Data center access strategy processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a data center access strategy processing method and device, electronic equipment and a storage medium, and can be applied to the technical field of big data. According to the method, after the original access strategy of each component is collected, the original access strategy is processed through the streaming computing engine to obtain the first access strategy, then the graph model is constructed according to the first access strategy, and the first access strategy is stored in the graph database according to the graph model; then the first access strategy in the graph database is managed in a visual mode to obtain the second access strategy, so that a worker can quickly and accurately identify the invalid strategy, and the identification accuracy of the invalid strategy and the management efficiency of the access strategy are effectively improved; and executing the configuration process of the second access strategy in the component according to the access strategy intention information, thereby improving the accuracy of the access strategy configured in the component.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a data center access policy processing method and device, electronic equipment and storage medium. Background Art

[0002] In related technologies, the rise of application microservice architecture has reshaped the traffic pattern of data centers. On the basis of the original north-south traffic dominance, east-west traffic has rapidly risen, and the two have intertwined into a more complex and changeable traffic model, which requires more complex data center access strategies to better obtain target traffic data. At present, data center access strategies are scattered in different components, and there are a large number of invalid strategies, out-of-bounds strategies, and high-risk strategies in these access strategies. As a result, the current manual access strategy management method has low management efficiency and low accuracy in invalid strategy identification in large-scale data scenarios, which in turn leads to low accuracy of access strategies configured in components.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a data center access policy processing method and device, electronic device and storage medium, which can effectively improve the management efficiency of access policies, the accuracy of identifying invalid policies and the accuracy of access policies configured in components.

[0005] To achieve the above object, an embodiment of the present application provides a data center access policy processing method in one aspect, the method comprising the following steps:

[0006] Collect the original access policies of various components;

[0007] Processing the original access policy through a streaming computing engine to obtain a first access policy;

[0008] Building a graph model according to the first access strategy;

[0009] Storing the first access strategy in a graph database according to the graph model;

[0010] Managing the first access strategy in the graph database in a visual manner to obtain a second access strategy;

[0011] Get access policy intent information;

[0012] The configuration process of the second access policy in the component is executed according to the access policy intention information.

[0013] In some embodiments, the collecting of original access policies of various components includes:

[0014] Get component type;

[0015] Configure the collection mode of the component according to the component type;

[0016] The original access policy of the corresponding component is collected through the collection method.

[0017] In some embodiments, the processing of the original access policy by the streaming computing engine includes:

[0018] Cleaning the original access policy to obtain a cleaned access policy;

[0019] Performing a first classification on the cleaned access policy to obtain an access policy type;

[0020] Parsing the cleaned access policy according to the access policy type to obtain a parsing result;

[0021] The cleansed access policy is secondly classified according to the analysis processing result and the access policy scenario.

[0022] In some embodiments, parsing the cleaned access policy according to the access policy type includes:

[0023] Identify the source information and port information of each access policy type corresponding to the cleaned access policy;

[0024] Creating a class vertex according to the source information and the port information;

[0025] An belonging edge relationship is created according to the class vertex and the connecting edge.

[0026] In some embodiments, the second classification of the cleansed access policy according to the parsing result and the access policy scenario includes:

[0027] When it is determined according to the analysis processing result that the host class source and target address in the access policy scenario cannot be matched, determining that the cleaned access policy is an invalid policy;

[0028] When it is determined according to the analysis processing result that the network segment source and target address in the access policy scenario cannot be matched, the cleaned access policy is determined to be an out-of-bounds policy.

[0029] In some embodiments, constructing a graph model according to the first access strategy includes:

[0030] Construct object vertices of the graph model according to the objects in the first access strategy;

[0031] Constructing the relationship edge of the graph model according to the relationship object in the first access strategy;

[0032] The graph model is generated according to the object vertices and the relationship edges.

[0033] In some embodiments, the process of executing the configuration of the second access policy in the component according to the access policy intention information includes:

[0034] Obtain the target system, target address, target port, source address and target protocol in the access policy intention information;

[0035] determining a target component from among a plurality of components according to the target system, the target address, and the target port;

[0036] determining a target access policy for the target component from the second access policy based on the source address and the target protocol;

[0037] Performing compliance testing on the target access policy to obtain a test result;

[0038] The target access policy is configured into the target component according to the detection result.

