Data query method and device, data storage method and device and storage medium

Abstract

The invention discloses a data query method and device, a data storage method and device and a storage medium, and relates to the field of network security. The data query method comprises the steps of obtaining a current version number of a service feature library of target security equipment; according to the corresponding relation between the predefined service in a preset service table and the start version number, inquiring the predefined service of which the start version number is smaller than or equal to the current version number from the preset service table; and performing policy configuration on the target security equipment according to the queried predefined service. Compared with the prior art, the embodiment of the invention has the advantages that the storage pressure of the network security management system can be reduced, and the data query efficiency of the network security management system can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a data query method, a data storage method, a device and a storage medium. Background Art

[0002] Security policy is an essential part of a firewall, and its most important function is to implement access control. It can define which users or devices can access which network resources, and under what conditions. Security policies are usually configured by a data query device connected to the firewall and sent to the firewall for application. Common security policies include information such as source address, destination address, protocol, source port, and destination port. In order to simplify user configuration, mainstream firewalls will encapsulate some information such as protocol, source port, and destination port. The encapsulation result is the service object, also known as service. Correspondingly, the pre-encapsulated service can be directly referenced in the security policy.

[0003] With the advancement of technology and the increasing complexity of network environments, new network access requirements and applications continue to emerge. In order to meet the network security requirements of these network access requirements and applications, firewalls need to add corresponding predefined services to simplify management and improve security. Therefore, network security vendors will regularly publish new predefined services in the form of collections and databases to the feature library server, and publish the corresponding version number each time a predefined service is released to ensure that users in need can update to the new predefined services in a timely manner.

[0004] In the related art, the network security management system stores all services and corresponding version numbers of each version of the service feature library. However, with the continuous increase of predefined services, the network security management system needs to store all versions of predefined service information to configure firewalls with different versions of feature libraries that may appear. This makes the amount of data that needs to be stored in the network security management system increasingly larger, which not only brings storage pressure to the network security management system, but also affects the data query efficiency of the network security management system. Summary of the invention

[0005] The purpose of the present application is to provide a data query method, a data storage method, a device and a storage medium, which can reduce the storage pressure of a network security management system and improve the data query efficiency of the network security management system.

[0006] In the first aspect, an embodiment of the present application provides a data query method, the method comprising: obtaining the current version number of a service feature library of a target security device; based on the correspondence between predefined services and start version numbers in a preset service table, querying from the preset service table a predefined service whose start version number is less than or equal to the current version number, wherein the start version number corresponding to any of the predefined services is used to indicate the earliest version of the service feature library that has the predefined service; and performing policy configuration on the target security device based on the queried predefined service.

[0007] Compared with the related art, in the data query method provided in the embodiment of the present application, the current version number of the service feature library of the target security device is the version number of the predefined service that the target security device can support. Considering that the later version released by the network security vendor includes all the services of the previous version, the service feature library of the later released version has incremental predefined services compared to the service feature library of the previous version. By querying the predefined services whose starting version number is less than or equal to the current version number from the preset service table, all the services corresponding to the current version number can be obtained. Therefore, on the basis of realizing service query and reading, there is no need to repeatedly store duplicate services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store a corresponding starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading the predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0008] In an optional embodiment, when the current version number satisfies a preset update condition, a service feature library having the current version number is obtained, wherein the preset update condition includes: the current version number is greater than the largest starting version number in the preset service table, or is less than the smallest starting version number in the preset service table; and the preset service table is updated according to the current version number and the service feature library having the current version number.

[0009] In this embodiment, if the current version number is greater than the largest starting version number in the preset service table, it means that the target security device has upgraded the service version; or the current version number is less than the smallest starting version number in the preset service table, it means that the starting version number stored in the preset service table is not the actual starting version number of the predefined service; in these cases, the service feature library of the current version number is obtained, and the preset service table is updated according to the current version number and the corresponding service feature library. There is no need to update the preset service table based on the feature library server. On the one hand, the update efficiency of the preset service table can be improved, and on the other hand, the preset service table can be updated when the connection between the network security management system and the feature library server is interrupted.

[0010] In an optional embodiment, updating the preset service table based on the current version number and the service feature library having the current version number includes: when the current version number is less than the smallest starting version number in the preset service table, for each predefined service existing in the service feature library and in the preset service table, using the current version number as the starting version number corresponding to the predefined service in the preset service table; when the current version number is greater than the largest starting version number in the preset service table, for each predefined service existing in the service feature library but not in the preset service table, adding the predefined service to the preset service table, and using the current version number as the starting version number corresponding to the predefined service added to the preset service table.

[0011] In this embodiment, the current version number is smaller than the smallest start version number in the preset service table, indicating that the start version number stored in the preset service table is not the actual start version number of the predefined service. At this time, using the current version number as the start version number corresponding to the predefined service can make the start version number stored in the preset service table closer to the actual start version number of the predefined service, thereby improving the reliability of the data stored in the preset service table; the current version number is larger than the largest start version number in the preset service table, indicating that at least some of the predefined services in the service feature library are not stored in the preset service table. At this time, adding this part of the predefined services not stored in the preset service table to the preset service table, and adding the corresponding current version number as the start version number to the preset service table can improve the richness of the predefined services stored in the preset service table.

