Network application form approval method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a network application form approval method and device, electronic equipment and storage medium. The method comprises: obtaining an updated network application form, identifying the source IP and target IP carried by the network application form, wherein the network application form is used to apply for access permission of the source IP accessing the target IP; converting the source IP into a first value and the target IP into a second value through a preset algorithm, matching the first value and the second value with a preset access control table, determining a first access area corresponding to the first value, a second access area corresponding to the second value and permission information of the first access area accessing the second access area according to the target matching result; and if the permission information indicates that the first access area is allowed to access the second access area, determining that the network application form passes the approval.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, and particularly relates to a network application form approval method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the network operation and maintenance process of a large enterprise data center, with the increase of application systems and enterprise user quantity, network operation and maintenance personnel need to handle network opening demands from inside and outside the enterprise. In order to meet the requirements of internal and external supervision and control and production safety, the network opening demand needs to meet certain rules to ensure compliance.

[0003] The main means to judge the compliance of network opening content is to identify the IP address involved in network opening, and then identify whether the source end and target end of the network opening demand meet the rules. This process needs to consume a lot of checking time and is difficult to ensure accuracy through manual identification and judgment of IP addresses.

[0004] Therefore, a method for quickly determining whether the source end and target end of the network opening demand meet the rules is urgently needed. SUMMARY

[0005] The embodiments of the present application provide a network application form approval method and device, electronic equipment and storage medium, to quickly determine whether the source end and target end of the network opening demand meet the rules.

[0006] In a first aspect, the embodiments of the present application provide a network application form approval method, including: obtaining an updated network application form, identifying a source end IP and a target end IP carried by the network application form, wherein the network application form is used to apply for access permission of the source end IP to the target end IP; converting the source end IP into a first value and the target end IP into a second value through a preset algorithm, matching the first value and the second value with a preset access control table, determining a first access area corresponding to the first value, a second access area corresponding to the second value, and permission information of the first access area accessing the second access area according to a target matching result; and if the permission information indicates that the first access area is allowed to access the second access area, determining that the network application form passes the approval.

[0007] In a second aspect, an embodiment of the present application provides a network application form approval device, comprising: an obtaining module configured to obtain an updated network application form, and identify a source IP and a target IP carried by the network application form, wherein the network application form is used to apply for access permission of the source IP to access the target IP; a matching module configured to convert the source IP into a first value, convert the target IP into a second value, match the first value and the second value with a preset access control table, and determine a first access area corresponding to the first value, a second access area corresponding to the second value, and permission information of the first access area to access the second access area according to a target matching result; and a determining module configured to determine that the network application form passes the approval if the permission information indicates that the first access area is allowed to access the second access area.

[0008] In a third aspect, an embodiment of the present application provides a network application form approval device, comprising: a memory and a processor.

[0009] The memory stores computer execution instructions.

[0010] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementation manners of the first aspect.

[0011] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0012] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0014] Figure 1 A scenario diagram of network application form approval provided by the present application;

[0015] Figure 2 A flowchart of a network application form approval method provided by the present application Figure 1 ;

[0016] Figure 3 A flowchart of a network application form approval method provided by the present applicationFigure 2 ;

[0017] Figure 4 The structure diagram of the approval device for the network application form provided by the present application is shown in the figure.

[0018] Figure 5 The structure diagram of the approval device for the network application form provided by the present application is shown in the figure.

[0019] The specific embodiments of the present application have been shown in the above figures, and will be described in more detail hereinafter. These figures and the written description are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0020] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements, and the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." The following description is not intended to limit the scope of the present application in any way, but rather is intended to provide what is considered to be a practical exemplification of various aspects of the application. As such, the following description is provided as an enabling teaching of the application in its currently contemplated configuration.

[0021] First, the terms involved in the present application are explained:

[0022] IP address: the logical address of each host in the network, in the form of X.X.X.X / 32, wherein X ranges from 0 to 255, and 32 is the mask.

[0023] IP: English full name: Internet Protocol, Chinese full name: network interconnection protocol.

[0024] Network segment: a collection of logical addresses of one or more hosts in the network. In the form of X.X.X.X / mask, wherein X ranges from 0 to 255, and the mask ranges from 0 to 32.

[0025] Network partition: a collection of one or more network segments in the network.

