Cluster network reinforcement method, apparatus, device, and storage medium

Abstract

The present disclosure relates to a cluster network reinforcement method, device, equipment and storage medium. The method is suitable for a target node in a cluster. The method comprises: in response to receiving a first network reinforcement strategy sent by a console, storing the first network reinforcement strategy in a local cache of the target node; applying the first network reinforcement strategy on the target node, and determining a cluster test result of network connectivity test on the cluster after the application is completed; if the cluster test result is failed, obtaining a second network reinforcement strategy historically received by the target node from the local cache of the target node and performing strategy rollback, and the second network reinforcement strategy corresponds to a passed cluster test result. The present disclosure sets a local cache and network connectivity test, obtains a historically collected network reinforcement strategy from the local cache and performs rollback after a new network reinforcement strategy application leads to a failure, so that the node failure can be self-recovered, and the risk caused by user misoperation is reduced.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for hardening up a cluster network. Background Technology

[0002] Cluster network hardening refers to strict port access control for each server in a cluster environment, aiming to prevent unauthorized external access and ensure the security of the cluster system. Traditional network hardening methods typically require manually running scripts on each server to configure security rules. However, this method is not only complex but also requires a high level of expertise from operations and maintenance personnel. To simplify operations, the use of a console to provide users with a self-service management interface has gradually been adopted and promoted. Users can configure and manage cluster network hardening policies themselves on the console. However, errors may occur during the configuration process, leading to network failures in the cluster, or even serious consequences such as communication interruptions between clusters and loss of connection to the management console. In such cases, users often have to seek help from the cluster vendor's operations and maintenance personnel to restore the system through backend login, which is time-consuming and costly, severely impacting business continuity and stability. Therefore, optimizing cluster network hardening methods to reduce the risks caused by user errors has become a pressing technical challenge. Summary of the Invention

[0003] To address the aforementioned technical problems, this disclosure provides a method, apparatus, device, and storage medium for hardening up a clustered network.

[0004] A first aspect of this disclosure provides a method for hardening a clustered network, the method comprising:

[0005] In response to receiving the first network hardening policy sent by the console, the first network hardening policy is stored in the local cache of the target node;

[0006] The first network hardening strategy is applied to the target node, and after the application is completed, the cluster test result of the network connectivity test of the cluster is determined.

[0007] If the cluster test result is unsuccessful, the second network hardening strategy previously received by the target node is retrieved from the target node's local cache, and the strategy is rolled back based on the second network hardening strategy. The cluster test result corresponding to the second network hardening strategy is then successful.

[0008] A second aspect of this disclosure provides a cluster network hardening apparatus, the apparatus comprising:

[0009] The caching module is used to store the first network hardening policy in the local cache of the target node in response to receiving the first network hardening policy sent by the console;

[0010] The application module is used to apply the first network hardening strategy on the target node, and after the application is completed, determine the cluster test result of the network connectivity test of the cluster.

[0011] The rollback module is used to retrieve the second network hardening strategy previously received by the target node from the local cache of the target node if the cluster test result is unsuccessful, and to roll back the strategy based on the second network hardening strategy, where the cluster test result corresponding to the second network hardening strategy is successful.

[0012] A third aspect of this disclosure provides a computer device including a memory and a processor, and a computer program, wherein the memory stores the computer program, and when the computer program is executed by the processor, it implements the cluster network hardening method of the first aspect described above.

[0013] A fourth aspect of this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the cluster network hardening method of the first aspect described above.

