged to reduce the number of policies and improve policy matching efficiency. Specifically, when the version ranges of multiple policies of a component overlap, the multiple policies can be merged.

[0084] In an exemplary embodiment, Figure 4As shown, if it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, the method further includes the following steps:

[0085] Step 401: Determine the policy group corresponding to the target component from the memory database according to the identification information, and determine the target policy from the policy group according to the version number.

[0086] In some exemplary embodiments, during the process of executing the policy matching task based on the second policy, if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, the policy matching task is executed based on the first policy.

[0087] Specifically, it is possible to first determine whether there is a policy group corresponding to the target component in the in-memory database based on the identification information. If so, the target policy is determined from the policy group based on the version number.

[0088] Step 402: If it is determined based on the identification information that the policy group corresponding to the target component does not exist in the memory database, the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0089] In some exemplary embodiments, if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, the policy matching task is performed based on the policy storage database.

[0090] Specifically, the policy group corresponding to the target component is directly determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

[0091] In an exemplary embodiment, Figure 5 As shown, after determining the target strategy, the method further includes the following steps:

[0092] Step 501: Adjust the usage times of the target policy, and after a preset time, update the policy usage information based on the adjusted usage times to obtain new policy usage information.

[0093] For example, each policy corresponds to a value, and the value can be used to represent the number of times the policy is used, and the number of times the policy is used can be used to determine policy usage information.

[0094] In some exemplary embodiments, after the target policy is determined, the number of times the target policy is used may be adjusted. For example, if the number of times the target policy is used is originally 0, it may be adjusted to 1 after being used once.

[0095] Furthermore, the number of times each strategy is used may be obtained at a preset time interval, and new strategy use information may be determined based on the number of times each strategy is used.

[0096] Step 502: Based on the new policy usage information, the first policy is obtained from the policy storage database and stored in the memory database.

[0097] In some exemplary embodiments, after the policy usage information is updated, the first policy and the second policy in the memory database and the program memory database need to be updated according to the new policy usage information to improve the accuracy of the first policy and the second policy, thereby improving the efficiency of policy matching.

[0098] In an optional embodiment of the present application, a value may be set for each component to represent the number of times the component's strategy is used, and the frequency of use of the component may be determined based on the number of times it is used. The frequency of use may be expressed as .

[0099] Furthermore, the large language model can be used to calculate the general usage frequency of each component within a preset time period. ,according to and The target usage frequency of each component within a preset time period can be determined, that is, , where i represents the identification information of the component, and The first strategy and the second strategy can also be determined based on the target usage frequency.

[0100] In an exemplary embodiment, Figure 6 As shown, when the target gateway receives a policy adjustment task, the method further includes the following steps:

[0101] Step 601: Determine whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory.

[0102] Optionally, the policy adjustment task may be to adjust the policy, such as adjusting the content indicated by the policy.

[0103] In some exemplary embodiments, when the target gateway receives a policy adjustment task, it may first determine whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory.

[0104] Step 602: If yes, adjust the to-be-adjusted policies in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task.

[0105] In some exemplary embodiments, if it is determined that the policy to be adjusted indicated by the policy adjustment task exists in the program memory, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted directly according to the adjustment information indicated by the policy adjustment task.

[0106] Step 603: If not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information.

[0107] In some exemplary embodiments, if it is determined that the policy to be adjusted indicated by the policy adjustment task does not exist in the program memory, it is then determined whether the policy to be adjusted exists in the memory database.

[0108] Furthermore, if it is determined that the policy to be adjusted exists in the memory database, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information.

[0109] Step 604: If it does not exist, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0110] In some exemplary embodiments, if it is determined that the policy to be adjusted does not exist in the in-memory database, the policy to be adjusted in the policy storage database is adjusted directly according to the adjustment information.

[0111] In an optional embodiment of the present application, the present application also provides a policy generation method. Specifically, since there are many secondary components in actual applications, that is, components developed and combined based on components in a private source warehouse, when determining the strategy corresponding to the secondary component, you can first determine the components involved in the secondary component based on the SBOM (Software Composition Analysis, software bill of materials) of the secondary component, and determine the strategy of the secondary component based on the strategies of these components.

[0112] For example, secondary component A is composed of A1, A2 and A3. If any of the strategies of A1, A2 and A3 is interception, then the strategy of secondary component A can be determined to be interception. If the strategies of A1, A2 and A3 are all release, then the strategy of secondary component A can be determined to be release.

[0113] The SBOM refers to a detailed list of all components, libraries, and dependencies used in the software build process, which can be obtained by software composition analysis.