[0012] In an optional embodiment, the method further includes: when it is monitored that the version number of the service feature library in the feature library server is higher than the maximum starting version number in the preset service table, obtaining all service feature libraries in the feature library server whose version number is higher than the maximum starting version number and the version number of each service feature library; and updating the preset service table according to the service feature library and the version number of the service feature library obtained from the feature library server.

[0013] In this embodiment, if it is monitored that a service feature library with a version number higher than the maximum starting version number in the preset service table appears on the feature library server, that is, the feature library server has updated the service version, then all service feature libraries in the feature library server with a version number higher than the maximum starting version number and the version number of each service feature library are directly downloaded from the feature library server to update the preset service table, thereby improving the real-time performance of the predefined services and starting version numbers stored in the network security management system.

[0014] In an optional embodiment, the preset service table is updated based on the service feature library and the version number of the service feature library obtained from the feature library server, including: for each predefined service that exists in the service feature library but not in the preset service table, the predefined service is added to the preset service table, and the version number of the service feature library is used as the starting version number corresponding to the predefined service added to the preset service table.

[0015] In this embodiment, when the preset service table is updated, the latest predefined service and version number are stored in the preset service table accordingly, increasing the number of predefined services stored in the preset service table, which is beneficial to improving the adaptability of the network security management system and the target security device.

[0016] In an optional embodiment, for two or more target security devices that share a security policy, obtaining the current version number of the service feature library of the target security device includes: obtaining the smallest version number among the current version numbers of the service feature library of each target security device; and querying the preset service table for a predefined service whose start version number is less than or equal to the current version number based on the correspondence between the predefined services in the preset service table and the start version number, includes: querying the preset service table for a predefined service whose start version number is less than or equal to the smallest version number among the current version number based on the correspondence between the predefined services in the preset service table and the start version number.

[0017] In this embodiment, obtaining the predefined service corresponding to the minimum value of the current version numbers of two or more target security devices, that is, the first released predefined service, can avoid the situation where the policy and the target security devices cannot be adapted when configuring policies for two or more target security devices.

[0018] In a second aspect, an embodiment of the present application provides a data storage method, the method comprising: obtaining service feature libraries of different versions and the version numbers of each of the service feature libraries, wherein the predefined services in the service feature libraries are used to configure security policies; determining the starting version number of each of the predefined services based on the predefined services in each of the service feature libraries and the version numbers of each of the service feature libraries, wherein the starting version number of any of the predefined services is used to indicate the earliest version of the service feature library that has the predefined service; and storing the correspondence between each of the predefined services and the starting version number of each of the predefined services in a preset service table.

[0019] Compared with the related art, in the data storage method provided in the embodiment of the present application, the correspondence between each predefined service and the starting version number of each predefined service is stored in a preset service table. When querying the predefined service, the predefined service can be directly queried based on the starting version number. There is no need to repeatedly store duplicate services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store one starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading the predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0020] In the third aspect, an embodiment of the present application provides a data query device, which includes: a first acquisition module, used to obtain the current version number of the service feature library of the target security device; a query module, used to query the predefined services whose start version number is less than or equal to the current version number from the preset service table based on the correspondence between the predefined services and the start version numbers in the preset service table, wherein the start version number corresponding to any of the predefined services is used to indicate the earliest version of the service feature library that has the predefined service; a configuration module, used to perform policy configuration on the target security device according to the queried predefined service.

[0021] In a fourth aspect, an embodiment of the present application provides a data storage device, comprising: a second acquisition module, used to acquire different versions of service feature libraries and the version numbers of each of the service feature libraries, wherein the predefined services in the service feature libraries are used to configure security policies; a determination module, used to determine the starting version number of each of the predefined services based on the predefined services in each of the service feature libraries and the version numbers of each of the service feature libraries, wherein the starting version number of any of the predefined services is used to indicate the earliest version of the service feature library that has the predefined service; a storage module, used to store the correspondence between each of the predefined services and the starting version number of each of the predefined services in a preset service table.

[0022] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the aforementioned data query method and / or data storage method. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can also be obtained based on these drawings.

[0024] Figure 1 A schematic diagram of a flow chart of a data storage method provided in Embodiment 1 of the present application;

[0025] Figure 2 A schematic diagram of the structure of a data storage device provided in Embodiment 2 of the present application;

[0026] Figure 3 A flowchart of a data query method provided in Example 1 of the present application;

[0027] Figure 4 A flowchart of a data query method provided in Embodiment 2 of the present application;

[0028] Figure 5 A flowchart of a data query method provided in Embodiment 3 of the present application;

[0029] Figure 6 A schematic diagram of the structure of a data query device provided in Embodiment 4 of the present application;

[0030] Figure 7 This is a schematic diagram of the structure of the electronic device provided in Example 4 of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0032] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application as claimed, but is merely representative of selected embodiments of the present application.

[0033] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0034] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0035] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0036] As a common network security device, the firewall has a security policy that is an essential part of it. Its most important function is to implement access control. It can define which users or devices can access which network resources and under what conditions. For example, the security policy shown in Table 1 below allows packets with a source address of 192.168.1.2, a destination address of 114.114.114.114, and a port of TCP / 80 for the service being accessed to pass through the firewall.