[0014] The technical solution provided in this disclosure has the following advantages compared with the prior art:

[0015] In the cluster network hardening method, apparatus, device, and storage medium provided in this disclosure embodiment, in response to receiving a first network hardening strategy sent by the console, the first network hardening strategy is stored in the local cache of the target node, applied on the target node, and after application, the cluster test result for network connectivity testing of the cluster is determined. If the cluster test result is unsuccessful, a second network hardening strategy previously received by the target node is retrieved from the local cache of the target node, and a strategy rollback is performed based on the second network hardening strategy. If the cluster test result corresponding to the second network hardening strategy is successful, the network connectivity test result can be performed on the cluster node. A local cache is set up to store network hardening policies. After applying a new network hardening policy, network connectivity tests are performed on the cluster. If the new network hardening policy causes network inaccessibility, historically collected network hardening policies that can communicate normally are retrieved from the local cache and rolled back. This allows node failures to recover automatically without waiting for maintenance personnel to log in to the backend for recovery. It avoids reliance on external communication and maintenance personnel intervention, significantly improves network stability and self-healing capabilities, reduces the complexity and downtime costs of traditional maintenance operations, and reduces the risks caused by user misoperation. It provides a more efficient management solution for network security hardening of cluster products. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0017] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a cluster network hardening method provided in an embodiment of this disclosure;

[0019] Figure 2 This is a flowchart of a method for determining cluster test results provided in an embodiment of this disclosure;

[0020] Figure 3 This is a flowchart of a method for obtaining a second network hardening strategy provided in an embodiment of this disclosure;

[0021] Figure 4 This is a flowchart of a method for applying a first network hardening strategy provided in an embodiment of this disclosure;

[0022] Figure 5 This is a schematic diagram of the structure of a cluster network hardening device provided in an embodiment of this disclosure;

[0023] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. Detailed Implementation

[0024] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0025] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0026] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0027] Figure 1This is a flowchart of a cluster network hardening method provided in an embodiment of this disclosure. This method can be executed by a cluster network hardening device, which can be installed on a target node in the cluster. Figure 1 As shown, the cluster network hardening method provided in this embodiment includes the following steps:

[0028] S101. In response to receiving the first network hardening policy sent by the console, the first network hardening policy is stored in the local cache of the target node.

[0029] The target node in this embodiment can be any node in the cluster.

[0030] The network hardening strategy in this embodiment can be understood as a strategy to restrict access permissions to ports in order to improve network security. For example, the network hardening strategy may allow nodes in the cluster to communicate with each other through ports 22, 80, 443, 8080, and 8081, while denying access to other ports by default. Optionally, in the same batch of network hardening strategies issued by the console to various nodes in the cluster, the network hardening strategies received by different nodes may be the same or different, which is not limited here.

[0031] In this embodiment of the disclosure, after receiving the first network reinforcement policy issued by the console, the cluster network reinforcement device can store the first network reinforcement policy in the local cache of the target node, thereby saving the first network reinforcement policy locally on the target node and ensuring that the target node can still independently obtain and apply the required policy when the network is abnormal.

[0032] In one exemplary implementation of this disclosure, when a user first enables network hardening through the console, the console will first issue a default policy to each node in the cluster, allowing access to all ports. This ensures that at least one network hardening policy can restore the network connectivity of the cluster when the policy needs to be rolled back for the user's erroneous operation.

[0033] S102. Apply the first network hardening strategy to the target node, and after the application is completed, determine the cluster test results for network connectivity testing of the cluster.

[0034] Network connectivity testing in this embodiment may include ping testing and connection testing on specified ports. For example, for a network hardening policy that allows nodes in the cluster to communicate with each other through ports 22, 80, 443, 8080, and 8081, while other ports are denied access by default, it is possible to check whether nodes in the cluster can communicate normally through ports 22, 80, 443, 8080, and 8081.

[0035] In this embodiment of the disclosure, after receiving the first network hardening strategy, the cluster network hardening device can apply the first network hardening strategy to the target node. Specifically, it can apply it to the firewall of the target node, configure the firewall, and after the configuration is completed, determine the cluster test result of the network connectivity test of the cluster.

[0036] In one exemplary embodiment of this disclosure, the cluster network hardening device can first perform a network connectivity test on the target node itself to obtain the test results, then obtain the test results of other nodes in the cluster that have undergone network connectivity tests, and combine the test results of the target node and other nodes to determine the cluster test result.

[0037] S103. If the cluster test result is unsuccessful, the second network hardening strategy received by the target node in the target node's local cache is obtained, and the strategy is rolled back based on the second network hardening strategy. The cluster test result corresponding to the second network hardening strategy is successful.

