Firewall security policy adaptive migration method and device, equipment and medium

Abstract

The invention provides a firewall security policy adaptive migration method and device, equipment and a medium. The method comprises the steps that a server obtains whether firewall information of a first client is changed or not, and if yes, old address information needing to be changed in the firewall information is obtained; obtaining whether the old address information exists in firewall information of a second client, and if yes, replacing the changed new address information in the firewall information to the second client; and obtaining whether the old definition of the new address information exists in the firewall information of the first client and / or the second client, and if yes, deleting the old definition of the new address information in the first client and / or the second client. According to the method, migration can be conveniently and effectively achieved, and the migration risk is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a firewall security policy adaptive migration method, device, equipment and medium. Background Art

[0002] Firewall technology is the most commonly used and effective defense measure in network security. It helps computer networks build a relatively isolated protection barrier between intranets and extranets to protect user data and information security.

[0003] With the rapid development of business in recent years, the access control requirements within the data center, especially in the test environment, have become increasingly complex, and the number of access control policies has increased rapidly, which has brought great challenges to the accurate implementation of firewall policies. In a complex system, when the security policy in the firewall needs to be changed and migrated, the maintenance personnel of the relevant applications need to perform manual migration. Manual processing is bound to cause omissions, resulting in risks and inefficiency.

[0004] Therefore, the present application proposes a more convenient and efficient adaptive migration method. Summary of the invention

[0005] The present application provides a firewall security policy adaptive migration method, device, equipment and medium to solve the problems of low efficiency and easy omissions in manual processing in the prior art.

[0006] In a first aspect, the present application provides a firewall security policy adaptive migration method, including:

[0007] The server obtains whether the firewall information of the first client is changed, and if so, obtains the old address information that needs to be changed in the firewall information;

[0008] Obtaining whether the old address information exists in the firewall information of the second client, and if so, replacing the changed new address information in the firewall information with the second client;

[0009] Obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client, and if so, delete the old definition of the new address information in the first client and / or the second client.

[0010] In a possible implementation manner, replacing the changed new address information in the firewall information to the second client includes:

[0011] If the old address information that needs to be changed exists in the firewall information of the second client, the changed new address information in the firewall information is added to the firewall information of the second client, and the old address information is deleted, wherein,

[0012] The firewall information includes address information, the address information includes a source address and a destination address, the source address is used to indicate an incoming address, the destination address is used to indicate a received address, and the old address information includes at least one of an old source address and an old destination address.

[0013] In a possible implementation manner, obtaining whether there is an old definition of the new address information in the firewall information of the first client and / or the second client includes:

[0014] If at least one of the new source address and the new destination address in the changed new address information in the firewall information exists in the firewall information of the first client and / or the second client, it is confirmed that there is an old definition of the new address information in the firewall information of the first client and / or the second client.

[0015] In a possible implementation, the server obtains whether the firewall information of the first client is changed, including:

[0016] If the changed new address information in the firewall information is inconsistent with the old address information that needs to be changed in the firewall information, confirming that the firewall information of the first client has been changed, and saving the new address information in the database of the server;

[0017] If the new address information after the change in the firewall information is consistent with the old address information that needs to be changed in the firewall information, it is confirmed that the current process is ended.

[0018] In a possible implementation, before confirming the end of the current process, the method further includes:

[0019] If the action message corresponding to the changed new address information in the firewall information is updated, the updated action message will be replaced to the location of the action message corresponding to the old address information that needs to be changed in the firewall information; wherein the firewall information includes an action message, and the action message is used to instruct the address information to perform an action.

[0020] In a possible implementation, before the server obtains whether the firewall information of the first client is changed, the method further includes:

[0021] The firewall information of the first client is obtained through the reporting instruction of the first client, wherein the first client feeds back the reporting instruction to the first client according to a preset period, and the reporting instruction includes the firewall information of the first client.

[0022] In a possible implementation manner, if there are a preset number of second clients whose performance indicators exceed preset performance, the method further includes:

[0023] Confirm that the firewall information of the first client is forwarded to the second client through the server, so that the second client confirms whether to update the firewall information of the second client according to the firewall information of the first client.

