Cluster network reinforcement method, apparatus and device, and storage medium

Abstract

The invention relates to a cluster network reinforcement method, device and equipment and a storage medium, the method is suitable for a target node in a cluster, and the method comprises the following steps: in response to receiving a first network reinforcement strategy sent by a console, storing the first network reinforcement strategy into a local cache of the target node; applying the first network reinforcement strategy on the target node, and determining a cluster test result of performing a network connectivity test on the cluster after the application is completed; if the cluster test result is not passed, a second network reinforcement strategy received by the target node in history is obtained from the local cache of the target node, strategy rollback is carried out, and a cluster test result corresponding to the second network reinforcement strategy is passed. According to the method and the device, the local cache and the network connectivity test are set, and the historically collected network reinforcement strategy is acquired from the local cache and rolled back after the fault is caused by application of the new network reinforcement strategy, so that the node fault can be automatically recovered, and the risk caused by misoperation of a user is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a cluster network reinforcement method, device, equipment and storage medium. Background Art

[0002] The network reinforcement of a cluster refers to strict port access rights control for each server in the cluster environment, aiming to prevent unauthorized external access and ensure the security of the cluster system. Traditional network reinforcement methods usually require manually running scripts on each server to configure security rules. However, this method is not only complex to operate, but also requires high professional skills of operation and maintenance personnel. In order to simplify the operation, the method of using a console to provide users with a self-service management portal has gradually been applied and promoted. Users can configure and manage the network reinforcement strategy of the cluster on the console. However, some misoperations may occur during the configuration process, resulting in network failures in the cluster, and even causing serious consequences such as interruption of inter-cluster communication and loss of connection to the control console. Once these situations occur, users can only seek help from the operation and maintenance personnel of the cluster manufacturer to restore through background login, which requires a long period of time and costs a lot, which will have a serious impact on the continuity and stability of the business. Therefore, how to optimize the cluster network reinforcement method to reduce the risks brought by user misoperation has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a cluster network reinforcement method, device, equipment and storage medium.

[0004] A first aspect of an embodiment of the present disclosure provides a cluster network reinforcement method, the method comprising:

[0005] In response to receiving the first network hardening policy sent by the console, storing the first network hardening policy in a local cache of the target node;

[0006] Applying the first network hardening strategy on the target node, and determining a cluster test result of performing a network connectivity test on the cluster after the application is completed;

[0007] If the cluster test result is failed, the second network hardening policy historically received by the target node is obtained from the local cache of the target node, and the policy is rolled back based on the second network hardening policy, and the cluster test result corresponding to the second network hardening policy is passed.

[0008] A second aspect of an embodiment of the present disclosure provides a cluster network reinforcement device, the device comprising:

[0009] a cache module, configured to, in response to receiving a first network hardening policy sent by the console, store the first network hardening policy in a local cache of the target node;

[0010] An application module, configured to apply the first network hardening strategy on the target node, and determine a cluster test result of performing a network connectivity test on the cluster after the application is completed;

[0011] The rollback module is used to obtain the second network hardening strategy historically received by the target node from the local cache of the target node if the cluster test result is failed, and perform a policy rollback based on the second network hardening strategy, and the cluster test result corresponding to the second network hardening strategy is passed.

[0012] A third aspect of an embodiment of the present disclosure provides a computer device, including a memory and a processor, and a computer program, wherein the computer program is stored in the memory, and when the computer program is executed by the processor, the cluster network reinforcement method as described in the first aspect above is implemented.

[0013] A fourth aspect of an embodiment of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the cluster network reinforcement method as described in the first aspect above is implemented.