[0038] In this embodiment of the disclosure, after determining the cluster test result, if the cluster test result is a failure of the network connectivity test, the cluster network hardening device can determine that the first network hardening strategy configured this time is a user error and cannot support the normal communication of the cluster. Therefore, a strategy rollback operation is required. Specifically, the device can access the local cache of the target node, obtain the corresponding second network hardening strategy that the target node has historically received and whose cluster test result is a success from the local cache, and apply the second network hardening strategy to achieve strategy rollback.

[0039] In one exemplary embodiment of this disclosure, the cluster network hardening device can, after rolling back the policy based on the second network hardening strategy, re-determine the cluster test result for network connectivity testing of the cluster. If the cluster test result is successful, the recovery is confirmed to be successful; otherwise, it continues to retrieve other network hardening strategies with corresponding successful cluster test results from the local cache of the target node, and roll back the policy based on the other network hardening strategies until the recovery is confirmed to be successful. If other network hardening strategies cannot guarantee that the cluster passes the network connectivity test, a reminder message is sent to relevant personnel.

[0040] This embodiment of the disclosure, in response to receiving a first network hardening policy sent by the console, stores the first network hardening policy in the local cache of the target node, applies the first network hardening policy on the target node, and after the application is completed, determines the cluster test result for network connectivity testing of the cluster. If the cluster test result is unsuccessful, it retrieves the second network hardening policy previously received by the target node from the local cache of the target node, and performs policy rollback based on the second network hardening policy. If the cluster test result corresponding to the second network hardening policy is successful, it can set up a local cache on the cluster node for storing network hardening policies. After applying a new network hardening policy, it performs network connectivity testing on the cluster. If the new network hardening policy causes network inaccessibility, it retrieves the previously collected network hardening policies that can communicate normally from the local cache and rolls them back. This allows node failures to recover automatically without waiting for maintenance personnel to log in to the backend for recovery, avoiding reliance on external communication and maintenance personnel intervention. This significantly improves network stability and self-healing capabilities, reduces the complexity and downtime costs of traditional maintenance operations, and reduces the risks caused by user misoperation. It provides a more efficient management solution for network security hardening of cluster product delivery.

[0041] Figure 2 This is a flowchart of a method for determining cluster test results provided in an embodiment of this disclosure, such as... Figure 2 As shown, based on the above embodiments, the cluster test results can be determined by the following method.

[0042] S201. Based on the first network hardening strategy, conduct network connectivity tests on the target node and obtain the test results of the target node.

[0043] In this embodiment of the disclosure, after the first network hardening strategy has been applied, the cluster network hardening device can perform network connectivity tests on the target node for the ports included in the first network hardening strategy, based on the content of the first network hardening strategy, and obtain the test results of the target node.

[0044] S202. If the target node test result is unsuccessful, then the cluster test result is determined to be unsuccessful.

[0045] In this embodiment of the disclosure, the cluster network hardening device can determine that the target node test result is failed when there is a port in the first network hardening strategy that cannot complete communication according to the access connection method corresponding to the port. Since the cluster needs to ensure that each node in the cluster can pass the network connectivity test, the cluster network hardening device can directly determine that the cluster test result is failed when the target node test result is failed.

[0046] S203. If the target node test result is passed, the target node test result is reported to the console so that the console determines the cluster test result based on the target node test result and the reporting status of the node test results of all other nodes in the cluster except the target node, and distributes the cluster test result to each node in the cluster. Specifically, if all other nodes report node test results and all reported node test results are passed, the cluster test result is passed; otherwise, the cluster test result is failed.

[0047] In this embodiment of the disclosure, the cluster network hardening device can determine that the target node test result is passed when all ports included in the first network hardening strategy can complete communication according to the access connection method corresponding to the port. The target node and the console can communicate normally. Therefore, the target node test result is reported to the console. The console will receive the target node test result reported by the target node and the node test results reported by each other node in the cluster after performing network connectivity tests according to the network hardening strategies corresponding to other nodes within a preset timeout period. Based on the target node test result and the reporting of node test results by other nodes, the cluster test result is determined. Specifically, if all other nodes pass the network connectivity test and report the corresponding node test results to the console, the console can determine that the cluster test result is passed. If some nodes fail the network connectivity test and do not report node test results to the console, or the reported node test results are failed, and the console does not receive node test results reported by all nodes within the timeout period, or the received node test results include failed results, the cluster test result can be determined to be failed, and the cluster test result is sent to each node in the cluster, including the target node.