[0037]

[0038] In order to simplify user configuration, mainstream firewalls will pre-encapsulate the protocol, source port, and destination port to form a predefined service object, which is also called a service (i.e., a predefined service) in this application.

[0039] Table 1 corresponds to the services.

[0040]

[0041]

[0042] Correspondingly, the security policy shown in Table 1 is changed to that shown in Table 3 below.

[0043]

[0044] Network security vendors pre-package multiple services and release them in the form of a collection. Each released service signature library corresponds to a unique version number. As shown in Table 4 below, version 1.0 includes three services: S1, S2, and S3. Version 1.1 adds two new services, S4 and S5, based on version 1.0. This version includes five services: S1, S2, S3, S4, and S5. Version 1.2 adds two new services, S6 and S7, based on version 1.1. This version includes seven services: S1, S2, S3, S4, S5, S6, and S7.

[0045]

[0046] Correspondingly, it is stored in the data query device in the manner shown in Table 5 below.

[0047]

[0048]

[0049] Combined with Table 5 above, it can be found that in this storage method, all services of each version are stored, resulting in a large number of services being stored repeatedly, which seriously wastes the storage space of the data query device; and the larger amount of stored data also leads to a decrease in the efficiency of querying and reading predefined services during subsequent use. In order to solve the above technical problems, the embodiments of the present application provide a data query method, a data storage method, a device and a storage medium, and the specific details can be referred to the specific description of the following embodiments.

[0050] Embodiment 1

[0051] The present application embodiment provides a data storage method, such as Figure 1 As shown, the data storage method provided in this embodiment includes:

[0052] Step S101: obtaining service feature libraries of different versions and the version number of each service feature library.

[0053] In this step, different versions of service feature libraries include predefined services, and each service feature library corresponds to a unique version number. As shown in Table 4 above, the first service feature library released earliest includes three predefined services S1, S2, and S3, and the version number corresponding to this service feature library is 1.0; the second service feature library released later includes five predefined services S1, S2, S3, S4, and S5, and the version number corresponding to this service feature library is 1.1...

[0054] Furthermore, in this step, the predefined services in the service feature library are used to configure security policies.

[0055] The data storage method provided in the embodiment of the present application can be applied to a network security management system, which can be implemented in the form of software, hardware, or a combination of software and hardware.

[0056] In some examples, in step S01, the network security management system may obtain a service feature library and a version number of the service feature library from at least one of a security device and a feature library server.

[0057] The network security management system may have a database, which may use a preset service table to record the correspondence between the predefined services involved in different versions of the service feature library and the start version numbers of the predefined services.

[0058] It can be understood that the service feature library and the version number of the service feature library in the security device are obtained by the security device from the feature library server. For example, every time the feature library server releases a new service feature library, the newly released service feature library and the version number of the service feature library are sent by the feature library server to the security device.

[0059] In this embodiment, the network security management system can use predefined services to configure security policies for target security devices such as firewalls.

[0060] Step S102: Determine the starting version number of each predefined service according to the predefined services in each service feature library and the version number of each service feature library.

[0061] In this step, for different service feature libraries, the service feature library with a larger version number has incremental predefined services compared to the service feature library with a smaller version number. For example, the different service feature libraries shown in Table 4 above all include three predefined services S1, S2, and S3, and the service feature library of version 1.1 has predefined services S4 and predefined services S5 compared to the service feature library of version 1.0.

[0062] In some examples, the network security management system can determine that the starting version number corresponding to each predefined service in several service feature libraries is the smallest version number corresponding to the predefined service in all service feature libraries. For example, predefined services S1, S2, and S3 correspond to three version numbers 1.0, 1.1, and 1.2 in three service feature libraries, respectively, and the smallest version number 1.0 can be used as the starting version number of predefined services S1, S2, and S3; predefined services S4 and S5 correspond to two version numbers 1.1 and 1.2 in three service feature libraries, respectively, and the smallest version number 1.1 can be used as the starting version number of predefined services S4 and S5; predefined services S6 and S7 correspond to only one version number 1.2 in three service feature libraries, and version number 1.2 can be used as the starting version number of predefined services S6 and S7.

[0063] Step S103: storing the correspondence between each predefined service and the start version number of each predefined service in a preset service table.

[0064] In some examples, the network security management system may record the correspondence between the name of each predefined service and the start version number of each predefined service in the preset service table.

[0065] As shown in Table 6 below, the correspondence between each predefined service and the start version number of each predefined service is stored in the preset service table in the following form.

[0066]

[0067]

[0068] In some examples, the method further includes: obtaining the current version number of the service feature library of the target security device; querying the preset service table for predefined services whose start version number is less than or equal to the current version number according to the correspondence between the predefined services in the preset service table and the start version number, wherein the start version number corresponding to any predefined service is used to indicate the version of the service feature library with the earliest predefined service; and configuring the policy of the target security device according to the queried predefined service. The target security device may be a security device for which a security policy is to be configured.

[0069] Here, the specific implementation process of steps such as obtaining the current version number of the service feature library of the target security device and querying the predefined services whose start version number is less than or equal to the current version number from the preset service table can be referred to the relevant description content below and will not be elaborated here.