[0024] In a second aspect, the present application provides a firewall security policy adaptive migration device, comprising:

[0025] A confirmation module, used for the server to obtain whether the firewall information of the first client has changed, and if so, to obtain the old address information that needs to be changed in the firewall information;

[0026] A processing module, used for obtaining whether the old address information exists in the firewall information of the second client, and if so, replacing the changed new address information in the firewall information to the second client;

[0027] A clearing module is used to obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client, and if so, delete the old definition of the new address information in the first client and / or the second client.

[0028] In a third aspect, the present application provides a firewall security policy adaptive migration device, including: at least one processor and a memory;

[0029] The memory stores computer-executable instructions;

[0030] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the firewall security policy adaptive migration method as described above.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the firewall security policy adaptive migration method as described above.

[0032] The present application provides a firewall security policy adaptive migration method, apparatus, device and medium. A server obtains whether the firewall information of a first client has changed. If so, the server obtains old address information that needs to be changed in the firewall information; obtains whether the old address information exists in the firewall information of a second client. If so, the server replaces the changed new address information in the firewall information to the second client; obtains whether the firewall information of the first client and / or the second client has an old definition of the new address information. If so, the server deletes the old definition of the new address information in the first client and / or the second client.

[0033] In the above method, the first client is responsible for reporting the firewall information, and the server is responsible for receiving the firewall information. When the server finds that the firewall information has changed, it can search for the client containing the old address information in the second client according to the old address information that needs to be changed in the firewall information, and replace the old address information with the new address information to realize automatic migration of the firewall information; if the new address information has been old defined (occupied) by the first client and / or the second client, then the old defined new address information will be deleted to ensure that the new operation of the new address information is not affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0035] Figure 1 A schematic diagram of a scenario of adaptive migration of firewall security policies provided in an embodiment of the present application;

[0036] Figure 2 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 1 ;

[0037] Figure 3 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 2 ;

[0038] Figure 4 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 3 ;

[0039] Figure 5 A diagram of a firewall security policy adaptive migration device provided by an embodiment of the present invention;

[0040] Figure 6 A hardware schematic diagram of a firewall security policy adaptive migration device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] In the actual production process of enterprises, as business changes lead to different security needs, firewalls need to be replaced during the customer's on-site network equipment upgrade process, and the data involved in the replaced firewall will be migrated to the new firewall.

[0043] Large data center LANs usually deploy thousands of servers and storage devices, hosting the daily operation of hundreds of application systems. To ensure the normal development of various businesses, there are extremely complex access relationships between different nodes of the same application and between different applications.

[0044] The existing migration process generally requires maintenance personnel to manually identify firewall requirements through application access relationships and then complete firewall data migration; however, this approach is inefficient and prone to errors, which brings risks to the migration process; the best existing processing method is to change the border firewall policy, which involves a very small number of firewalls and cannot meet the needs of complex and large firewall systems, and the efficiency improvement is limited.

[0045] Therefore, the present application proposes a processing method that can automatically perform migration according to the change of demand, thereby improving processing efficiency.

[0046] The following describes the implementation process of a firewall security policy adaptive migration method proposed in the present application in conjunction with the accompanying drawings and specific embodiments.

[0047] Figure 1 A schematic diagram of a scenario of adaptive migration of firewall security policies provided in an embodiment of the present application. Figure 1 As shown, the system includes: a server 101, a first client 102 and a second client 103; wherein,

[0048] The first client 102 and the second client 103 can both be established on a server device different from the server 101, and are used to proxy client services (at this time, the first client 102 and the second client 103 complete registration with the server 101), etc. The first client 102 is a certain client device, and the second client 103 is at least one client device, which is equivalent to a client group, and the first client 102 can be included in the second client 103;

[0049] The server 101 is set on a server device and can be used to manage the first client 102 and the second client 103, including receiving client information; when the first client 102 changes the firewall information, it can report to the server 101 at a regular time, and the server 101 receives the firewall information of the first client 102. If it is confirmed that the firewall information of the first client 102 has changed, it searches for old address information that needs to be changed in the firewall information of the second client 103. If so, the old address information is replaced with the changed new address information to complete the migration of the firewall information;

[0050] If the address corresponding to the changed new address information has been used in the firewall information of the second client 103, then the address corresponding to the new address information is deleted to avoid conflict with the changed new address information.