[0048] This embodiment of the disclosure performs network connectivity testing on the target node based on a first network hardening strategy to obtain the target node test result. If the target node test result is unsuccessful, the cluster test result is determined to be unsuccessful. If the target node test result is successful, the target node test result is reported to the console. The console then determines the cluster test result based on the target node test result and the reporting status of the node test results of all other nodes in the cluster, excluding the target node, and distributes the cluster test result to each node in the cluster. Specifically, if all other nodes report node test results and all reported node test results are successful, the cluster test result is considered successful; otherwise, the cluster test result is considered unsuccessful. This ensures that the cluster test result can be accurately determined regardless of whether the target node can communicate with the console, so that subsequent decisions on whether to execute a policy rollback can be made based on the cluster test result, further reducing the risk caused by user misoperation.

[0049] In some embodiments, if the cluster test result is passed, a first flag is added to the first network hardening strategy in the local cache. The first flag is used to indicate that the cluster test result corresponding to the first network hardening strategy is passed. If the cluster test result is failed, a second flag is added to the first network hardening strategy in the local cache. The second flag is used to indicate that the cluster test result corresponding to the first network hardening strategy is failed.

[0050] Optionally, the cluster network hardening device can directly store the network hardening policy sent by the console into the local cache of the target node each time it receives it. After determining the cluster test result, it can add a first tag or a second tag to the first network hardening policy according to the cluster test result. Alternatively, it can set a flag bit when storing the policy into the local cache of the target node and set the value of the flag bit to the initial value to indicate that the network hardening policy has not yet undergone network connectivity testing. After determining the cluster test result, it can modify the value of the flag bit to the value corresponding to the first tag or the second tag according to the cluster test result. This makes it convenient to quickly find the corresponding historically received network hardening policy with a passed cluster test result when rolling back the policy in the future.

[0051] Figure 3 This is a flowchart of a method for obtaining a second network hardening strategy provided in an embodiment of this disclosure, such as... Figure 3 As shown, based on the above embodiments, a second network hardening strategy can be obtained through the following method.

[0052] S301. Based on the first tag, filter the network hardening strategies stored in the local cache to obtain candidate network hardening strategies.

[0053] In this embodiment of the disclosure, when a policy rollback operation is required, the cluster network hardening device can filter candidate network hardening policies associated with a first tag from the network hardening policies stored in the local cache.

[0054] S302. Based on the version number of the pre-acquired alternative network hardening strategies, determine the latest version of the alternative network hardening strategy as the second network hardening strategy.

[0055] In this embodiment of the disclosure, the console generates a version number when issuing network hardening strategies. The same batch of network hardening strategies issued to each node in the cluster have the same version number. When the cluster network hardening device stores the network hardening strategy in the local cache, it also caches the version number. When selecting candidate network hardening strategies from the local cache and further determining the second network hardening strategy, the latest version of the candidate network hardening strategy can be determined as the second network hardening strategy based on the version number of the candidate network hardening strategy.

[0056] This embodiment of the disclosure filters network hardening strategies stored in the local cache based on a first tag to obtain candidate network hardening strategies. Based on the version number of the candidate network hardening strategies obtained in advance, the latest version of the candidate network hardening strategy is determined as the second network hardening strategy. When a connectivity failure is detected, it can roll back to the previous available version that passed the network connectivity test. At the same time, it ensures that if some nodes are disconnected, all nodes can roll back to the same strategy version, further reducing the risk caused by user misoperation.

[0057] In other embodiments, at least one global policy library is set in the cluster. The global policy library is used to store the network hardening policies received by each node in the cluster. If the cluster test result is unsuccessful and the local cache of the target node is lost, a second network hardening policy is obtained from the global policy library.