[0039] To achieve the above object, another aspect of an embodiment of the present application provides a data center access policy processing device, the device comprising:

[0040] The first module is used to collect the original access policies of various components;

[0041] The second module is used to process the original access policy through a stream computing engine to obtain a first access policy;

[0042] A third module is used to construct a graph model according to the first access strategy;

[0043] A fourth module is used to store the first access strategy in a graph database according to the graph model;

[0044] A fifth module is used to manage the first access strategy in the graph database in a visual manner to obtain a second access strategy;

[0045] The sixth module is used to obtain access policy intent information;

[0046] The seventh module is used to execute the configuration process of the second access policy in the component according to the access policy intention information.

[0047] To achieve the above object, another aspect of an embodiment of the present application provides an electronic device, including:

[0048] at least one processor;

[0049] at least one memory for storing at least one program;

[0050] When the at least one program is executed by the at least one processor, the at least one processor implements the above method.

[0051] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0052] The embodiments of the present application include at least the following beneficial effects: The present application provides a data center access policy processing method and device, an electronic device and a storage medium. The scheme collects the original access policies of various components, processes the original access policies through a streaming computing engine to obtain a first access policy, then builds a graph model based on the first access policy, and stores the first access policy in a graph database based on the graph model, and then manages the first access policy in the graph database in a visual manner to obtain a second access policy, so that staff can quickly and accurately identify invalid policies, effectively improve the recognition accuracy of invalid policies and the management efficiency of access policies, and then execute the configuration process of the second access policy in the component according to the access policy intention information, thereby improving the accuracy of the access policy configured in the component. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a flow chart of a data center access policy processing method provided in an embodiment of the present application;

[0054] Figure 2 It is a flowchart of processing the original access policy through the streaming computing engine provided by an embodiment of the present application;

[0055] Figure 3 It is a flowchart of parsing and processing the post-cleaning access policy provided by an embodiment of the present application;

[0056] Figure 4 It is a flowchart of parsing and processing each type of access policy provided by an embodiment of the present application;

[0057] Figure 5 is a flowchart of constructing a graph model according to a first access strategy provided by an embodiment of the present application;

[0058] Figure 6 It is a flowchart of a configuration process of executing a second access policy in a component according to access policy intention information provided by an embodiment of the present application;

[0059] Figure 7The embodiment of this application provides Figure 6 A flowchart of the method shown in the application scenario;

[0060] Figure 8 This is a schematic diagram of the application interaction architecture of the data center access policy processing method provided in an embodiment of the present application;

[0061] Fig. 9 It is a structural diagram of a data center access policy processing device provided in an embodiment of the present application;

[0062] Fig.10 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application, they are only examples of devices and methods consistent with some aspects of the embodiments of the present application.

[0064] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0065] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0067] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations:

[0068] Graph database: A graph database is a database that stores graph-structured data. It models complex data relationships through nodes (representing entities) and edges (representing relationships). This structure is very suitable for representing data with complex network structures such as social networks, knowledge graphs, and recommendation systems, and can efficiently query the association information between nodes.

[0069] Access policy: Access policy is a specification that defines and restricts network communication behavior. It is used to control the communication traffic between different network components (such as hosts, virtual machines, containers, etc.) to improve network security and reduce potential network attack surfaces. Access policies exist in all network components, such as firewalls, servers, containers, etc. Data center access policies can be roughly divided into four categories: SNAT policy, DNAT policy, access control policy, and load balancing policy.

[0070] SNAT policy: SNAT (Source Network Address Translation) is an address translation operation that modifies the source IP address of a data packet according to specific conditions. It is mainly used to implement scenarios where multiple hosts in a LAN share an external IP address. SNAT policies mainly exist in firewalls and hosts.