[0026] Network opening demand: an application form containing source IP address and target IP address.

[0027] Figure 1 The scenario diagram of the approval method for the network application form provided by the present application is shown in the figure. Figure 1As shown in the specific application scenario of this application, network activation is one of the most common and frequent network requirement delivery tasks in the network operation and maintenance work of large data centers. The network activation requirement is mainly for internal and external business access or development testing needs to activate the network from one node in the local area network to another node. The applicant submits an application form to the network operation and maintenance personnel. After confirming that the content of the application form meets the specifications and is approved, the network operation and maintenance personnel shall issue the corresponding access control policies on the network devices involved.

[0028] In large data center networks, there are many different network partitions, including office areas, production areas, and testing areas. These network partitions may also have different sub-partitions, such as Production Zone 1, Production Zone 2, and Production Zone 3. Corresponding access control standards exist between different network partitions, and network operations personnel need to determine whether the network access requirements comply with these standards.

[0029] However, from the perspective of the applicant, their only concern is the result of network activation. Whether the activation of host A to host B complies with access control specifications, and how to map the host's IP address to the access control specifications, are not within their scope of knowledge.

[0030] From the perspective of network operations and maintenance personnel, the core information in the request form submitted by the requester is the IP addresses of the source and target hosts. Mapping the host IP addresses to network partitions and then matching them against the request form to see if they comply with access control specifications is an extremely time-consuming process and it is difficult to guarantee the accuracy of the matching.

[0031] Based on the above scenarios, it is clear that in existing technologies, manually identifying and judging IP addresses requires a significant amount of verification time and is difficult to guarantee accuracy.

[0032] The application provides a network application form approval method, the latest network application form is obtained, the information of the source IP and the target IP is contained in the form, and the access permission of the source IP to the target IP is applied. The information of the source IP and the target IP is extracted from the network application form, the source IP is converted into a first value by a preset algorithm, and the target IP is converted into a second value. The two converted values are matched with a preset access control table to determine the network partitions to which they belong. According to the target matching result, the first access area corresponding to the first value, the second access area corresponding to the second value, and the permission information of the first access area to the second access area are determined: according to the matching result, it is determined that the source IP and the target IP belong to which network partition, and the access permission between the two network partitions. If the permission information indicates that the first access area is allowed to access the second access area, it is determined that the network application form is approved: if the access permission allows the network partition where the source IP is located to access the network partition where the target IP is located, the network application form is approved. The complex IP address is converted into a simple value, and then the network application form is quickly determined according to the value range of the preset access area in the access control table. The problem that a large amount of checking time is consumed and the accuracy cannot be guaranteed when the process is identified and judged by manual IP address is solved. The effect of quickly determining whether the source and target of the network opening demand meet the rules is achieved.

[0033] The technical solutions of the application and how the technical solutions of the application solve the above technical problems will be described in detail in specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the application will be described below with reference to the drawings.

[0034] Figure 2 The flowchart of the network application form approval method provided by the application Figure 1 As shown in Figure 2 , the method comprises:

[0035] S201, obtaining an updated network application form, and identifying the source IP and the target IP carried by the network application form, wherein the network application form is used to apply for the access permission of the source IP to the target IP;

[0036] In an optional embodiment, the network application form is as shown in Table 1:

[0037] Table 1

[0038]

[0039] Optionally, the network application form can also carry target port information.

[0040] S202, converting the source IP into a first value and the target IP into a second value through a preset algorithm, matching the first value and the second value with a preset access control table, determining a first access zone corresponding to the first value, a second access zone corresponding to the second value, and permission information of the first access zone accessing the second access zone according to a target matching result;

[0041] The IP address is converted into a numerical form through an algorithm, and then the numerical values are compared with entries in an access control table to determine access permissions.

[0042] S203, if the permission information indicates that the first access zone is allowed to access the second access zone, it is determined that the network application form passes the approval.