[0058] Specifically, the console can send the network hardening policies corresponding to each node to each node, and at the same time send the network hardening policies of all nodes to the global policy library. The global policy library stores the network hardening policies received by each node in a unified manner. When the cluster network hardening device determines that the cluster test result is unsuccessful and the local cache of the target node is lost, and it is impossible to obtain the second network hardening policy required for rollback from the local cache, it can obtain the second network hardening policy from the global policy library. Specifically, it can filter the network hardening policies that were previously sent to the target node based on the node identifier of the target node, and then further determine the second network hardening policy based on the first tag and version number, thereby providing an alternative solution for policy rollback operation when the local cache is lost.

[0059] Figure 4 This is a flowchart illustrating a method for applying a first network hardening strategy according to an embodiment of this disclosure. Figure 4 As shown, based on the above embodiments, the first network hardening strategy can be applied by the following method.

[0060] S401. Generate firewall rules based on the first network hardening policy.

[0061] In this embodiment of the disclosure, the cluster network hardening device can generate firewall rules corresponding to the first network hardening policy after receiving it from the console. The firewall rules restrict the access connection methods corresponding to the allowed ports, and the denied ports and / or access connection methods. For example, the first network hardening policy with version number v1 can be as follows:

[0062] {

[0063] "version": "v1",

[0064] "rules": [

[0065] {"port": 22, "protocol": "TCP", "action": "ALLOW"},

[0066] {"port": 80, "protocol": "TCP", "action": "ALLOW"},

[0067] {"port": 443, "protocol": "TCP", "action": "ALLOW"},

[0068] {"port": 8080, "protocol": "TCP", "action": "ALLOW"},

[0069] {"port": 8081, "protocol": "TCP", "action": "ALLOW"},

[0070] {"port": "*", "protocol": "*", "action": "DENY"} ]

[0072] }

[0073] The firewall rules generated based on the first network hardening strategy can be: allow TCP access on ports 22, 80, 443, 8080, and 8081; deny access to all other ports and protocols.

[0074] S402. Apply firewall rules to the firewall of the target node.

[0075] In this embodiment of the disclosure, the cluster network hardening device can update the firewall rules currently used on the firewall of the target node after generating the firewall rules corresponding to the first network hardening strategy, and apply the newly generated firewall rules to the firewall of the target node.

[0076] This embodiment generates firewall rules based on a first network hardening strategy and applies the firewall rules to the firewall of the target node, facilitating subsequent network connectivity testing of the first network hardening strategy.

[0077] In some other embodiments, the cluster network hardening device may record the triggering reason and / or execution information of the policy rollback operation in a pre-created log file after performing policy rollback based on the second network hardening strategy.

[0078] The log file can be set on the target node to record information about policy rollback operations occurring on that node, or it can be set on any one or more other nodes in the cluster to record global cluster information. Triggering reasons can include manual and automatic rollbacks. Automatic rollbacks can be triggered by the current node failing a network connectivity test or by other nodes failing a network connectivity test. Execution information can include the version numbers of the network hardening policies before and after the rollback, the execution time of the policy rollback operation, etc., without limitation. Recording the triggering reasons and / or execution information of policy rollback operations in the log file facilitates subsequent analysis of the policy rollback process.

[0079] Optionally, the log file can also store log information such as policy version creation, policy distribution, local caching, network detection, and rollback operations. The log information covers operation time, operator, policy content, network detection results, and rollback reasons. The log file can be used to generate periodic reports to help the operations team understand the impact of policy changes on network status. By analyzing the logs, frequent rollbacks on certain ports can be detected, allowing for adjustments to firewall rules and monitoring policies, thereby improving system stability.

[0080] Figure 5 This is a schematic diagram of the structure of a cluster network hardening device provided in an embodiment of this disclosure. Figure 5 As shown, the cluster network hardening device 500 includes: a caching module 510, an application module 520, and a rollback module 530. The caching module 510 is used to store the first network hardening strategy sent by the console into the local cache of the target node in response to receiving it. The application module 520 is used to apply the first network hardening strategy to the target node and determine the cluster test result for network connectivity testing after application. The rollback module 530 is used to retrieve a previously received second network hardening strategy from the local cache of the target node if the cluster test result is failed, and perform a policy rollback based on the second network hardening strategy, where the cluster test result corresponding to the second network hardening strategy is passed.