[0014] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0015] In the cluster network reinforcement method, apparatus, device and storage medium provided by the embodiments of the present disclosure, in response to receiving a first network reinforcement policy sent by a console, the first network reinforcement policy is stored in the local cache of the target node, the first network reinforcement policy is applied on the target node, and after the application is completed, a cluster test result of a network connectivity test on the cluster is determined. If the cluster test result is not passed, a second network reinforcement policy historically received by the target node is obtained from the local cache of the target node, and a policy rollback is performed based on the second network reinforcement policy. If the cluster test result corresponding to the second network reinforcement policy is passed, the cluster test result can be performed on the cluster node. Set up a local cache for storing network reinforcement policies, and test the network connectivity of the cluster after applying a new network reinforcement policy. When the new network reinforcement policy causes network disconnection, obtain the historically collected network reinforcement policies that enable normal communication from the local cache and roll back, so that node failures can recover by themselves without waiting for operation and maintenance personnel to log in to the background for recovery, avoiding reliance on external communication and operation and maintenance personnel intervention, significantly improving the stability and self-healing ability of the network, reducing the complexity and downtime costs of traditional operation and maintenance operations, and reducing the risks brought by user misoperation, providing a more efficient management solution for network security reinforcement delivered by cluster products. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 is a flow chart of a cluster network reinforcement method provided by an embodiment of the present disclosure;

[0019] Figure 2 is a flow chart of a method for determining cluster test results provided by an embodiment of the present disclosure;

[0020] Figure 3 is a flow chart of a method for obtaining a second network reinforcement strategy provided by an embodiment of the present disclosure;

[0021] Figure 4 is a flow chart of a method for applying a first network reinforcement strategy provided by an embodiment of the present disclosure;

[0022] Figure 5 It is a structural schematic diagram of a cluster network reinforcement device provided by an embodiment of the present disclosure;

[0023] Figure 6 It is a structural diagram of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0026] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0027] Figure 11 is a flow chart of a cluster network reinforcement method provided by an embodiment of the present disclosure. The method can be executed by a cluster network reinforcement device, and the cluster network reinforcement device can be set on a target node in the cluster. Figure 1 As shown, the cluster network reinforcement method provided in this embodiment includes the following steps:

[0028] S101. In response to receiving a first network hardening policy sent by a console, storing the first network hardening policy in a local cache of a target node.

[0029] The target node in the embodiment of the present disclosure may be any node in the cluster.

[0030] The network reinforcement policy in the disclosed embodiment can be understood as a policy that restricts port access rights in order to improve network security. For example, the network reinforcement policy can allow nodes in the cluster to communicate with each other through ports 22, 80, 443, 8080, and 8081, and other ports are denied access by default. Optionally, in the same batch of network reinforcement policies issued by the console to each node in the cluster, the network reinforcement policies received by different nodes can be the same or different, which is not limited here.

[0031] In the disclosed embodiment, the cluster network reinforcement device can store the first network reinforcement policy in the local cache of the target node after receiving the first network reinforcement policy issued by the control console, thereby saving the first network reinforcement policy locally on the target node, ensuring that when the network is abnormal, the target node can still independently obtain and apply the required policy.

[0032] In an exemplary embodiment of the present disclosure, when a user turns on network hardening for the first time through the console, the console will first issue a default policy to each node in the cluster, allowing access to all ports, so that when a policy rollback is required for a user's erroneous operation, it is guaranteed that there is at least one network hardening policy that can restore the network connectivity of the cluster.

[0033] S102: Apply the first network hardening strategy on the target node, and determine a cluster test result of performing a network connectivity test on the cluster after the application is completed.

[0034] The network connectivity test in the disclosed embodiments may include a ping test and a connection test of a specified port. For example, for a network hardening policy that allows nodes in a cluster to communicate with each other through ports 22, 80, 443, 8080, and 8081, and denies access to other ports by default, it is possible to check whether the nodes in the cluster can communicate normally through ports 22, 80, 443, 8080, and 8081.

[0035] In the disclosed embodiment, the cluster network hardening device can apply the first network hardening strategy on the target node after receiving the first network hardening strategy. Specifically, it can be applied to the firewall of the target node to configure the firewall, and after the configuration is completed, determine the cluster test result of the network connectivity test of the cluster.

[0036] In an exemplary implementation of the disclosed embodiment, the cluster network reinforcement device may first perform a network connectivity test on the target node itself to obtain a test result, then obtain the test results of other nodes in the cluster that have undergone a network connectivity test, and determine the cluster test result in combination with the test results of the target node and other nodes.