[0043] Through the above method, the latest network application form is obtained, which contains the information of the source IP and the target IP, and is used to apply for the access permission of the source IP accessing the target IP. The information of the source IP and the target IP is extracted from the network application form, the source IP is converted into a first value and the target IP is converted into a second value through a preset algorithm. The two converted numerical values are matched with a preset access control table to determine the network partitions to which they belong. According to the target matching result, the first access zone corresponding to the first value and the second access zone corresponding to the second value are determined, as well as the permission information of the first access zone accessing the second access zone. According to the matching result, it is determined that the source IP and the target IP belong to which network partition, and the access permission between the two network partitions. If the permission information indicates that the first access zone is allowed to access the second access zone, it is determined that the network application form passes the approval: if the access permission allows the network partition where the source IP is located to access the network partition where the target IP is located, the network application form passes the approval. The complex IP address is converted into a simple numerical value, and then the network application form is quickly determined whether it passes the approval according to the numerical value range of the preset access zone in the access control table. The effect of quickly determining whether the source and target of the network opening demand meet the rules is achieved.

[0044] In one possible embodiment, first digital information constituting the source IP is identified, the first digital information is divided into four first number fields according to a division point carried in the first digital information, the four first number fields are multiplied by conversion coefficients respectively and summed to obtain a first summation result, wherein the conversion coefficients are determined based on position information of the first number fields in the first digital information, and the first summation result is determined as the first numerical value; second digital information constituting the target IP is identified, the second digital information is divided into four second number fields according to a division point carried in the second digital information, the four second number fields are multiplied by conversion coefficients respectively and summed to obtain a second summation result, wherein the conversion coefficients are determined based on position information of the second number fields in the second digital information, and the second summation result is determined as the second numerical value.

[0045] Optionally, the first digital information of the source IP is 32.38.143.36 / 32, and the division point is “.”, according to which the first digital information can be divided into four numbers. For example, the IP address IP1=X1.X2.X3.X4 / 32, and the result of converting IP1 into decimal is a (equivalent to the first summation result), wherein:

[0046] a=X1*2563+X2*2562+X3*2561+X4*2560. 3 2 1 0

[0047] Optionally, the first preset algorithm is a=X1*2563+X2*2562+X3*2561+X4*2560. 0

[0048] Optionally, the first digital information is 32.38.143.36 / 32, and the four first number fields correspond to 32, 38, 143 and 36. The conversion coefficient corresponding to 32 is 2563, the conversion coefficient corresponding to 38 is 2562, the conversion coefficient corresponding to 143 is 2561, and the conversion coefficient corresponding to 36 is 2560. Different positions correspond to different conversion coefficients. When the first number field is located at the first number in the first digital information, the conversion coefficient corresponding to the first number field is 2563; when the first number field is located at the second number in the first digital information, the conversion coefficient corresponding to the first number field is 2562; when the first number field is located at the third number in the first digital information, the conversion coefficient corresponding to the first number field is 2561; and when the first number field is located at the fourth number in the first digital information, the conversion coefficient corresponding to the first number field is 2560.

[0049] The algorithm of the second digital information corresponding to the second summation result is the same as the above method. ​​​​

[0050] In a possible embodiment, row information and column information in the access control table are read, where the row information is used to indicate a plurality of source end access areas, and the plurality of source end access areas respectively correspond to different first value ranges, and the column information is used to indicate a plurality of target end access areas, and the plurality of target end access areas respectively correspond to different second value ranges; a target first value range matching the first value is determined, a source end access area corresponding to the target first value range is determined as a first access area; a target second value range matching the second value is determined, a target end access area corresponding to the target second value range is determined as a second access area; and permission information of the first access area accessing the second access area is determined according to intersection information of the first access area and the second access area in the preset access control table.

[0051] According to the above formula, the values of the source end IP address and the target end IP address converted into decimals in Table 2 can be calculated, as shown in Table 2:

[0052] Table 2

[0053]

[0054] After the IP address is converted into decimal, according to the decimal value range corresponding to the network segment pre-planned by the network operation personnel, the program can directly determine the network partition where the source end and the target end are located, as shown in Table 3:

[0055] Table 3

[0056]

[0057] It should be noted that by associating different access areas with value ranges, when determining access permissions, only the value range needs to be matched. If a plurality of IP addresses corresponding to access areas are pre-stored in the access control table, when used, the system needs to scan all the pre-stored IP addresses one by one for matching. When the number of IP addresses is large, the amount of calculation is large, and the matching time is long.