[0114] In an exemplary embodiment, Figure 7As shown, another strategy matching method is provided, which includes the following steps:

[0115] Step 701: Obtain a first policy from a policy storage database of a target gateway based on policy usage information, and store the first policy in a memory database; when the target gateway is started, determine a second policy from the first policy based on the policy usage information, and store the second policy in a program memory, where the number of the second policies is less than the number of the first policies;

[0116] Step 702: When the target gateway receives the policy matching task, the target gateway determines the identification information and version number of the target component according to the policy matching task; determines the policy group corresponding to the target component from the second policy according to the identification information; and determines the target policy from the policy group according to the version number, where the target policy indicates whether to intercept the behavior of obtaining the target component.

[0117] Step 703: If it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number;

[0118] Step 704: After determining the target policy, the number of times the target policy has been used is adjusted, and after a preset time, the policy usage information is updated based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, the steps of obtaining the first policy from the policy storage database and storing the first policy in the memory database are executed;

[0119] Step 705: When the target gateway receives a policy adjustment task, determine whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, adjust the policy to be adjusted in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0120] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0121] Based on the same inventive concept, embodiments of the present application also provide a policy matching device for implementing the aforementioned policy matching method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations in one or more of the following policy matching device embodiments can be found in the aforementioned limitations on the policy matching method and will not be further elaborated here.

[0122] In an exemplary embodiment, Figure 8 As shown, a strategy matching device 800 is provided, comprising: an acquisition module 801, a determination module 802 and an execution module 803, wherein:

[0123] An acquisition module 801 is configured to acquire a first policy from a policy storage database of a target gateway according to policy usage information, and store the first policy in a memory database;

[0124] a determination module 802 configured to determine, when the target gateway is started, a second policy from the first policy according to the policy usage information, and store the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0125] The execution module 803 is configured to execute the policy matching task based on the second policy when the target gateway receives the policy matching task, so as to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0126] In one embodiment, the execution module 803 is specifically configured to determine the identification information and version number of the target component according to the policy matching task; and determine the target policy from the second policy according to the identification information and the version number.

[0127] In one embodiment, the execution module 803 is specifically configured to determine the policy group corresponding to the target component from the second policy according to the identification information; and determine the target policy from the policy group according to the version number.

[0128] In one embodiment, the execution module 803 is also used to determine the policy group corresponding to the target component from the in-memory database based on the identification information if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, and determine the target policy from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then determine the policy group corresponding to the target component from the policy storage database based on the identification information, and determine the target policy from the policy group based on the version number.

[0129] In one embodiment, the execution module 803 is also used to adjust the number of times the target policy is used after determining the target policy, and to update the policy usage information based on the adjusted number of times used after a preset time to obtain new policy usage information; based on the new policy usage information, execute the steps of obtaining the first policy from the policy storage database and storing the first policy in the memory database.

[0130] In one embodiment, the execution module 803 is also used to determine whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory when the target gateway receives the policy adjustment task; if so, adjust the policy to be adjusted in the program memory, the memory database and the policy storage database according to the adjustment information indicated by the policy adjustment task; if not, determine whether the policy to be adjusted exists in the memory database; if so, adjust the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, adjust the policy to be adjusted in the policy storage database according to the adjustment information.

[0131] Each module in the aforementioned strategy matching device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0132] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 9As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a policy matching method is implemented.

[0133] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 10 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, it implements a policy matching method. Those skilled in the art will understand that Figure 9 and Figure 10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0134] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0135] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0136] When the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0137] When the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0138] In one embodiment, when executing the computer program, the processor further implements the following steps: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0139] In one embodiment, when executing the computer program, the processor further implements the following steps: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0140] In one embodiment, when the processor executes the computer program, the following steps are also implemented: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0141] In one embodiment, when the processor executes the computer program, the following steps are also implemented: after determining the target policy, the number of times the target policy is used is adjusted, and after a preset time, the policy usage information is updated based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, the steps of obtaining the first policy from the policy storage database and storing the first policy in the memory database are executed.

[0142] In one embodiment, the processor also implements the following steps when executing the computer program: when the target gateway receives a policy adjustment task, it determines whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted according to the adjustment information indicated by the policy adjustment task; if not, it determines whether the policy to be adjusted exists in the memory database; if so, it adjusts the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; if not, it adjusts the policy to be adjusted in the policy storage database according to the adjustment information.