[0070] In some examples, the method also includes: obtaining the current version number of the service feature library of the target security device; when the current version number meets the preset update conditions, obtaining the service feature library with the current version number, wherein the preset update conditions include: the current version number is greater than the largest starting version number in the preset service table, or is less than the smallest starting version number in the preset service table; updating the preset service table according to the current version number and the service feature library with the current version number.

[0071] Here, the specific implementation process of the update step of the preset service table can refer to the relevant description content below, which will not be explained in detail here.

[0072] Compared with the related art, in the data storage method provided in the first embodiment of the present application, the correspondence between each predefined service and the starting version number of each predefined service is stored in a preset service table. When querying the predefined service, the predefined service can be directly queried based on the starting version number, and there is no need to repeatedly store duplicate services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store one starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading the predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0073] Embodiment 2

[0074] Embodiment 2 of the present application provides a data storage device, such as Figure 2 As shown, the data storage device provided in the second embodiment includes: a second acquisition module 101, used to obtain different versions of service feature libraries and the version number of each service feature library, wherein the predefined services in the service feature library are used to configure security policies; a determination module 102, used to determine the starting version number of each predefined service according to the predefined services in each service feature library and the version number of each service feature library, wherein the starting version number of any predefined service is used to indicate the version of the service feature library with the predefined service at the earliest; a storage module 103, used to store the correspondence between each predefined service and the starting version number of each predefined service in a preset service table.

[0075] It can be understood that the data storage device provided in this embodiment 2 is an embodiment of a device corresponding to the data storage method provided in the aforementioned embodiment 1, the data storage method provided in the aforementioned embodiment 1 can be implemented in the data storage device provided in this embodiment 2, and the data storage device provided in this embodiment 2 can be used to execute the data storage method provided in the aforementioned embodiment 1.

[0076] Compared with the related art, in the data storage device provided in the second embodiment of the present application, after the second acquisition module 101 acquires different versions of service feature libraries and the version numbers of each service feature library, the determination module 102 determines the starting version number of each predefined service, and finally the storage module 103 stores the correspondence between each predefined service and the starting version number of each predefined service in the preset service table. When querying the predefined service, the predefined service can be directly queried based on the starting version number, and there is no need to repeatedly store duplicate services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store one starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading the predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0077] Embodiment 3

[0078] Embodiment 3 of the present application provides a data query method, which is applied to a network security management system. The network security management system can query a pre-stored preset service table, obtain the required predefined services from the preset service table, and perform policy configuration on the target security device based on the queried predefined services.

[0079] As shown in Table 6 above, the preset service table queried by the data query method provided in Embodiment 3 of the present application includes several predefined services and the starting version number corresponding to each predefined service.

[0080] like Figure 3 As shown, the data query method provided in this embodiment includes the following steps:

[0081] Step S201: Obtain the current version number of the service feature library of the target security device.

[0082] Step S202: According to the correspondence between the predefined services and the starting version numbers in the preset service table, the predefined services whose starting version numbers are less than or equal to the current version number are searched from the preset service table.

[0083] Step S203: Perform policy configuration on the target security device according to the queried predefined service.

[0084] In some examples, the current version number of the service feature library of the target security device may be used to indicate the version number of the latest service feature library of the target security device.

[0085] Here, the start version number is the version number of the earliest known predefined service in the preset service table. That is, for any predefined service, its corresponding start version number can be used to indicate the earliest version of the service feature library that has the predefined service.

[0086] Refer to the above Table 4 for an example. For example, the service feature library of version 1.0 contains 3 services, namely S1, S2, and S3; the service feature library of version 1.1 contains 5 services, namely S1, S2, S3, S4, and S5; the service feature library of version 1.2 contains 7 services, namely S1, S2, S3, S4, S5, S6, and S7; accordingly, as shown in Table 6 above, the starting version number corresponding to services S1, S2, and S3 in the preset service table is 1.0, the starting version number corresponding to services S4 and S5 in the preset service table is 1.1, and the starting version number corresponding to services S6 and S7 in the preset service table is 1.2.

[0087] For example, in some other embodiments of the present application, version 1.0 includes 3 services, S1, S2, and S3, and version 1.2 includes 7 services, S1, S2, S3, S4, S5, S6, and S7. The starting version numbers of the corresponding services S1, S2, and S3 in the preset service table are 1.0, and the starting version numbers of the services S4, S5, S6, and S7 in the preset service table are 1.2, and so on.

[0088] Here, the preset service table stores the correspondence between the predefined services and the start version numbers of the predefined services. The specific implementation method can refer to the data storage method provided in the above-mentioned embodiment 1, which will not be repeated here.

[0089] The target security device is a security device connected to the network security management system and for which a security policy needs to be specified. The current version number is the version number corresponding to all services existing on the target security device. Referring to the above Table 4 for example, for example, if the services existing on the target security device are S1, S2, and S3, the corresponding current version number is 1.0; if the services existing on the target security device are S1, S2, S3, S4, and S5, the corresponding current version number is 1.1, and so on.

[0090] In some examples, in step S201, the network security management system may actively send a version number request to the target security device. After receiving the version number request sent by the network security management system, the target security device sends the version number of its own service feature library to the network security management system.

[0091] In some examples, the network security management system receives a policy configuration request sent by a target security device, where the policy configuration request carries a current version number of a service feature library of the target security device.