[0058] Optionally, the access control table is as shown in Table 4:

[0059] Table 4

[0060]

[0061] The row information is used to indicate the source end access areas corresponding to the source end in Table 2, including office 1 area, office 2 area, production 1 area, production 2 area, production 3 area, test 1 area, and test 2 area. Each access area corresponds to a preset value range.

[0062] The row information is read from the access control table, which indicates a plurality of source access zones. Each source access zone corresponds to a specific first numerical range. Meanwhile, the column information is read, which indicates a plurality of target access zones. Each target access zone corresponds to a specific second numerical range. According to the first numerical value obtained from the previous conversion, the target first numerical range that matches it is determined. This matching process involves searching the row information in the access control table to find the range containing the first numerical value. Similarly, according to the second numerical value, the target second numerical range that matches it is determined. This requires searching the column information in the access control table to find the range containing the second numerical value.

[0063] In one possible embodiment, if the cross information indicates that access is allowed, it is determined that the permission of the first access zone allows access to the second access zone; if the cross information indicates that access is prohibited, it is determined that the permission of the first access zone prohibits access to the second access zone, and the network application form is returned to the uploading object that uploaded the network application form; if the cross information indicates that it is to be determined, the network application form is forwarded to an audit terminal for auditing, and the permission information of the first access zone accessing the second access zone is determined according to the auditing result.

[0064] Determining the access zone: the system first determines the first access zone to which the source IP address belongs, and then determines the second access zone to which the target IP address belongs. The system checks the cross information of the first access zone and the second access zone in the access control table to determine whether there is an allowed or prohibited access rule.

[0065] If the cross information indicates that access is allowed, the system will directly determine that the permission of the first access zone allows access to the second access zone. This means that the source IP address or IP address segment is authorized to access the target IP address or IP address segment.

[0066] If the cross information indicates that access is prohibited, the system will reject the access request of the first access zone to the second access zone, and return the network application form to the object that uploaded the form. This means that there is a security policy or rule that prevents such access.

[0067] If the cross information indicates that it is to be determined, that is, the access control policy is not clear or needs further verification, the system will forward the network application form to an audit terminal for manual or automatic auditing. The auditing result will determine whether to allow or reject the access request.

[0068] As shown in Figure 3 , Figure 3 is the flowchart of the approval method of the network application form provided by the present application Figure 2 ,

[0069] The user first needs to fill out the relevant forms, which is the starting point of the entire process. After filling out, the system submits the information to the network approval department for preliminary review. After the network approval passes, the system will calculate and allocate IP addresses. Next, the system will perform matrix matching according to certain rules to ensure that the IP address matches a specific resource or service. If the matrix (equivalent to the network application form) matches successfully and meets all approval conditions, the approval will pass and proceed to the next step. After the approval passes, the relevant operations or services will be implemented, which may include resource allocation, service startup, etc. In the case of cross-information indicating manual review, manual intervention may be required to further evaluate or adjust the approval result.

[0070] If problems or non-compliance are found during the approval process, the system may prompt the user to make modifications and then resubmit the application.

[0071] In one possible embodiment, if the audit result indicates that access is prohibited, the network application form is returned to the upload object that uploaded the network application form, and the upload object is prompted to modify the network application form. If the audit result indicates that access is allowed, the system determines that the permissions of the first access zone allow access to the second access zone.

[0072] If the audit result indicates that access should be prohibited, the system returns the network application form to the object that originally submitted the form and prompts the object to make necessary modifications to the application form to meet security requirements. If the audit result indicates that access can be allowed, the system determines that the permissions of the first access zone allow access to the second access zone. This means that the source IP address or IP address segment is authorized to access the target IP address or IP address segment.

[0073] In one possible embodiment, if the network application form carries multiple network applications, the system determines the permission information corresponding to each network application in the multiple network applications, where each network application includes a source IP and a target IP. If the permission information corresponding to any network application in the multiple network applications is prohibited access, the network application form is returned to the upload object that uploaded the network application form, and the upload object is prompted to modify the network application form.

[0074] If the network application form contains multiple network applications, the system needs to process each application separately to determine their permission information. This means that each application needs to be evaluated independently to determine whether its source IP and destination IP match the security policy. For each network application, the system determines its permission information based on the pre-set access control table. This usually involves checking whether the source IP and destination IP match the allowed access rules. If the permission information of any one of the multiple network applications indicates that access is prohibited, the entire network application form will be returned to the object that originally submitted the form. This usually means that there is a security problem or policy mismatch that needs to be adjusted by the applicant.