[0143] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0144] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0145] When the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0146] When the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0147] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0148] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0149] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: after determining the target policy, the number of times the target policy is used is adjusted, and after a preset time, the policy usage information is updated based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, the steps of obtaining the first policy from the policy storage database and storing the first policy in the memory database are executed.

[0151] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the target gateway receives a policy adjustment task, it is determined whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted according to the adjustment information indicated by the policy adjustment task; if not, it is determined whether the policy to be adjusted exists in the memory database; if so, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information; if not, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

[0152] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0153] Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database;

[0154] When the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy;

[0155] When the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

[0156] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the identification information and version number of the target component according to the policy matching task; and determining the target policy from the second policy according to the identification information and the version number.

[0157] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the policy group corresponding to the target component from the second policy according to the identification information; and determining the target policy from the policy group according to the version number.

[0158] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the second policy, then the policy group corresponding to the target component is determined from the in-memory database based on the identification information, and the target policy is determined from the policy group based on the version number; if it is determined based on the identification information that the policy group corresponding to the target component does not exist in the in-memory database, then the policy group corresponding to the target component is determined from the policy storage database based on the identification information, and the target policy is determined from the policy group based on the version number.

[0159] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: after determining the target policy, the number of times the target policy is used is adjusted, and after a preset time, the policy usage information is updated based on the adjusted number of times used to obtain new policy usage information; based on the new policy usage information, the steps of obtaining the first policy from the policy storage database and storing the first policy in the memory database are executed.

[0160] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the target gateway receives a policy adjustment task, it is determined whether the policy to be adjusted indicated by the policy adjustment task exists in the program memory; if so, the policy to be adjusted in the program memory, the memory database and the policy storage database is adjusted according to the adjustment information indicated by the policy adjustment task; if not, it is determined whether the policy to be adjusted exists in the memory database; if so, the policy to be adjusted in the memory database and the policy storage database is adjusted according to the adjustment information; if not, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

[0161] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0162] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A strategy matching method, characterized in that: The method comprises: Obtaining a first policy from a policy storage database of the target gateway according to the policy usage information, and storing the first policy in a memory database; When the target gateway is started, determining a second policy from the first policy according to the policy usage information, and storing the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy; In a case where the target gateway receives the policy matching task, the policy matching task is executed based on the second policy to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of acquiring the target component.

2. The method according to claim 1, characterized in that The performing the policy matching task based on the second policy to determine the target policy includes: Determining the identification information and version number of the target component according to the strategy matching task; The target policy is determined from the second policy according to the identification information and the version number.

3. The method according to claim 2, characterized in that The determining the target policy from the second policy according to the identification information and the version number includes: Determining a policy group corresponding to the target component from the second policy according to the identification information; The target policy is determined from the policy group according to the version number.

4. The method according to claim 3, characterized in that The method further comprises: If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the second policy, then determining the policy group corresponding to the target component from the in-memory database according to the identification information, and determining the target policy from the policy group according to the version number; If it is determined according to the identification information that the policy group corresponding to the target component does not exist in the memory database, the policy group corresponding to the target component is determined from the policy storage database according to the identification information, and the target policy is determined from the policy group according to the version number.

5. The method according to claim 1, wherein The method further comprises: After determining the target policy, adjusting the number of times the target policy is used, and after a preset time, updating the policy usage information based on the adjusted number of times used to obtain new policy usage information; The steps of acquiring the first policy from the policy storage database and storing the first policy in the memory database are performed based on the new policy usage information.

6. The method according to claim 1, characterized in that The method further comprises: When the target gateway receives the policy adjustment task, determining whether there is a policy to be adjusted indicated by the policy adjustment task in the program memory; If so, adjusting the policies to be adjusted in the program memory, the memory database, and the policy storage database according to the adjustment information indicated by the policy adjustment task; If not, determining whether the policy to be adjusted exists in the memory database; if so, adjusting the policy to be adjusted in the memory database and the policy storage database according to the adjustment information; If not, the policy to be adjusted in the policy storage database is adjusted according to the adjustment information.

7. A strategy matching device, characterized in that: The device comprises: an acquisition module, configured to acquire a first policy from a policy storage database of a target gateway according to the policy usage information, and store the first policy in a memory database; a determination module, configured to determine, when the target gateway is started, a second policy from the first policy according to the policy usage information, and store the second policy in a program memory, wherein the number of the second policy is less than the number of the first policy; An execution module is used to execute the policy matching task based on the second policy when the target gateway receives the policy matching task to determine a target policy, where the target policy is used to indicate whether to intercept the behavior of obtaining the target component.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images