[0092] In step S202, the predefined service whose starting version number is less than or equal to the current version number is queried from the preset service table. Specifically, the current version number is compared with each starting version number stored in the preset service table, and the starting version number less than or equal to the current version number is determined, and then the predefined service corresponding to the starting version number less than or equal to the current version number is used as the target service. Referring to the above Table 6 for example, for example, if the current version number is 1.1, the starting version numbers less than or equal to 1.1 are 1.0 and 1.1, and the corresponding predefined services S1, S2, S3, S4, and S5 are the predefined services obtained by the query.

[0093] When the number of predefined services obtained by the query is two or more, in step S203, the policy configuration of the target security device according to the predefined services obtained by the query can be specifically based on selecting some or all of the predefined services obtained by the query for policy configuration, and the specific selection number can be selected according to the number of policies that need to be configured.

[0094] In some examples, for two or more target security devices that share a security policy, when building a shared security policy for the two or more target security devices, the step of obtaining the current version number of the target security device of the target security device in step S201 may specifically be: obtaining the current version number of the target security device of each target security device, and taking the minimum value of all current version numbers as the current version number. The implementation process of step S202 may include: according to the correspondence between the predefined services in the preset service table and the starting version number, querying the predefined service whose starting version number is less than or equal to the minimum version number in the current version number from the preset service table.

[0095] It is understandable that when there are multiple predefined services queried from the preset service table, all the queried predefined services can be used to perform policy configuration on the target security device.

[0096] Accordingly, in step S203, configuring the target security device according to the queried predefined service may be as follows: constructing a shared security policy as a target security policy according to the queried predefined service, and issuing the target security policy to two or more target security devices respectively.

[0097] Here, the shared security policy is a security policy used for two or more security devices at the same time. Two or more security devices have the same data packet processing action for the same service. A set of security policies can be configured in the network security management system and sent to two or more security devices, namely the shared security policy. The security policy used only for a single security device is the private security policy, which corresponds to the shared security policy.

[0098] In this embodiment, by constructing a shared security policy as the target security policy based on the minimum value of two or more current version numbers, that is, the first released service version, it is possible to avoid the situation where the security device cannot adapt to the shared security policy when constructing a shared security policy for two or more security devices.

[0099] Compared with the related art, in the data query method provided in the first embodiment of the present application, since the later released version by the network security vendor usually includes all the services of the previous version, all the services corresponding to the current version number can be obtained by querying the predefined services whose starting version number is less than or equal to the current version number from the preset service table. Therefore, on the basis of realizing service query and reading, there is no need to repeatedly store repeated services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store a corresponding starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0100] Embodiment 4

[0101] Embodiment 4 of the present application provides a data query method. The difference from the aforementioned embodiment 3 is that in the present embodiment 4, when the current version number meets the preset update condition, a service feature library with the current version number is obtained, and the preset service table is updated according to the current version number and the service feature library with the current version number. The specific steps are as follows: Figure 4 As shown, including:

[0102] Step S301: Obtain the current version number of the service feature library of the target security device.

[0103] Step S302: Determine whether the current version number meets the preset update condition, if so, execute step S303, if not, execute step S305.

[0104] Step S303: Obtain a service feature library with a current version number.

[0105] Step S304: Update the preset service table according to the current version number and the service feature library having the current version number.

[0106] Step S305: According to the correspondence between the predefined services and the starting version numbers in the preset service table, the predefined service whose starting version number is less than or equal to the current version number is searched from the preset service table.

[0107] Step S306: Perform policy configuration on the target security device according to the queried predefined service.

[0108] In step S302, judging whether the current version number satisfies the preset update condition may specifically include at least two different situations, namely, judging whether the current version number is greater than the largest starting version number in the preset service table, or whether the current version number is less than the smallest starting version number in the preset service table. When the current version number is greater than the largest starting version number in the preset service table, or the current version number is less than the smallest starting version number in the preset service table, it is determined that the current version number satisfies the preset update condition, and step S303 is executed. Otherwise, it is determined that the current version number does not satisfy the preset update condition, and step S305 is executed.

[0109] In some examples, in step S303, the service feature library with the current version number is the service feature library of the current version of the target security device, in which there is at least one predefined service, and the predefined service is the service currently used by the target security device. When the current version number is greater than the maximum starting version number, the network security management system can also request the service feature library with the current version number from the target security device. For example, the network security management system can send a service feature library request to the target security device, and after receiving the service feature library request, the target security device will send its own current version of the service feature library to the network security management system.

[0110] In other examples, in step S303, the network security management system may obtain a service feature library with a current version number from a feature server.

[0111] In step S304, updating the preset service table may also correspond to at least two different updating methods according to the current version number and the service feature library having the current version number.

[0112] When it is determined in step S302 that the current version number is less than the smallest starting version number in the preset service table, the corresponding updating of the preset service table according to the current version number and the service feature library having the current version number may be specifically as follows: for each predefined service existing in the service feature library and in the preset service table, the current version number is used as the starting version number corresponding to the predefined service in the preset service table. Taking the aforementioned Table 6 as an example, if the current version number corresponding to the predefined service S4 is 1.0, and the starting version number corresponding to it in Table 6 is 1.1, which is greater than the current version number 1.0, then the current version number 1.0 may be used as the starting version number corresponding to the predefined service S4, as shown in the following Table 7, and the starting version number 1.1 corresponding to the service S4 is modified to the updated version number 1.0.