[0037] S103: If the cluster test result is failed, obtain the second network hardening policy historically received by the target node from the local cache of the target node, and roll back the policy based on the second network hardening policy. The cluster test result corresponding to the second network hardening policy is passed.

[0038] In the disclosed embodiment, after determining the cluster test result, the cluster network reinforcement device can, when the cluster test result is that the network connectivity test has failed, determine that the first network reinforcement strategy configured this time is a user error operation and cannot support normal communication of the cluster, and therefore needs to perform a policy rollback operation. Specifically, the local cache of the target node can be accessed, and the second network reinforcement strategy with the corresponding cluster test result of passing that the target node has historically received can be obtained from the local cache, and the second network reinforcement strategy can be applied to implement the policy rollback.

[0039] In an exemplary implementation of the embodiments of the present disclosure, the cluster network reinforcement device can re-determine the cluster test result of the network connectivity test on the cluster after performing a policy rollback based on the second network reinforcement policy. If the cluster test result is passed, the recovery is confirmed to be successful. Otherwise, other network reinforcement policies with corresponding cluster test results of passed that have been historically received are continued to be obtained from the local cache of the target node, and the policy is rolled back based on the other network reinforcement policies until the recovery is confirmed to be successful. If other network reinforcement policies cannot ensure that the cluster passes the network connectivity test, a reminder message is sent to relevant personnel.

[0040] The disclosed embodiment stores the first network reinforcement policy in a local cache of a target node in response to receiving a first network reinforcement policy sent by a console, applies the first network reinforcement policy on the target node, and determines a cluster test result of a network connectivity test on the cluster after the application is completed. If the cluster test result is a failure, a second network reinforcement policy historically received by the target node is obtained from the local cache of the target node, and the policy is rolled back based on the second network reinforcement policy. The cluster test result corresponding to the second network reinforcement policy is a pass. A local cache for storing network reinforcement policies can be set on the cluster node. After applying a new network reinforcement policy, a network connectivity test is performed on the cluster. When the new network reinforcement policy causes the network to be unavailable, a historically collected network reinforcement policy that can communicate normally is obtained from the local cache and rolled back, so that the node failure can be recovered by itself without waiting for the operation and maintenance personnel to log in to the background for recovery, avoiding reliance on external communication and the intervention of operation and maintenance personnel, significantly improving the stability and self-healing ability of the network, reducing the complexity and downtime cost of traditional operation and maintenance operations, reducing the risks brought by user misoperation, and providing a more efficient management solution for network security reinforcement delivered by cluster products.

[0041] Figure 2 is a flow chart of a method for determining cluster test results provided by an embodiment of the present disclosure, such as Figure 2 As shown, based on the above embodiment, the cluster test result can be determined by the following method.

[0042] S201. Perform a network connectivity test on a target node based on a first network hardening strategy to obtain a target node test result.

[0043] In the disclosed embodiment, after applying the first network reinforcement strategy, the cluster network reinforcement device can perform a network connectivity test on the target node for the port included in the first network reinforcement strategy according to the content of the first network reinforcement strategy to obtain a target node test result.

[0044] S202: If the target node test result is failed, determine that the cluster test result is failed.

[0045] In the disclosed embodiment, the cluster network reinforcement device can determine that the target node test result is failed when there is a port included in the first network reinforcement strategy that cannot complete communication according to the access connection method corresponding to the port. Since the cluster needs to ensure that each node in the cluster can pass the network connectivity test in order to pass the network connectivity test, when the target node test result is failed, the cluster network reinforcement device can directly determine that the cluster test result is failed.

[0046] S203. If the target node test result is passed, the target node test result is reported to the console, so that the console determines the cluster test result based on the target node test result and the reporting status of the node test results of each other node in the cluster except the target node, and sends the cluster test result to each node in the cluster. Among them, when the reporting status is that all other nodes report node test results and the reported node test results are all passed, the cluster test result is passed, otherwise the cluster test result is failed.