[0051] Figure 2 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 1 .like Figure 2 As shown, the method includes:

[0052] S201. The server obtains whether the firewall information of the first client is changed.

[0053] When there are multiple clients in the environment (multiple servers are configured as agents, including the first client and the second client), and the performance of each agent is sufficient, then one of the clients (the first client) obtains the firewall information in real time and sends it to the server (the server is configured as a manager). The server confirms whether the firewall information has changed based on the firewall information reported by the first client before and after.

[0054] The firewall information of the first client may be actively reported after the first client is connected to the server:

[0055] For example, the firewall information of the first client is obtained through a reporting instruction of the first client, wherein the first client feeds back the reporting instruction to the first client according to a preset period, and the reporting instruction includes the firewall information of the first client.

[0056] The server receives the firewall information reported by the first client according to the reporting instruction. The first client reports the firewall information to the server regularly, and the reporting time interval is a preset period, so the firewall information reported by the server at the current moment may be different from the firewall information reported at the previous moment.

[0057] S202: If the firewall information of the first client is changed, old address information that needs to be changed in the firewall information is obtained.

[0058] When the firewall information of the first client is changed, the changed old address information is first confirmed, so as to subsequently search in the second client whether the second client has the old address information.

[0059] S203: Obtain whether the old address information exists in the firewall information of the second client.

[0060] Obtain the firewall information of the second client, compare the firewall information of the second client with the old address information that needs to be changed for the first client, and confirm whether the old address information exists in the firewall information of the second client; for example, the old address information 1.1.1.4 of the firewall information of the first client is changed to the new address information 1.2.3.4. If the firewall information of the second client has the address 1.1.1.4, then the old address information exists in the firewall information of the second client.

[0061] S204: If the old address information exists in the firewall information of the second client, replace the changed new address information in the firewall information with the second client.

[0062] As long as there is a second client with old address information, the old address information of the second client should be replaced with the new address information; for example, find the address 1.1.1.4 of the second client and replace it with the address 1.2.3.4.

[0063] S205: Obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client.

[0064] When the first client and / or the second client changes the address information, in order to ensure the normal operation of the new address information, it is necessary to confirm whether the firewall information in the first client and / or the second client has the old definition of the new address information.

[0065] S206: If there is an old definition of the new address information in the firewall information of the first client and / or the second client, delete the old definition of the new address information in the first client and / or the second client.

[0066] If the firewall information in the first client and / or the second client contains the old definition of the new address information, the old definition of the new address information can be directly deleted (the new address information is also deleted at the same time); for example, the firewall information in the first client and / or the second client contains the address 1.2.3.4, which corresponds to the old definition of the usage. In order to avoid conflict with the new definition of the usage, the old definition of the usage needs to be deleted, and the address 1.2.3.4 is also deleted at the same time.

[0067] In an embodiment of the present application, the first client is responsible for reporting firewall information, and the server is responsible for receiving firewall information. When the server finds that the firewall information has changed, it can search for the client containing the old address information in the second client according to the old address information that needs to be changed in the firewall information, and replace the old address information with the new address information to achieve automatic migration of the firewall information; if the new address information has been old defined (occupied) by the first client and / or the second client, then the old defined new address information will be deleted to ensure that the new operation of the new address information is not affected.

[0068] Figure 3 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 2 .like Figure 3 As shown, the method includes:

[0069] S301. If the changed new address information in the firewall information is inconsistent with the old address information that needs to be changed in the firewall information, confirm that the firewall information of the first client has been changed, and save the new address information in the database of the server.