[0113]

[0114]

[0115] The current version number is smaller than the smallest start version number in the preset service table, indicating that the start version number stored in the preset service table is not the actual start version number of the predefined service. At this time, using the current version number as the start version number corresponding to the predefined service can make the start version number stored in the preset service table closer to the actual start version number of the predefined service, thereby improving the reliability of the data stored in the preset service table.

[0116] When the current version number is greater than the largest starting version number in the preset service table in step S302, the corresponding updating of the preset service table according to the current version number and the service feature library having the current version number can be specifically as follows: for each predefined service existing in the service feature library but not in the preset service table, the predefined service is added to the preset service table, and the current version number is used as the starting version number corresponding to the predefined service added to the preset service table. Similarly, taking the aforementioned Table 6 as an example, if the current version number is 1.3, the corresponding service feature library includes predefined services S1, S2, S3, S4, S5, S6, S7, S8, S9, and the current version number 1.3 is greater than the largest starting version number 1.2 in Table 6, for predefined services S8 and S9 existing in the service feature library but not in the preset service table, the predefined services S8 and S9 can be added to the preset service table as shown in the following Table 8, and the current version number 1.3 is used as the starting version number corresponding to the predefined services S8 and S9 added to the preset service table.

[0117]

[0118]

[0119] The current version number is greater than the largest starting version number in the preset service table, indicating that at least some of the predefined services in the service feature library are not stored in the preset service table. At this time, these predefined services not stored in the preset service table are added to the preset service table, and the corresponding current version number is added to the preset service table as the starting version number. This can improve the richness of the predefined services stored in the preset service table.

[0120] Compared with the related art, in the data query method provided in Example 4 of the present application, if the current version number is greater than the largest starting version number in the preset service table, it means that the target security device has upgraded the service version; or the current version number is less than the smallest starting version number in the preset service table, it means that the starting version number stored in the preset service table is not the actual starting version number of the predefined service; in these cases, the service feature library of the current version number is obtained, and the preset service table is updated according to the current version number and the corresponding service feature library. There is no need to update the preset service table based on the feature library server. On the one hand, the update efficiency of the preset service table can be improved, and on the other hand, the preset service table can also be updated when the network security management system is disconnected from the network.

[0121] Embodiment 5

[0122] Embodiment 5 of the present application provides a data query method, such as Figure 5 As shown, the data query method provided in this embodiment 5 includes:

[0123] Step S401: when it is detected that the version number of the service feature library in the feature library server is higher than the maximum starting version number in the preset service table, all service feature libraries in the feature library server whose version number is higher than the maximum starting version number and the version number of each service feature library are obtained.

[0124] Step S402: updating the preset service table according to the service feature library and the version number of the service feature library obtained from the feature library server.

[0125] Step S403: Obtain the current version number of the service feature library of the target security device.

[0126] Step S404: According to the correspondence between the predefined services and the starting version numbers in the preset service table, the predefined services whose starting version numbers are less than or equal to the current version number are searched from the preset service table.

[0127] Step S405: Perform policy configuration on the target security device according to the queried predefined service.

[0128] It can be understood that step S401 and step S402 are steps for the network security management system to update the preset service table by interacting with the feature server, and step S403 to step S405 are steps for the network security management system to query data for the target security device, and there is no restriction on the order of the two.

[0129] In some examples, step S401 can specifically be that the network security management system detects whether a version number higher than the maximum starting version number in the preset service table appears in the feature library server at a preset interval. If a version number higher than the maximum starting version number in the preset service table appears in the server, the service feature library corresponding to the version number is obtained from the server.

[0130] In step S402, according to the service feature library obtained from the feature library server and the version number of the service feature library, the preset service table is updated, including: for each predefined service that exists in the service feature library but does not exist in the preset service table, the predefined service is added to the preset service table, and the version number of the service feature library is used as the starting version number corresponding to the predefined service added to the preset service table. Similarly, taking the aforementioned Table 6 as an example, if the predefined services S10 and S11 exist in the feature library server, and the predefined services S10 and S11 do not exist in the preset service table, then as shown in the following Table 9, the network security management system adds the predefined services S10 and S11 to the preset service table, and uses the version number 1.4 of the service feature library where the predefined services S10 and S11 are located as the starting version number corresponding to the predefined services S10 and S11 added to the preset service table.

[0131]

[0132]

[0133] When updating the preset service table, the predefined services and version numbers that are not in the service feature library are stored in the preset service table accordingly, thereby increasing the number of predefined services stored in the preset service table and improving the adaptability of the network security management system to the target security device.

[0134] Compared with the related art, in the data query method provided in Example 5 of the present application, it is monitored that a service feature library with a version number higher than the maximum starting version number in the preset service table appears on the feature library server, that is, the network security manufacturer has updated the service version. At this time, all service feature libraries with a version number higher than the maximum starting version number in the feature library server and the version number of each service feature library are directly downloaded from the feature library server to update the preset service table, thereby improving the real-time performance of the predefined services and starting version numbers stored in the network security management system.