[0081] Optionally, the application module 520 includes: a testing unit, configured to perform network connectivity testing on the target node based on the first network hardening strategy to obtain the target node test result; a first determining unit, configured to determine that the cluster test result is failed if the target node test result is failed; and a second determining unit, configured to report the target node test result to the console if the target node test result is passed, so that the console determines the cluster test result based on the target node test result and the reporting status of node test results by each other node in the cluster other than the target node, and distributes the cluster test result to each node in the cluster, wherein the cluster test result is passed when all other nodes report the node test result and all reported node test results are passed; otherwise, the cluster test result is failed.

[0082] Optionally, the cluster network hardening device 500 further includes: a first adding module, configured to add a first flag to the first network hardening strategy in the local cache if the cluster test result is passed, wherein the first flag is used to indicate that the cluster test result corresponding to the first network hardening strategy is passed; and a second adding module, configured to add a second flag to the first network hardening strategy in the local cache if the cluster test result is failed, wherein the second flag is used to indicate that the cluster test result corresponding to the first network hardening strategy is failed.

[0083] Optionally, the rollback module 530 includes: a filtering unit, configured to filter the network hardening strategies stored in the local cache based on the first tag to obtain candidate network hardening strategies; and a third determining unit, configured to determine the latest version of the candidate network hardening strategy as the second network hardening strategy based on the version number of the candidate network hardening strategy obtained in advance.

[0084] Optionally, the cluster is provided with at least one global policy library, which is used to store network hardening policies received by each node in the cluster. The cluster network hardening device 500 further includes: an acquisition module, which is used to acquire the second network hardening policy from the global policy library if the cluster test result is unsuccessful and the local cache of the target node is lost.

[0085] Optionally, the application module 520 includes: a generation unit, used to generate firewall rules based on the first network hardening strategy; and an application unit, used to apply the firewall rules to the firewall of the target node.

[0086] Optionally, the cluster network hardening device 500 further includes a recording module, used to record the triggering reason and / or execution information of the policy rollback operation in a pre-created log file.

[0087] The cluster network hardening device provided in this embodiment can perform the methods described in any of the above embodiments, and its execution method and beneficial effects are similar, so they will not be repeated here.

[0088] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure.

[0089] like Figure 6 As shown, the computer device may include a processor 610 and a memory 620 storing computer program instructions.

[0090] Specifically, the processor 610 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0091] Memory 620 may include a large-capacity storage for information or instructions. For example, and not limitingly, memory 620 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 620 may include removable or non-removable (or fixed) media. Where appropriate, memory 620 may be internal or external to the integrated gateway device. In a particular embodiment, memory 620 is a non-volatile solid-state memory. In a particular embodiment, memory 620 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (Electrically Programmable ROM, EPROM), an electrically erasable programmable PROM (EEPROM), an electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0092] The processor 610 reads and executes computer program instructions stored in the memory 620 to perform the steps of the cluster network hardening method provided in this embodiment of the disclosure.

[0093] In one example, the computer device may also include a transceiver 630 and a bus 640. Wherein, as... Figure 6 As shown, the processor 610, memory 620 and transceiver 630 are connected via bus 640 and communicate with each other.

[0094] Bus 640 may include hardware, software, or both. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 640 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0095] This disclosure also provides a computer-readable storage medium that can store a computer program that, when executed by a processor, enables the processor to implement the cluster network hardening method provided in this disclosure.