[0070] The server compares the old address information in the firewall information of the first client with the new address information in the firewall information of the first client. If the two are not completely consistent, it means that the firewall information of the first client has changed. The new address information can be saved in the server's database, and the server can traverse the firewall information of each second client to see if there is any address that is consistent with the old and new address information. If so, corresponding processing will be performed.

[0071] S302: If the old address information that needs to be changed exists in the firewall information of the second client, the changed new address information in the firewall information is added to the firewall information of the second client, and the old address information is deleted, wherein:

[0072] The firewall information includes address information, the address information includes a source address and a destination address, the source address is used to indicate an incoming address, the destination address is used to indicate a received address, and the old address information includes at least one of an old source address and an old destination address.

[0073] Firewall information can be expressed as <IP S ,IP D ,Action>; where IP S is the source address, indicating that the current client can be accessed by the source address; IP D is the target address, indicating that the current client can access the target address; Action is the action message, indicating the actions that can be taken, such as accept, forward, and send;

[0074] If there is old address information that needs to be changed in the firewall information of the second client, the new address information after the change in the firewall information is first added to the firewall information of the second client, and then the old address information is deleted; for example, the old address information belongs to the IP address of the second client. S (or IP D ), the new address information is represented by new_ip, and the old address information is represented by old_ip, then the new address information can replace the old address information by: S Change to IP S ∪{new_ip}-{old_ip} (or IP D Change to IP D ∪{new_ip}-{old_ip}); bring in actual data explanation:

[0075] IP S ={1.1.1.1-1.1.1.10}, IP D ={0.0.0.0 / 0}, when 1.1.1.4 is changed to 1.2.3.4, the changed IP S ={1.1.1.1-1.1.1.3}∪{1.1.1.5-1.1.1.10}∪{1.2.3.4}, IP D ={0.0.0.0 / 0}, it can be seen that in IP S 1.1.1.4 was deleted and 1.2.3.4 was added.

[0076] S303. If at least one of the new source address and the new destination address in the changed new address information in the firewall information exists in the firewall information of the first client and / or the second client, it is confirmed that an old definition of the new address information exists in the firewall information of the first client and / or the second client.

[0077] If the firewall information of the first client and / or the second client contains the changed new address information, the new address information in the firewall information of the first client and / or the second client needs to be deleted; the new address information includes a new source address and a new destination address, and as long as any of the first client and / or the second client exists, the corresponding address needs to be deleted;

[0078] For example, the new address information belongs to the IP address of the first client and / or the second client. S (or IP D ), the new address information is represented by new_ip, and the old address information is represented by old_ip. Then the new address information can be deleted by: S Change to IP S -{new_ip}(or change IP D Change to IP D -{new_ip}).

[0079] S304: If the new address information after the change in the firewall information is consistent with the old address information that needs to be changed in the firewall information, confirm that the current process is ended.

[0080] If the old address information in the firewall information of the first client is completely consistent with the new address information in the firewall information of the first client, it means that the firewall information of the first client has not changed, and there is no need to migrate the firewall information, and no further processing is performed.

[0081] In addition to updating address information, the firewall may also have changes in action messages:

[0082] For example, if the action message corresponding to the new address information after the change in the firewall information is updated, the updated action message is replaced with the location of the action message corresponding to the old address information that needs to be changed in the firewall information; wherein the firewall information includes an action message, and the action message is used to instruct the address information to perform an action.

[0083] If the change in address information is accompanied by a change in action message, the action message is changed at the corresponding position; for example, IP S The corresponding Action is to allow forwarding. If the subsequent Action is changed to allow receiving, then the corresponding IP S The corresponding Action is modified.

[0084] In an embodiment of the present application, the specific address information in the firewall information, including the source address and the destination address, is used to confirm whether the firewall information of the first client has changed. If so, the client with the corresponding address information (including the new and old address information) is found to migrate the firewall information, thereby realizing autonomous migration of the firewall information and increasing migration efficiency.