[0135] Furthermore, in some embodiments of the present application, for example, an internal LAN with constant network access requirements, the services required by the security devices thereon are relatively fixed over a long period of time. At this time, updating the preset service table may also include: obtaining all current version numbers of all security devices connected to the network security management system; deleting redundant inventory services in the preset service table, where the redundant inventory services are predefined services with a start version number greater than the maximum value of all current version numbers. Predefined services with a start version number greater than all current version numbers will not be applied by any security device. At this time, deleting redundant predefined services that are not required by all security devices can further reduce the amount of service and version number data stored in the network security management system.

[0136] In addition, in some embodiments of the present application, the data query method may include the following process.

[0137] a.Service feature library acquisition process:

[0138] (1) The security device establishes a TCP persistent connection with the network security management system to complete the registration.

[0139] (2) The network security management system proactively queries the service signature library version of the security device. If the version number is larger than the version number recorded in the network security management system, it indicates that the security device has upgraded the signature library during the offline phase. In this case, the security device is requested to upgrade the current service signature library again.

[0140] (3) The network security management system requests the service signature library and stores it in the database for policy configuration of security devices.

[0141] b. Change the storage format.

[0142] The embodiment of the present application provides a preset service table, in which a field is added to each predefined service to identify from which version the service is supported.

[0143] For example, (S1, 1.0) indicates that S1 is supported starting from version 1.0, so security devices with signature library versions 1.1 and 1.2 can use S1 to configure policies. (S4, 1.1) indicates that S4 is supported starting from version 1.1, so for security devices with signature library version 1.0, the predefined service S4 cannot be used. Based on the above analysis, the new data storage format can be shown in Table 6 above.

[0144] The change process of predefined service data is described in the order that security device 2, security device 1, and security device 3 are registered to the HSM (hardware security module):

[0145] After the network security management system obtains the signature database information of security device 2, as shown in the following table, the signature database version number is 1.1 and contains 5 predefined services. If it is found that no signature database information has been stored in the system, the data is directly stored in the database.

[0146]

[0147]

[0148] Equipment Tagging The currently installed service signature library version Safety equipment 2 1.1

[0149] After the network security management system obtains the signature database information of security device 1, the signature database version number is 1.0, and it contains 3 predefined services, S1, S2, and S3. Dependencies are processed for these three predefined services. It is found that the version supported by S1 is 1.0, which is less than 1.1 stored in the data, as shown in the following table, so the [Start Version Number] of S1 is changed to 1.0; next, the [Start Version Number] of S2 and S3 are changed to 1.0 in turn.

[0150] Starting version number Service Name Service Details 1.0 S1 Port, protocol and other information 1.0 S2 Port, protocol and other information 1.0 S3 Port, protocol and other information 1.1 S4 Port, protocol and other information 1.1 S5 Port, protocol and other information

[0151] Equipment Tagging The currently installed service signature library version Safety equipment 2 1.1 Safety equipment 1 1.0

[0152] After the network security management system obtains the signature database information of security device 3, the signature database version number is 1.2, and it contains 7 predefined services, S1, S2, S3, S4, S5, S6, and S7. It depends on processing 7 predefined service objects. The versions of S1, S2, S3, S4, and S5 in the signature database are all greater than the [Start Version Number] in the database and do not need to be updated.

[0153] As shown in the following table, S6 and S7 do not exist in the database and can be directly inserted.

[0154]

[0155]

[0156] Equipment Tagging The currently installed service signature library version Safety equipment 2 1.1 Safety equipment 1 1.0 Safety equipment 3 1.2

[0157] Through the implementation of the above algorithm, in the embodiment of the present application, all predefined services involved in different versions of service feature libraries are stored in a lightest way, and query is flexibly supported.

[0158] c. Query support

[0159] When configuring a private policy for a security device, the service signature library version number of the target security device, i.e., the current version number, is easily obtained. For example, the available predefined service set can be queried using the following SQL statement:

[0160] Select * from service table where 'starting version number' <= current version number.

[0161] In some practical applications, the span of feature library versions is not large. If you need to configure a sharing policy, in order to avoid configuring invalid services, the system only provides users with the minimum service feature library. It is easy to get the minimum feature library version of the target security device, which is recorded as v1. The query statement is as follows:

[0162] Select * from service table where 'starting version number' <= v1.

[0163] Embodiment 6

[0164] Embodiment 6 of the present application provides a data query device, such as Figure 6 As shown, it includes: a first acquisition module 201, used to obtain the current version number of the service feature library of the target security device; a query module 202, used to query the predefined services whose start version numbers are less than or equal to the current version number from the preset service table according to the correspondence between the predefined services in the preset service table and the start version numbers, wherein the start version number corresponding to any predefined service is used to indicate the version of the service feature library with the earliest predefined service; a configuration module 203, used to perform policy configuration on the target security device according to the queried predefined services.

[0165] It can be understood that the sixth embodiment is an embodiment of a data query device corresponding to the data query method provided in the above embodiments, and the sixth embodiment can be implemented corresponding to the embodiments of the above data query method.