[0047] In the disclosed embodiment, the cluster network reinforcement device can determine that the target node test result is passed when all ports included in the first network reinforcement strategy can complete communication according to the access connection mode corresponding to the port, and the target node and the console can communicate normally, so the target node test result is reported to the console. The console will receive the target node test result reported by the target node within a preset timeout period, as well as the node test results reported by each other node in the cluster except the target node after performing a network connectivity test according to the network reinforcement strategy corresponding to the other nodes, and determine the cluster test result based on the target node test result and the reporting of the node test results by other nodes. Specifically, if all other nodes pass the network connectivity test and report the corresponding node test results to the console, the console can determine that the cluster test result is passed. If some nodes fail the network connectivity test and do not report the node test results to the console, or the reported node test results are failed, the console does not receive the node test results reported by all nodes within the timeout period, or the received node test results include failed results. The cluster test result can be determined as failed, and the cluster test result is sent down to each node in the cluster including the target node.

[0048] The disclosed embodiment performs a network connectivity test on the target node based on the first network reinforcement strategy to obtain a target node test result. If the target node test result is failed, the cluster test result is determined to be failed. If the target node test result is passed, the target node test result is reported to the console, so that the console determines the cluster test result based on the target node test result and the reporting of the node test results by each other node in the cluster except the target node, and sends the cluster test result to each node in the cluster. When the reporting situation is that each other node reports the node test result and the reported node test results are all passed, the cluster test result is passed; otherwise, the cluster test result is failed. This ensures that the cluster test result can be accurately determined regardless of whether the target node can communicate with the console, so as to decide whether to execute the policy rollback based on the cluster test result in the future, thereby further reducing the risk of user misoperation.

[0049] In some embodiments, if the cluster test result is passed, a first mark is added to the first network hardening strategy in the local cache, and the first mark is used to indicate that the cluster test result corresponding to the first network hardening strategy is passed; if the cluster test result is failed, a second mark is added to the first network hardening strategy in the local cache, and the second mark is used to indicate that the cluster test result corresponding to the first network hardening strategy is failed.

[0050] Optionally, the cluster network reinforcement device can directly store the network reinforcement policy issued by the console into the local cache of the target node each time it is received, and after determining the cluster test result, add a first mark or a second mark to the first network reinforcement policy according to the cluster test result. It can also associate a flag bit with it when storing it in the local cache of the target node, and set the value of the flag bit to an initial value, indicating that the network reinforcement policy has not undergone the network connectivity test. After determining the cluster test result, the value of the flag bit is modified to the value corresponding to the first mark or the second mark according to the cluster test result, so that when the policy is rolled back later, the corresponding cluster test result can be quickly found according to the second mark. The historically received network reinforcement policy.

[0051] Figure 3 is a flow chart of a method for obtaining a second network reinforcement strategy provided by an embodiment of the present disclosure, such as Figure 3 As shown, based on the above embodiment, the second network hardening strategy can be obtained by the following method.

[0052] S301. Filter the network hardening strategies stored in the local cache based on the first mark to obtain candidate network hardening strategies.

[0053] In the disclosed embodiment, the cluster network hardening device may filter the candidate network hardening policies associated with the first mark from the network hardening policies stored in the local cache when a policy rollback operation needs to be performed.

[0054] S302: Based on the pre-acquired version number of the candidate network hardening policy, determine the latest version of the candidate network hardening policy as the second network hardening policy.

[0055] In the disclosed embodiment, the console will generate a version number when issuing a network reinforcement policy. The same batch of network reinforcement policies issued to each node in the cluster have the same version number. The cluster network reinforcement device will cache the version number at the same time when storing the network reinforcement policy in the local cache. When selecting the alternative network reinforcement policy from the local cache and further determining the second network reinforcement policy, the latest version of the alternative network reinforcement policy can be determined as the second network reinforcement policy according to the version number of the alternative network reinforcement policy.

[0056] The disclosed embodiment obtains an alternative network hardening strategy by screening the network hardening strategies stored in the local cache based on the first tag, and determines the latest version of the alternative network hardening strategy as the second network hardening strategy based on the version number of the alternative network hardening strategy obtained in advance. When a connectivity failure is detected, the system can roll back to the last available version that passed the network connectivity test, and at the same time ensure that when some nodes are disconnected, all nodes can roll back to the same policy version, thereby further reducing the risk of user misoperation.