[0075] In one possible embodiment, if the network application form carries source and destination ports, the source port is converted into a third value and the destination port is converted into a fourth value by a pre-set algorithm. The third value and the fourth value are matched with a pre-set port control table to determine the first port zone corresponding to the third value, the second port zone corresponding to the fourth value, and the port permission connecting the first port zone to the second port zone. If the port permission indicates that the first port zone is allowed to access the second port zone, the network application form is determined to be approved.

[0076] If the network application form contains source and destination ports, the system needs to convert these port information into numerical form for matching with the pre-set port control table. The system uses a pre-set algorithm to convert the source port into a third value and the destination port into a fourth value. This conversion is usually to simplify the matching process or to adapt to specific data structures. The system matches the third value and the fourth value with the pre-set port control table to determine which port zone they belong to respectively. According to the matching result, the system determines the first port zone corresponding to the third value and the second port zone corresponding to the fourth value. The system also determines the port permission connecting the first port zone to the second port zone, which determines whether the first port zone is allowed to access the second port zone. If the port permission indicates that the first port zone is allowed to access the second port zone, the network application form is determined to be approved.

[0077] The method for approving a network application form provided by the embodiment of the application obtains the latest network application form, which contains the information of a source IP and a target IP and is used to apply for the access permission of the source IP to the target IP. The information of the source IP and the target IP is extracted from the network application form, and the source IP is converted into a first value and the target IP is converted into a second value through a preset algorithm. The two converted values are matched with a preset access control table to determine the network partitions to which they belong. According to the target matching result, the first access area corresponding to the first value, the second access area corresponding to the second value, and the permission information of the first access area to access the second access area are determined. According to the matching result, it is determined that the source IP and the target IP belong to which network partitions and the access permission between the two network partitions. If the permission information indicates that the first access area is allowed to access the second access area, it is determined that the network application form passes the approval. If the access permission allows the network partition where the source IP is located to access the network partition where the target IP is located, the network application form passes the approval. The complex IP address is converted into a simple value, and then the network application form is quickly determined to pass the approval according to the value range of the preset access area in the access control table. The effect of quickly determining whether the source and target of the network opening demand meet the rules is achieved.

[0078] Figure 4 The structural diagram of the approval device for the network application form provided by the application is shown in Figure 4 The approval device 40 for the network application form provided by the embodiment includes:

[0079] The obtaining module 401 is configured to obtain an updated network application form and identify the source IP and the target IP carried by the network application form, wherein the network application form is used to apply for the access permission of the source IP to the target IP.

[0080] The matching module 402 is configured to convert the source IP into a first value and the target IP into a second value through a preset algorithm, match the first value and the second value with a preset access control table, and determine the first access area corresponding to the first value, the second access area corresponding to the second value, and the permission information of the first access area to access the second access area according to the target matching result.

[0081] The determining module 403 is configured to determine that the network application form passes the approval if the permission information indicates that the first access area is allowed to access the second access area.

[0082] In a possible embodiment, the matching module 402 is further configured to identify first digital information constituting the source IP, divide the first digital information into four first number fields according to a split point carried in the first digital information, multiply the four first number fields by conversion coefficients respectively and sum the results to obtain a first sum result, wherein the conversion coefficients are determined based on position information of the first number fields in the first digital information, and determine the first sum result as the first numerical value; identify second digital information constituting the target IP, divide the second digital information into four second number fields according to a split point carried in the second digital information, multiply the four second number fields by conversion coefficients respectively and sum the results to obtain a second sum result, wherein the conversion coefficients are determined based on position information of the second number fields in the second digital information, and determine the second sum result as the second numerical value.

[0083] In a possible embodiment, the matching module 402 is further configured to read row information and column information in an access control table, wherein the row information is used to indicate a plurality of source access areas, and the plurality of source access areas respectively correspond to different first numerical value ranges; the column information is used to indicate a plurality of target access areas, and the plurality of target access areas respectively correspond to different second numerical value ranges; determine a target first numerical value range matched with the first numerical value, determine a source access area corresponding to the target first numerical value range as a first access area; determine a target second numerical value range matched with the second numerical value, determine a target access area corresponding to the target second numerical value range as a second access area; and determine, according to intersection information of the first access area and the second access area in the preset access control table, permission information of the first access area accessing the second access area.