[0071] DNAT policy: DNAT (Destination Network Address Translation) policy is an important form of Network Address Translation (NAT), which is mainly used to modify the destination IP address of the data packet in order to redirect the request of the external network to a specific host or service on the internal network. DNAT policy mainly exists in firewalls and hosts.

[0072] Access control policy: Access control policy is a policy that controls the device to forward traffic and conducts integrated content security detection on traffic. Access control policy is mainly used to control network access across firewalls and control access to the device itself. Access control policy mainly exists in firewalls, hosts, virtual devices, and containers.

[0073] Load balancing strategy: Load balancing strategy is a traffic forwarding strategy configured on the load balancing server, which is used to forward access traffic to the backend business server. Load balancing strategy mainly exists in the load balancing server.

[0074] Streaming computing engine: A streaming computing engine is a computing system used to process data streams in real time. It can continuously obtain data from different data sources and perform real-time analysis and processing to obtain valuable information. Streaming computing engines have the characteristics of persistence, low latency, event-driven, and data-intensive applications. The main measurement indicators of streaming computing engines are latency and throughput, that is, the speed of processing data and the amount of data that can be processed.

[0075] Agent: In the field of artificial intelligence (AI) and computer science, an agent usually refers to a software or hardware entity that can act autonomously, perceive the environment and take actions to achieve specific goals. In computer science, an agent can refer to a software program, such as a network agent or intelligent agent, that can independently perform tasks such as processing queries, performing actions, or interacting with other systems.

[0076] SNMP (Simple Network Management Protocol) is an application layer protocol used to manage network nodes in IP networks, such as servers, workstations, routers, switches, etc. SNMP allows network administrators to remotely monitor and control network devices, collect network status information, discover and solve network problems, and plan network growth status.

[0077] RESTCONF is a configuration management protocol based on HTTP. RESTCONF follows the RESTful architectural style and uses HTTP methods (such as GET, POST, PUT, DELETE, and PATCH) to operate the data of network devices. RESTCONF is designed to meet the needs of modern networks for configuration management interfaces and to provide a standardized interface that is more suitable for Web applications to access and operate network devices.

[0078] NETCONF (Network Configuration Protocol) is a network configuration protocol. NETCONF provides a set of mechanisms for managing and configuring network devices. The NETCONF protocol uses Extensible Markup Language (XML) for data representation and adopts a client / server model to achieve communication between the client and the server through the Remote Procedure Call (RPC) mechanism.

[0079] An API (Application Programming Interface) is a set of predefined functions, methods, classes, and protocols for communication and data exchange between different software applications. API defines a set of rules and protocols that software developers can use to access the functionality of an operating system, library, service, or other application. The main purpose of an API is to provide a simple, standardized way for different software components to communicate with each other without having to know each other's specific implementation details.

[0080] In related technologies, with the recommendation of enterprise digitalization, enterprise data centers have also transformed and upgraded. From the traditional three-tier architecture (access-aggregation-core) to the cloud architecture, this change has not only greatly improved the processing efficiency, flexibility and scalability of the data center, but also evolved into an intelligent computing architecture model. In this process, the composition of the data center has become increasingly rich and diverse, not only covering hardware devices such as firewalls, switches, and servers, but also deeply integrating virtualization devices, containers, and load balancers in the cloud environment. Software components such as components have jointly woven a complex and powerful digital network. In addition, the rise of application microservices architecture has completely reshaped the traffic pattern of the data center. On the basis of the original north-south traffic dominance, east-west traffic has rapidly risen, and the two are intertwined to form a more complex and changeable traffic model. The changes in the data center have led to certain problems in the current access policy management methods corresponding to the data center:

[0081] First, because data centers involve many components and the access policy configuration process is completed by each component separately, the access policy management methods are discrete and cannot be applied to the current application process of large amounts of data;

[0082] Second, it is currently impossible to effectively identify invalid access policies, out-of-bounds policies, and high-risk policies in data centers, which leads to certain risks in the access process of data centers;

[0083] Third, due to the complexity of access policies in data centers, there are conversions (SNAT or DNAT) and proxy relationships between addresses, which makes the current manual analysis and positioning methods difficult, which in turn may lead to low accuracy of the access policies configured in the components.