[0085] Figure 4 A flowchart of a firewall security policy adaptive migration method provided in an embodiment of the present application Figure 3 .like Figure 4 As shown, the method includes:

[0086] If there are a preset number of second clients whose performance indicators exceed the preset performance, confirm that the firewall information of the first client is forwarded to the second client through the server, so that the second client confirms whether to update the firewall information of the second client based on the firewall information of the first client.

[0087] If the performance indicator of the second client exceeds the preset performance, the server can broadcast it. Before the second client receives the firewall information of the first client, the server confirms that the firewall information has changed. After storing the changed information in the data center, the firewall information of the first client is sent to the second client, which is then handed over to the second client and / or the first client for processing.

[0088] Example:

[0089] S401. The server confirms that the firewall information of the first client has changed, and sends the firewall information of the first client to the second client.

[0090] The above embodiment mainly describes that the server traverses the client firewall information, finds out the client that needs to implement the firewall information change, and then sends the change method to the corresponding client. This belongs to the unicast situation. When the client performance is insufficient, this arrangement can be made; if the client performance is sufficient, the server can also be used as a control medium to obtain the firewall information uploaded by a certain client (the first client). When it is confirmed that the firewall information has changed, the firewall information is directly forwarded to each client. This belongs to the broadcast situation;

[0091] The difference between broadcast and unicast is that unicast only needs to find the client corresponding to the changed address and send the change, while broadcast is that the server confirms that the client's address information has changed, and sends the changed firewall information to all clients, allowing the client to confirm whether it has the corresponding address. If not, no processing will be performed. If yes, each client and the server will perform similar deletion and replacement processing as in unicast. See the following steps for details.

[0092] S402: Obtain old address information that needs to be changed in the firewall information of the first client, and confirm whether the old address information exists in the firewall information of the second client.

[0093] Each second client confirms by itself whether there is corresponding old address information in its own firewall information.

[0094] S403: If the old address information exists in the firewall information of the second client, replace the changed new address information in the firewall information with the second client.

[0095] If the second client finds that there is corresponding old address information in its firewall information, then the new address information of the first client to replace the old address information is replaced to the corresponding position of the firewall information of the second client; the specific example is consistent with the replacement method of the server, and will not be repeated here;

[0096] The first client must have the old address information, which can be directly replaced with the new address information.

[0097] S404: Obtain whether there is an old definition of the new address information in the firewall information of the second client; if yes, delete the old definition of the new address information in the first client and / or the second client.

[0098] If the first client and / or the second client finds that there is an old definition of the corresponding new address information in their firewall information, the old definition of the new address information is deleted to avoid conflicts in the operation of the new address information that replaces the old address information.

[0099] In the embodiment of the present application, considering the situation where the server performance is relatively good, each server can confirm whether it needs to change the firewall information by itself, which relatively reduces the work of the server and also realizes adaptive migration.

[0100] In addition to broadcast and unicast forms, the firewall information replacement process can also be implemented through the openstack management platform. When one server is a server (with manager installed) and other servers do not have agents installed, the other servers are managed through the openstack management platform, where the server periodically queries each other server whether there is a firewall information change, and sends the changed firewall information to each other server through the ansible tool, allowing other servers to confirm whether they have corresponding new and old address information that needs to be processed (similar to the client processing process in broadcasting, the specific examples will not be repeated); the core steps in the adaptive migration method of this application can be applied in different environments, which facilitates firewall information migration.

[0101] Figure 5 A diagram of a firewall security policy adaptive migration device provided by an embodiment of the present invention, such as Figure 5 As shown, the device includes: a confirmation module 501, a processing module 502 and a clearing module 503;

[0102] The confirmation module 501 is used for the server to obtain whether the firewall information of the first client has been changed, and if so, to obtain the old address information that needs to be changed in the firewall information.

[0103] The processing module 502 is used to obtain whether the old address information exists in the firewall information of the second client, and if so, replace the changed new address information in the firewall information with the second client.

[0104] The clearing module 503 is used to obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client, and if so, delete the old definition of the new address information in the first client and / or the second client.