[0084] In a possible embodiment, the matching module 402 is further configured to, if the intersection information indicates allowed access, determine that the permission of the first access area allows access to the second access area; if the intersection information indicates forbidden access, determine that the permission of the first access area forbids access to the second access area, and return the network application form to an uploading object that uploads the network application form; and if the intersection information indicates to be determined, forward the network application form to an audit terminal for auditing, and determine, according to an audit result, the permission information of the first access area accessing the second access area.

[0085] In a possible embodiment, the matching module 402 is further configured to, if the audit result indicates forbidden access, return the network application form to an uploading object that uploads the network application form, and prompt the uploading object to modify the network application form; and if the audit result indicates allowed access, determine that the permission of the first access area allows access to the second access area.

[0086] In a possible implementation, the apparatus further includes a modification module (not shown in the figure) configured to, if the network application form carries multiple network applications, determine the permission information corresponding to each of the multiple network applications, wherein each network application includes a source IP and a target IP; and if the permission information corresponding to any of the multiple network applications is access prohibited, return the network application form to an uploading object that uploads the network application form, and prompt the uploading object to modify the network application form.

[0087] In a possible implementation, the apparatus further includes a port module (not shown in the figure) configured to, if the network application form carries a source port and a target port, convert the source port into a third value and the target port into a fourth value by using a preset algorithm, match the third value and the fourth value with a preset port control table, and determine, according to a target matching result, a first port area corresponding to the third value, a second port area corresponding to the fourth value, and a port permission that the first port area connects the second port area; and if the port permission indicates that the first port area is allowed to access the second port area, determine that the network application form passes the examination and approval.

[0088] The network application form examination and approval apparatus provided in this embodiment can execute the method provided in the method embodiments, and has similar implementation principles and technical effects, which will not be described here again in this embodiment.

[0089] Figure 5 A structural schematic diagram of the network application form examination and approval apparatus provided in this application is shown in FIG. 5. As shown in FIG. 5, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, the memory 502, and the communication component 503 are connected through a bus 504. Figure 5

[0090] In the specific implementation process, the at least one processor 501 executes the computer execution instructions stored in the memory 502, so that the at least one processor 501 executes the method described above.

[0091] The specific implementation process of the processor 501 can refer to the method embodiments described above, and has similar implementation principles and technical effects, which will not be described here again in this embodiment.

[0092] ​In the above embodiments, it should be understood that the processor can be a central processing unit (CPU) and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution or combined with hardware and software modules in the processor for execution.

[0093] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0094] The bus can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0095] The present application also provides a computer program product comprising a computer program which, when executed by a processor, implements the above method.

[0096] The present application also provides a computer readable storage medium having computer execution instructions stored therein, wherein when a processor executes the computer execution instructions, the above method is implemented.

[0097] The above readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0098] An example readable storage medium is coupled to the processor such that the processor can read information from the readable storage medium and can write information to the readable storage medium. Of course, the readable storage medium can also be a part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0099] The division of units is only a logical functional division, and in actual implementation, there can be another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0100] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0101] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0102] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0103] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. The program executes to perform the steps of the above-mentioned method embodiments; and the foregoing storage medium includes various media capable of storing program codes, such as ROM, RAM, magnetic disk, or optical disk.

[0104] Finally, it should be noted that other embodiments of the present application will readily occur to those skilled in the art upon consideration of the specification and practice of the present application disclosed herein. The present application is intended to include all such variations as fall within the general scope of the application, and includes the generic principles disclosed and the best mode known to the inventors to be currently practiced as well as variations thereof, without departing from the scope of the present application as defined by the claims. The specification and examples give the best application of the present application as known to at least one of the inventors at the time of the filing of this application. It is to be understood that since numerous modifications and changes will readily occur to those skilled in the art, the application is not to be limited to the exact construction and operation as illustrated and described. Accordingly, all such variations are intended to be included within the scope of the present application as defined in the claims. The application is to be limited only by the claims.