[0084] In view of this, the embodiments of the present application provide a data center access policy processing method and device, an electronic device and a storage medium. After collecting the original access policies of various components, the present application processes the original access policies through a streaming computing engine to obtain a first access policy, and then builds a graph model according to the first access policy, and stores the first access policy in a graph database according to the graph model, and then manages the first access policy in the graph database in a visual manner to obtain a second access policy, so that staff can quickly and accurately identify invalid policies, effectively improve the recognition accuracy of invalid policies and the management efficiency of access policies, and then execute the configuration process of the second access policy in the component according to the access policy intention information, thereby improving the accuracy of the access policy configured in the component.

[0085] The data center access policy processing method provided in the embodiment of the present application relates to the field of big data technology. The data center access policy processing method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or it can be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured to provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms and other basic cloud computing services. The server can also be a node server in the blockchain network; the software can be an application that implements the data center access policy processing method, etc., but is not limited to the above forms.

[0086] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0087] Figure 1is an optional flowchart of the data center access policy processing method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S110 to S170:

[0088] Step S110: Collect original access policies of various components;

[0089] Step S120: Process the original access policy through the stream computing engine to obtain a first access policy;

[0090] Step S130: construct a graph model according to the first access strategy;

[0091] Step S140: storing the first access strategy in a graph database according to the graph model;

[0092] Step S150: managing the first access strategy in the graph database in a visual manner to obtain a second access strategy;

[0093] Step S160: Obtain access policy intention information;

[0094] Step S170: Execute the configuration process of the second access policy in the component according to the access policy intention information.

[0095] In the embodiment of the present application, the components may include but are not limited to firewalls, hosts, virtual devices, load balancers or containers, etc. The interaction methods, hardware devices, management methods, and configuration information involved in different types of components are all different. Therefore, after obtaining the component type, the present embodiment configures the collection method of the component according to the component type, and then collects the original access policy of the corresponding component through the configured collection method. Among them, the collection method includes but is not limited to API method, Agent method, SNMP method, RestConf method or NetConf method, which can be selected according to the actual situation.

[0096] In the embodiments of the present application, Figure 2 As shown, the process of processing the original access policy by the stream computing engine includes but is not limited to steps S210 to S240:

[0097] Step S210, clean the original access policy to obtain a cleaned access policy;

[0098] Step S220, performing a first classification on the cleaned access policy to obtain an access policy type;

[0099] Step S230, parsing the cleaned access policy according to the access policy type to obtain a parsing result;

[0100] Step S240: Perform a second classification on the cleaned access policy according to the analysis result and the access policy scenario.

[0101] It can be understood that the process of cleaning the original access policy in this embodiment includes the following three contents: first, filtering and marking the source address, target address, target port and other features in the original access policy, marking and filtering the data that does not conform to the policy configuration rules; second, de-duplication and merging the original access policies with the same five-tuple (source, source port, target, target port, protocol) in the original access policy; third, generating a unique identifier based on the five-tuple and the identifier of the network component. The first classification of this embodiment refers to the classification of the access policy after cleaning. Among them, the access policy types of this embodiment may include but are not limited to SNAT type, DNAT type, access control type, load balancing type, etc.

[0102] Specifically, after obtaining the access policy type, this embodiment performs parsing processing on the cleaned access policy. Figure 3 As shown, the parsing process of this embodiment includes but is not limited to steps S310 to S330:

[0103] Step S310, identifying the source information and port information of the cleaned access policy corresponding to each access policy type;

[0104] Step S320: Create a class vertex according to the source information and the port information;

[0105] Step S330: Create a belonging edge relationship based on the class vertices and the connecting edges.