[0057] In other embodiments, at least one global policy library is provided in the cluster, and the global policy library is used to store the network hardening policies received by each node in the cluster. If the cluster test result is failed and the local cache of the target node is lost, the second network hardening policy is obtained from the global policy library.

[0058] Specifically, the console can send the network reinforcement policies of all nodes to the global policy library while issuing the network reinforcement policies corresponding to each node to each node. The global policy library uniformly stores the network reinforcement policies received by each node. When the cluster network reinforcement device determines that the cluster test result is failed and the local cache of the target node is lost, and the second network reinforcement policy required for rollback cannot be obtained from the local cache, the second network reinforcement policy can be obtained from the global policy library. Specifically, the network reinforcement policy historically sent to the target node can be filtered out according to the node identifier of the target node, and the second network reinforcement policy can be further determined according to the first mark and version number, thereby providing an alternative plan for the policy rollback operation when the local cache is lost.

[0059] Figure 4 FIG. 1 is a flow chart of a method for applying a first network reinforcement strategy provided by an embodiment of the present disclosure. Figure 4 As shown, based on the above embodiment, the first network reinforcement strategy can be applied by the following method.

[0060] S401. Generate firewall rules based on the first network hardening strategy.

[0061] In the disclosed embodiment, the cluster network hardening device can generate a firewall rule corresponding to the first network hardening policy after receiving the first network hardening policy issued by the console. The firewall rule defines the access connection mode corresponding to the port allowed to access, and the port and / or access connection mode denied to access. For example, the first network hardening policy with version number v1 can be as follows:

[0062] {

[0063] "version":"v1",

[0064] "rules":[

[0065] {"port":22,"protocol":"TCP","action":"ALLOW"},

[0066] {"port":80,"protocol":"TCP","action":"ALLOW"},

[0067] {"port":443,"protocol":"TCP","action":"ALLOW"},

[0068] {"port":8080,"protocol":"TCP","action":"ALLOW"},

[0069] {"port":8081,"protocol":"TCP","action":"ALLOW"},

[0070] {"port":"*","protocol":"*","action":"DENY"} ]

[0072] }

[0073] The firewall rules generated based on the first network hardening strategy may be: allowing TCP access to ports 22, 80, 443, 8080, and 8081; and denying access to all other ports and protocols.

[0074] S402: Apply the firewall rule to the firewall of the target node.

[0075] In the disclosed embodiment, the cluster network hardening device may update the firewall rules currently used on the firewall of the target node after generating the firewall rules corresponding to the first network hardening strategy, and apply the newly generated firewall rules to the firewall of the target node.

[0076] The disclosed embodiment generates firewall rules based on the first network hardening strategy and applies the firewall rules to the firewall of the target node, thereby facilitating subsequent network connectivity testing of the first network hardening strategy.

[0077] In some further embodiments, the cluster network hardening device may record the triggering reason and / or execution information of the policy rollback operation in a pre-created log file after performing a policy rollback based on the second network hardening policy.

[0078] Among them, the log file can be set on the target node to record the information of the policy rollback operation occurring on the target node, and can also be set on any one or more other nodes in the cluster to record the global information of the cluster. Triggering reasons may include manually triggered rollback and automatically triggered rollback. Automatically triggered rollback may include the current node failing to pass the network connectivity test to trigger rollback and other nodes failing to pass the network connectivity test to trigger rollback. Execution information may include the version number of the network reinforcement policy before and after the rollback, the execution time of the policy rollback operation, etc., which are not limited here. By recording the triggering reasons and / or execution information of the policy rollback operation in the log file, it is convenient to analyze the policy rollback process later.

[0079] Optionally, the log file can also store log information such as policy version creation, policy delivery, local cache, network detection, rollback operation, etc. The log information covers the operation time, operator, policy content, network detection results, rollback reasons, etc. The log file can be used to generate reports regularly to help the operation and maintenance team understand the impact of policy changes on network status. By analyzing the logs, you can find the frequent rollback of certain ports, so as to adjust the firewall rules and monitoring strategies and improve the stability of the system.