[0096] The aforementioned storage medium may, for example, include a memory 620 containing computer program instructions, which can be executed by the processor 610 of the cluster network hardening device to complete the cluster network hardening method provided in this embodiment of the disclosure. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), compact disc-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device. The aforementioned computer program may be written in any combination of one or more programming languages ​​to perform the operations of this embodiment of the disclosure. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0097] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of cluster network hardening, the method comprising: The method is suitable for a target node in a cluster, and the method comprises: in response to receiving a first network reinforcement strategy sent by a console, storing the first network reinforcement strategy in a local cache of the target node; applying the first network reinforcement strategy on the target node, and determining a cluster test result of testing network connectivity of the cluster after the application; if the cluster test result is failed, obtaining a second network reinforcement strategy historically received by the target node from the local cache of the target node, and performing strategy rollback based on the second network reinforcement strategy, wherein the second network reinforcement strategy corresponds to a passed cluster test result; the determination of the cluster test result of testing network connectivity of the cluster comprises: testing network connectivity of the target node based on the first network reinforcement strategy to obtain a target node test result; if the target node test result is failed, determining that the cluster test result is failed; if the target node test result is passed, reporting the target node test result to the console, so that the console determines the cluster test result based on the target node test result and reporting situations of node test results of each other node in the cluster except the target node, and delivers the cluster test result to each node in the cluster, wherein the cluster test result is passed when the reporting situations are that each other node reports the node test result and the reported node test result is passed, otherwise the cluster test result is failed.

2. The method of claim 1, wherein, The method further comprises: if the cluster test result is passed, adding a first mark to the first network reinforcement strategy in the local cache, wherein the first mark is used to represent that the cluster test result corresponding to the first network reinforcement strategy is passed; if the cluster test result is failed, adding a second mark to the first network reinforcement strategy in the local cache, wherein the second mark is used to represent that the cluster test result corresponding to the first network reinforcement strategy is failed.

3. The method of claim 2, wherein, The obtaining of the second network reinforcement strategy historically received by the target node from the local cache of the target node comprises: screening network reinforcement strategies stored in the local cache based on the first mark to obtain alternative network reinforcement strategies; determining the latest version of the alternative network reinforcement strategies as the second network reinforcement strategy based on a version number of the alternative network reinforcement strategies obtained in advance.

4. The method of claim 1, wherein, At least one global strategy library is arranged in the cluster, and the global strategy library is used to store network reinforcement strategies received by each node in the cluster, and the method further comprises: if the cluster test result is failed and the local cache of the target node is lost, obtaining the second network reinforcement strategy from the global strategy library.

5. The method of claim 1, wherein, The application of the first network reinforcement strategy on the target node comprises: generating a firewall rule based on the first network reinforcement strategy; applying the firewall rule to a firewall of the target node.

6. The method of claim 1, wherein, After the policy rollback based on the second network reinforcement policy, the method further comprises: Recording the trigger cause and / or execution information of the policy rollback operation in a pre-created log file.

7. A clustered network hardened appliance, comprising: The device is suitable for a target node in a cluster, and the device comprises: A cache module configured to store the first network reinforcement policy in a local cache of the target node in response to receiving the first network reinforcement policy sent by the console; An application module configured to apply the first network reinforcement policy on the target node and determine a cluster test result of a network connectivity test on the cluster after the application is completed; A rollback module configured to, if the cluster test result is failed, obtain a second network reinforcement policy historically received by the target node from the local cache of the target node, and perform policy rollback based on the second network reinforcement policy, wherein the second network reinforcement policy corresponds to a passed cluster test result. The application module comprises: A test unit configured to perform a network connectivity test on the target node based on the first network reinforcement policy to obtain a target node test result; A first determination unit configured to, if the target node test result is failed, determine that the cluster test result is failed; A second determination unit configured to, if the target node test result is passed, report the target node test result to the console, so that the console determines the cluster test result based on the target node test result and a reporting situation of node test results of each other node in the cluster except the target node, and sends the cluster test result to each node in the cluster, wherein, if the reporting situation is that each other node reports the node test result and the reported node test result is passed, the cluster test result is passed, otherwise the cluster test result is failed.

8. A computer device, comprising: Comprise: A memory; A processor; And a computer program; wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the cluster network reinforcement method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and when the computer program is executed by the processor, the cluster network reinforcement method of any one of claims 1-6 is implemented.

Images