[0106] It is understandable that the parsing process of this embodiment can be to parse the access policy of each access policy type separately. Specifically, as can be seen from the above content, the access policy type can include but is not limited to SNAT type, DNAT type, access control type, and load balancing type. Therefore, this embodiment can be performed by parsing each type of access policy separately. For example, Figure 4 As shown, the access policy parsing process for each type includes but is not limited to steps S410 to S440:

[0107] Step S410, parse the SNAT type access policy, identify the SNAT source address, SNAT target address and SNAT port, and establish corresponding vertex and edge relationships. Specifically, this step is to parse the SNAT type access policy. The parsing process of this step specifically needs to identify the SNAT source address, SNAT target address and SNAT port. If the SNAT source address is a network address, it is also necessary to split the network segment corresponding to the network address and identify it according to the asset matching situation. Create a Src class vertex for the SNAT source address, create a SnatAddressAndPort class vertex for the SNAT target address and SNAT port, create a SnatPolicy class vertex for the access policy, and then create a HasSrc edge between the Src class vertex and the SnatPolicy class vertex, and create a HasSnat edge between the SnatAddressAndPort class vertex and the SnatPolicy class vertex.

[0108] Step S420, parse the DNAT type access policy, identify the DNAT source address, DNAT target address and DNAT port, and establish the corresponding vertex and edge relationship. Specifically, this step is to parse the DNAT type access policy. The parsing process of this step specifically needs to identify the DNAT source and port, DNAT target address and port, and create a DstAndPort class vertex for the DNAT target address and port according to the asset matching situation, create a DnatAddressAndPort class vertex for the DNAT source address and port, create a DnatPolicy class vertex for the access policy, and then create a HasDst edge between the DnatPolicy class vertex and the DstAndPort class vertex, and create a HasDnat edge between the DnatPolicy class vertex and the DnatAddressAndPort class vertex.

[0109] Step S430, parse the access policy of the access control type, identify the source address of the access control, the target address of the access control and the port of the access control, and establish the corresponding vertex and edge relationship. Specifically, this step is to parse the access policy of the access control type. The parsing process of this step specifically needs to identify the source address of the access control, the target address of the access control, the target port of the access control and the protocol of the access control, etc. If the source address of the access control is a network segment address, the network segment address needs to be split and identified according to the asset matching situation. Then create a Src class vertex for the source address of the access control, create a DstAndport class vertex for the target address of the access control corresponding to a single port, create a DstAndPortRange class vertex for the port range target address of the access control, create an AccessControlPolicy class vertex for the access policy, and then create a HasSrc edge between the Src class vertex and the AccessControlPolicy class vertex, and create a HasDst edge between the DstAndPortRange class vertex and the AccessControlPolicy class vertex.

[0110] Step S440, parse the access policy of the load balancing type, identify the source address in the load balancing process, the target address in the load balancing process, and the port in the load balancing process, and establish the corresponding vertex and edge relationship. Specifically, this step is to parse the access policy of the load balancing type. The parsing process of this step specifically needs to identify the service address, listening port, and backend address and port attributes, and create a ServerAndPortAddress class vertex and a DstAndPort class vertex, create a LoadBalancePolicy class vertex for this access policy, and then create a HasServerAndPort edge between the ServerAndPortAddress class vertex and the LoadBalancePolicy class vertex, and create a HasDst edge between the DstAndPort class vertex and the LoadBalancePolicy class vertex.

[0111] After completing the parsing process of the access policies corresponding to all access policy types, the belonging edge relationship is created according to the vertices obtained in the parsing process, so that the position relationship of the edge to which each vertex belongs can be determined through the belonging edge relationship, and then the attribute relationship between the vertices can be obtained. Specifically, a BelongsToSeg edge relationship can be created between the Src class vertex and the NetSegment class vertex. A BelongsToSys edge relationship is created between the Src class vertex, the DstAndPort class vertex, the DstAndPortRange class vertex, the DnatAddressAndPort class vertex, the SnatAddressAndPort class vertex, the ServerAndPortAddress class vertex and the Sys class vertex.

[0112] In an embodiment of the present application, the cleaned access policy can be secondly classified according to the analysis processing result combined with the specific access policy scenario. Specifically, when it is determined according to the analysis processing result that the host class source and target address in the access policy scenario cannot be matched, the cleaned access policy is determined to be an invalid policy; when it is determined according to the analysis processing result that the network segment source and target address in the access policy scenario cannot be matched, the cleaned access policy is determined to be an out-of-bounds policy. In addition, for access policies of SNAT type and DNAT type and address type of PublicAddress, the access policy is identified as a boundary policy.