Claims

1. A method of approving a network application form, characterized by, The method comprises: obtaining an updated network application form, and identifying a source IP and a target IP carried by the network application form, wherein the network application form is used to apply for access permission of the source IP to the target IP; converting the source IP into a first numerical value and the target IP into a second numerical value by using a preset algorithm, matching the first numerical value and the second numerical value with a preset access control table, and determining a first access zone corresponding to the first numerical value, a second access zone corresponding to the second numerical value, and permission information of the first access zone to access the second access zone according to a target matching result; if the permission information indicates that the first access zone is allowed to access the second access zone, determining that the network application form passes the examination and approval.

2. The method of claim 1, wherein, The method comprises: identifying first digital information constituting the source IP, and dividing the first digital information into four first number fields according to a division point carried in the first digital information; multiplying the four first number fields by conversion coefficients respectively, and summing up to obtain a first summation result, wherein the conversion coefficients are determined based on position information of the first number fields in the first digital information; determining the first summation result as the first numerical value; identifying second digital information constituting the target IP, and dividing the second digital information into four second number fields according to a division point carried in the second digital information; multiplying the four second number fields by conversion coefficients respectively, and summing up to obtain a second summation result, wherein the conversion coefficients are determined based on position information of the second number fields in the second digital information; determining the second summation result as the second numerical value.

3. The method of claim 1, wherein, The method comprises: reading row information and column information in the access control table, wherein the row information is used to indicate a plurality of source access zones, and the plurality of source access zones correspond to different first numerical value ranges respectively, and the column information is used to indicate a plurality of target access zones, and the plurality of target access zones correspond to different second numerical value ranges respectively; determining a target first numerical value range matched with the first numerical value, and determining a source access zone corresponding to the target first numerical value range as the first access zone; determining a target second numerical value range matched with the second numerical value, and determining a target access zone corresponding to the target second numerical value range as the second access zone; determining the permission information of the first access zone to access the second access zone according to intersection information of the first access zone and the second access zone in the preset access control table.

4. The method of claim 3, wherein, The method comprises: If the cross information indicates permission of access, it is determined that the permission of the first access area allows access to the second access area; If the cross information indicates prohibition of access, it is determined that the permission of the first access area prohibits access to the second access area, and the network application form is returned to the uploading object uploading the network application form; If the cross information indicates to be determined, the network application form is forwarded to an audit terminal for auditing, and the permission information of the first access area accessing the second access area is determined according to the auditing result.

5. The method of claim 4, wherein, According to the auditing result, the permission information of the first access area accessing the second access area is determined, including: If the auditing result indicates prohibition of access, the network application form is returned to the uploading object uploading the network application form, and the uploading object is prompted to modify the network application form; If the auditing result indicates permission of access, it is determined that the permission of the first access area allows access to the second access area.

6. The method according to any one of claims 1-5, characterized in that, Before determining that the network application form passes the approval, the method further includes: If the network application form carries multiple network applications, the permission information corresponding to each network application in the multiple network applications is determined, wherein each network application includes a source IP and a target IP; If the permission information corresponding to any network application in the multiple network applications is prohibition of access, the network application form is returned to the uploading object uploading the network application form, and the uploading object is prompted to modify the network application form.

7. The method according to any one of claims 1-5, characterized in that, Before determining that the network application form passes the approval, the method further includes: If the network application form carries a source port and a target port, the source port is converted into a third value and the target port is converted into a fourth value by a preset algorithm, the third value and the fourth value are matched with a preset port control table, and the first port area corresponding to the third value, the second port area corresponding to the fourth value, and the port permission of the first port area connecting the second port area are determined according to the target matching result; If the port permission indicates that the first port area is allowed to access the second port area, it is determined that the network application form passes the approval.

8. An approval device of a network application form, characterized by comprising: Including: An acquisition module is configured to acquire an updated network application form, and identify a source IP and a target IP carried by the network application form, wherein the network application form is used to apply for access permission of the source IP accessing the target IP; A matching module is configured to convert the source IP into a first value and the target IP into a second value by a preset algorithm, match the first value and the second value with a preset access control table, and determine a first access area corresponding to the first value, a second access area corresponding to the second value, and permission information of the first access area accessing the second access area according to a target matching result; A determination module is configured to determine that the network application form passes the approval if the permission information indicates that the first access area is allowed to access the second access area.

9. An approval device of a network application form, characterized by, Including: A memory and a processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by the processor to implement the method according to any one of claims 1-7.

Images