[0105] The present application also provides a firewall security policy adaptive migration device, including: at least one processor and a memory;

[0106] The memory stores computer-executable instructions;

[0107] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the firewall security policy adaptive migration method.

[0108] Figure 6 The hardware diagram of the firewall security policy adaptive migration device provided by the embodiment of the present invention is as follows. Figure 6 As shown, the firewall security policy adaptive migration device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. The device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0109] In a specific implementation process, at least one processor 601 executes the computer-executable instructions stored in the memory 602, so that at least one processor 601 executes the above firewall security policy adaptive migration method.

[0110] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0111] In the above Figure 6In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0112] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0113] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0114] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the firewall security policy adaptive migration method as described above is implemented.

[0115] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0116] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0117] The division of the units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0118] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0119] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0120] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A firewall security policy adaptive migration method, characterized in that: include: The server obtains whether the firewall information of the first client is changed, and if so, obtains the old address information that needs to be changed in the firewall information; Obtaining whether the old address information exists in the firewall information of the second client, and if so, replacing the changed new address information in the firewall information with the second client; Obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client, and if so, delete the old definition of the new address information in the first client and / or the second client.

2. The method according to claim 1, characterized in that The step of replacing the changed new address information in the firewall information with the second client includes: If the old address information that needs to be changed exists in the firewall information of the second client, the changed new address information in the firewall information is added to the firewall information of the second client, and the old address information is deleted, wherein, The firewall information includes address information, the address information includes a source address and a destination address, the source address is used to indicate an incoming address, the destination address is used to indicate a received address, and the old address information includes at least one of an old source address and an old destination address.

3. The method according to claim 2, characterized in that The obtaining whether there is an old definition of the new address information in the firewall information of the first client and / or the second client includes: If at least one of the new source address and the new destination address in the changed new address information in the firewall information exists in the firewall information of the first client and / or the second client, it is confirmed that there is an old definition of the new address information in the firewall information of the first client and / or the second client.

4. The method according to claim 1, characterized in that: The server obtains whether the firewall information of the first client is changed, including: If the changed new address information in the firewall information is inconsistent with the old address information that needs to be changed in the firewall information, confirming that the firewall information of the first client has been changed, and saving the new address information in the database of the server; If the new address information after the change in the firewall information is consistent with the old address information that needs to be changed in the firewall information, it is confirmed that the current process is ended.

5. The method according to claim 4, characterized in that Before confirming the end of the current process, the method further includes: If the action message corresponding to the changed new address information in the firewall information is updated, the updated action message will be replaced to the location of the action message corresponding to the old address information that needs to be changed in the firewall information; wherein the firewall information includes an action message, and the action message is used to instruct the address information to perform an action.

6. The method according to claim 1, characterized in that Before the server obtains whether the firewall information of the first client has been changed, the method further includes: The firewall information of the first client is obtained through the reporting instruction of the first client, wherein the first client feeds back the reporting instruction to the first client according to a preset period, and the reporting instruction includes the firewall information of the first client.

7. The method according to claim 1, characterized in that If there are a preset number of the second clients whose performance indicators exceed the preset performance, the method further includes: Confirm that the firewall information of the first client is forwarded to the second client through the server, so that the second client confirms whether to update the firewall information of the second client according to the firewall information of the first client.

8. A firewall security policy adaptive migration device, characterized in that: include: A confirmation module, used for the server to obtain whether the firewall information of the first client has changed, and if so, to obtain the old address information that needs to be changed in the firewall information; A processing module, used for obtaining whether the old address information exists in the firewall information of the second client, and if so, replacing the changed new address information in the firewall information to the second client; A clearing module is used to obtain whether there is an old definition of the new address information in the firewall information of the first client and / or the second client, and if so, delete the old definition of the new address information in the first client and / or the second client.

9. A firewall security policy adaptive migration device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the firewall security policy adaptive migration method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the firewall security policy adaptive migration method as described in any one of claims 1 to 7 are implemented.

Images