[0166] Compared with the related art, in the data query device provided in the sixth embodiment of the present application, the current version number of the service feature library of the target security device obtained by the first acquisition module 201 is the version number of the predefined service that the target security device can support. Since the version released later by the network security manufacturer usually includes all the predefined services of the previous version, the query module 202 queries the predefined services whose starting version number is less than or equal to the current version number from the preset service table to obtain all the services corresponding to the current version number for the configuration module 203 to perform policy configuration on the target security device. Therefore, on the basis of realizing service query and reading, there is no need to repeatedly store repeated services in different versions in the preset service table. Each service only needs to be stored once in the preset service table, and each service only needs to store a corresponding starting version number, thereby reducing the amount of data of services and version numbers stored in the network security management system, reducing the storage pressure of the network security management system, and due to the reduction in the amount of data of stored services and version numbers, the smaller amount of data can also improve the efficiency of querying and reading the predefined services stored in the preset service table, thereby improving the data query efficiency of the network security management system.

[0167] Embodiment 7

[0168] Embodiment 7 of the present application relates to an electronic device, such as Figure 7 As shown, it includes: at least one processor 301; and a memory 302 that is communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 so that the at least one processor 301 can execute the methods in the above-mentioned embodiments.

[0169] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0170] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0171] Embodiment 8

[0172] Embodiment 8 of the present application relates to a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0173] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0174] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0175] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data query method, characterized in that: The method comprises: Obtain the current version number of the service signature library of the target security device; According to the correspondence between the predefined services and the starting version numbers in the preset service table, query the preset service table for a predefined service whose starting version number is less than or equal to the current version number, wherein the starting version number corresponding to any of the predefined services is used to indicate the earliest version of the service feature library having the predefined service; The target security device is configured with a policy according to the queried predefined service.

2. The method according to claim 1, characterized in that: The method further comprises: In the case where the current version number satisfies a preset update condition, obtaining a service feature library having the current version number, wherein the preset update condition includes: the current version number is greater than the largest starting version number in the preset service table, or is less than the smallest starting version number in the preset service table; The preset service table is updated according to the current version number and the service feature library having the current version number.

3. The method according to claim 2, characterized in that The updating of the preset service table according to the current version number and the service feature library having the current version number includes: When the current version number is smaller than the smallest starting version number in the preset service table, for each predefined service in the service feature library and in the preset service table, the current version number is used as the starting version number corresponding to the predefined service in the preset service table; or, When the current version number is greater than the largest starting version number in the preset service table, for each predefined service that exists in the service feature library but does not exist in the preset service table, the predefined service is added to the preset service table, and the current version number is used as the starting version number corresponding to the predefined service added to the preset service table.

4. The method according to claim 1, characterized in that: The method further comprises: When it is detected that the version number of the service feature library in the feature library server is higher than the maximum starting version number in the preset service table, all service feature libraries in the feature library server with a version number higher than the maximum starting version number and the version number of each service feature library are obtained; The preset service table is updated according to the service feature library and the version number of the service feature library obtained from the feature library server.

5. The method according to claim 4, characterized in that The updating of the preset service table according to the service feature library and the version number of the service feature library obtained from the feature library server includes: For each predefined service that exists in the service feature library but not in the preset service table, the predefined service is added to the preset service table, and the version number of the service feature library is used as the starting version number corresponding to the predefined service added to the preset service table.

6. The method according to claim 1, characterized in that For two or more target security devices that share a security policy, obtaining the current version number of the service feature library of the target security device includes: Obtain the minimum version number among the current version numbers of the service signature library of each target security device; The step of searching the preset service table for a predefined service having a starting version number less than or equal to the current version number according to the correspondence between the predefined service in the preset service table and the starting version number includes: According to the correspondence between the predefined services and the starting version numbers in the preset service table, the predefined services whose starting version numbers are less than or equal to the minimum version number in the current version numbers are queried from the preset service table.

7. A data storage method, characterized in that: The method comprises: Obtaining different versions of service feature libraries and version numbers of the service feature libraries, wherein the predefined services in the service feature libraries are used to configure security policies; Determine the starting version number of each of the predefined services according to the predefined services in each of the service feature libraries and the version number of each of the service feature libraries, wherein the starting version number of any of the predefined services is used to indicate the earliest version of the service feature library having the predefined service; The correspondence between each of the predefined services and the start version number of each of the predefined services is stored in a preset service table.

8. A data query device, characterized in that: The device comprises: A first acquisition module, used to acquire the current version number of the service feature library of the target security device; A query module, used to query the preset service table for a predefined service whose start version number is less than or equal to the current version number according to the correspondence between the predefined services and the start version numbers in the preset service table, wherein the start version number corresponding to any of the predefined services is used to indicate the earliest version of the service feature library having the predefined service; A configuration module is used to perform policy configuration on the target security device according to the queried predefined service.

9. A data storage device, characterized in that: The device comprises: A second acquisition module is used to acquire different versions of service feature libraries and version numbers of the service feature libraries, wherein the predefined services in the service feature libraries are used to configure security policies; A determination module, configured to determine a starting version number of each of the predefined services according to the predefined services in each of the service feature libraries and the version number of each of the service feature libraries, wherein the starting version number of any of the predefined services is used to indicate the earliest version of the service feature library having the predefined service; The storage module is used to store the corresponding relationship between each of the predefined services and the starting version number of each of the predefined services in a preset service table.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program is executed by a processor to implement the data query method described in any one of claims 1 to 6, or the data storage method described in claim 7.

Images