[0080] Figure 5 Schematic diagram of a cluster network reinforcement device provided by an embodiment of the present disclosure. Figure 5 As shown, the cluster network reinforcement device 500 includes: a cache module 510, an application module 520, and a rollback module 530, wherein the cache module 510 is used to store the first network reinforcement policy sent by the console in the local cache of the target node in response to receiving the first network reinforcement policy; the application module 520 is used to apply the first network reinforcement policy on the target node, and determine the cluster test result of the network connectivity test on the cluster after the application is completed; the rollback module 530 is used to obtain the second network reinforcement policy historically received by the target node from the local cache of the target node if the cluster test result is failed, and perform a policy rollback based on the second network reinforcement policy, and the cluster test result corresponding to the second network reinforcement policy is passed.

[0081] Optionally, the application module 520 includes: a testing unit, used to perform a network connectivity test on the target node based on the first network hardening strategy to obtain a target node test result; a first determination unit, used to determine that the cluster test result is failed if the target node test result is failed; a second determination unit, used to report the target node test result to the console if the target node test result is passed, so that the console determines the cluster test result based on the target node test result and the reporting status of the node test results of each other node in the cluster except the target node, and sends the cluster test result to each node in the cluster, wherein, when the reporting status is that each other node reports the node test result and the reported node test results are all passed, the cluster test result is passed, otherwise the cluster test result is failed.

[0082] Optionally, the cluster network reinforcement device 500 also includes: a first adding module, used to add a first mark to the first network reinforcement strategy in the local cache if the cluster test result is passed, and the first mark is used to indicate that the cluster test result corresponding to the first network reinforcement strategy is passed; a second adding module, used to add a second mark to the first network reinforcement strategy in the local cache if the cluster test result is failed, and the second mark is used to indicate that the cluster test result corresponding to the first network reinforcement strategy is failed.

[0083] Optionally, the rollback module 530 includes: a screening unit, used to screen the network hardening policies stored in the local cache based on the first mark to obtain alternative network hardening policies; and a third determination unit, used to determine the latest version of the alternative network hardening policy as the second network hardening policy based on the version number of the alternative network hardening policy obtained in advance.

[0084] Optionally, at least one global policy library is set in the cluster, and the global policy library is used to store the network reinforcement policies received by each node in the cluster. The cluster network reinforcement device 500 also includes: an acquisition module, which is used to obtain the second network reinforcement policy from the global policy library if the cluster test result is failed and the local cache of the target node is lost.

[0085] Optionally, the application module 520 includes: a generation unit, used to generate firewall rules based on the first network hardening strategy; and an application unit, used to apply the firewall rules to the firewall of the target node.

[0086] Optionally, the cluster network reinforcement device 500 further includes: a recording module, configured to record the triggering reason and / or execution information of the policy rollback operation in a pre-created log file.

[0087] The cluster network reinforcement device provided in this embodiment can execute the method described in any of the above embodiments. Its execution method and beneficial effects are similar and will not be described in detail here.

[0088] Figure 6 It is a structural diagram of a computer device provided in an embodiment of the present disclosure.

[0089] like Figure 6 As shown, the computer device may include a processor 610 and a memory 620 storing computer program instructions.

[0090] Specifically, the processor 610 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0091] The memory 620 may include a large capacity memory for information or instructions. By way of example and not limitation, the memory 620 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 620 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 620 may be inside or outside the integrated gateway device. In a particular embodiment, the memory 620 is a non-volatile solid-state memory. In a particular embodiment, the memory 620 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or a flash memory, or a combination of two or more of these.

[0092] The processor 610 reads and executes the computer program instructions stored in the memory 620 to perform the steps of the cluster network reinforcement method provided in the embodiment of the present disclosure.

[0093] In one example, the computer device may further include a transceiver 630 and a bus 640. Figure 6 As shown, the processor 610, the memory 620 and the transceiver 630 are connected via a bus 640 and communicate with each other.

[0094] The bus 640 includes hardware, software, or both. For example, but not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 640 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0095] The embodiment of the present disclosure further provides a computer-readable storage medium, which may store a computer program. When the computer program is executed by a processor, the processor implements the cluster network reinforcement method provided by the embodiment of the present disclosure.

[0096] The above-mentioned storage medium may, for example, include a memory 620 of computer program instructions, and the above-mentioned instructions may be executed by the processor 610 of the cluster network reinforcement device to complete the cluster network reinforcement method provided by the embodiment of the present disclosure. Optionally, the storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, a random access memory (Random Access Memory, RAM), a compact disc read-only memory (Compact DiscROM, CD-ROM), a tape, a floppy disk, and an optical data storage device, etc. The above-mentioned computer program may be written in any combination of one or more programming languages ​​to perform the program code of the operation of the embodiment of the present disclosure, and the programming language includes an object-oriented programming language, such as Java, C++, etc., and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device, partially on the remote computing device, or entirely on the remote computing device or server.

[0097] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0098] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cluster network reinforcement method, characterized in that: The method is applicable to a target node in a cluster, and the method comprises: In response to receiving the first network hardening policy sent by the console, storing the first network hardening policy in a local cache of the target node; Applying the first network hardening strategy on the target node, and determining a cluster test result of performing a network connectivity test on the cluster after the application is completed; If the cluster test result is failed, the second network hardening policy historically received by the target node is obtained from the local cache of the target node, and the policy is rolled back based on the second network hardening policy, and the cluster test result corresponding to the second network hardening policy is passed.

2. The method according to claim 1, characterized in that The determining of a cluster test result of performing a network connectivity test on the cluster includes: Performing a network connectivity test on the target node based on the first network reinforcement strategy to obtain a target node test result; If the target node test result is failed, determining that the cluster test result is failed; If the target node test result is passed, the target node test result is reported to the console, so that the console determines the cluster test result based on the target node test result and the reporting status of the node test results of each other node in the cluster except the target node, and sends the cluster test result to each node in the cluster, wherein, when the reporting status is that each other node reports the node test result and the reported node test results are all passed, the cluster test result is passed, otherwise the cluster test result is failed.

3. The method according to claim 1, characterized in that The method further comprises: If the cluster test result is passed, adding a first mark to the first network hardening policy in the local cache, the first mark being used to indicate that the cluster test result corresponding to the first network hardening policy is passed; If the cluster test result is failed, a second mark is added to the first network hardening policy in the local cache, where the second mark is used to indicate that the cluster test result corresponding to the first network hardening policy is failed.

4. The method according to claim 3, characterized in that The acquiring, from the local cache of the target node, the second network reinforcement strategy historically received by the target node comprises: Filter the network hardening strategies stored in the local cache based on the first tag to obtain candidate network hardening strategies; Based on the pre-acquired version number of the candidate network hardening policy, the latest version of the candidate network hardening policy is determined as the second network hardening policy.

5. The method according to claim 1, characterized in that At least one global policy library is provided in the cluster, and the global policy library is used to store the network reinforcement policies received by each node in the cluster. The method further includes: If the cluster test result is failed and the local cache of the target node is lost, the second network hardening policy is obtained from the global policy library.

6. The method according to claim 1, characterized in that The applying the first network hardening strategy on the target node includes: generating a firewall rule based on the first network hardening strategy; The firewall rule is applied to the firewall of the target node.

7. The method according to claim 1, characterized in that After performing policy rollback based on the second network hardening policy, the method further includes: The triggering reason and / or execution information of the policy rollback operation is recorded in a pre-created log file.

8. A cluster network reinforcement device, characterized in that: The device is applicable to a target node in a cluster, and comprises: a cache module, configured to, in response to receiving a first network hardening policy sent by the console, store the first network hardening policy in a local cache of the target node; An application module, configured to apply the first network hardening strategy on the target node, and determine a cluster test result of performing a network connectivity test on the cluster after the application is completed; The rollback module is used to obtain the second network hardening strategy historically received by the target node from the local cache of the target node if the cluster test result is failed, and perform a policy rollback based on the second network hardening strategy, and the cluster test result corresponding to the second network hardening strategy is passed.

9. A computer device, characterized in that: include: Memory; processor; And a computer program; wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the cluster network reinforcement method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the cluster network reinforcement method according to any one of claims 1 to 7 is implemented.

Images