[0113] In the embodiments of the present application, Figure 5 As shown, the process of constructing the graph model according to the first access strategy includes but is not limited to steps S510 to S530:

[0114] Step S510, constructing object vertices of a graph model according to the objects in the first access strategy;

[0115] Step S520: construct relationship edges of the graph model according to the relationship objects in the first access strategy;

[0116] Step S530: Generate a graph model based on the object vertices and the relationship edges.

[0117] It is understandable that, in this embodiment, after combing all first access strategies, the rules and attributes in the access strategies can be modeled according to the graph design mode to obtain the corresponding graph model. The modeling process of this embodiment includes but is not limited to object vertex class design and relationship edge design.

[0118] Specifically, this embodiment models the objects in the first access policy according to vertices, and the vertex types include but are not limited to four parent types: Address, Policy, Address Type, and Sys. The address subclasses include but are not limited to: NetSegment (network address segment class), Src (source address class), DstAndPort (destination address and port class), DstAndPortRange (destination address and port range class), DnatAddressAndPort (Dnat address and port class), SnatAddressAndPort (Snat destination address class), ServerAndPortAddress class; the address type subclasses include: PublicAddress (public network address class), InetAddress (intranet address class), PrivateAddress (private network address class), OhterAddress (other address class); the policy subclasses include: DnatPolicy (Dnat policy class), SnatPolicy (Snat policy class), AccessControlPolicy (access policy class), and LoadBalancePolicy (load balancing class).

[0119] It can be understood that in this embodiment, the relationship edge is obtained by modeling the relationship object in the first access policy according to the edge. Among them, the relationship edge types include but are not limited to HasDst class (including the target address), HasSrc (including the source address class), BelongsToType (belonging address class), BelongsToSys (belonging system class), BelongsToSeg (belonging network segment class), BelongsToFirewall (belonging firewall class), HasSnat (belonging SNAT class), HasDnat (belonging Dnat class), BelongsToHost (belonging host class), HasServerAndPort (belonging load balancing site class).

[0120] In an embodiment of the present application, the graph model obtained by modeling stores the first access policy in a graph database to facilitate the management of the first access policy in subsequent applications. Specifically, this embodiment can manage the first access policy in the graph database in a visual manner. Among them, the management process includes but is not limited to the capabilities of data center end-to-end access policy configuration display, invalid policy identification display, cross-border policy identification display, boundary policy identification display, risk policy identification display, and address traceability display.

[0121] It is understandable that after completing the management of the access policy in this embodiment, in the application process, the access policy intent information can be obtained by declarative means to identify the access policy intent, so that the access policy configuration process can be performed according to the access policy intent to realize the end-to-end access policy configuration function in the visual interface. Specifically, Figure 6 As shown, the configuration process of executing the second access policy in the component according to the access policy intention information includes but is not limited to steps S610 to S650:

[0122] Step S610, obtaining the target system, target address, target port, source address and target protocol in the access policy intention information;

[0123] Step S620, determining a target component from a plurality of components according to a target system, a target address and a target port;

[0124] Step S630, determining a target access policy of the target component from the second access policy according to the source address and the target protocol;

[0125] Step S640: Perform compliance detection on the target access policy to obtain a detection result;

[0126] Step S650: configure the target access policy into the target component according to the detection result.

[0127] Specifically, the target system, target address, target port, source address and target protocol of this embodiment all refer to the component information to be configured by the access policy input by the current user. Among them, the component information of this embodiment may include but is not limited to the target component information to be deployed by the access policy, and may also include the accessed component information accessed through the target component. Exemplarily, assuming that there are components 1, 2 and 3, if component 1 is the target component, then the target system, target address, target port, source address and target protocol are all information corresponding to component 1, and may also be information corresponding to component 2 that mutually accesses component 1. After this embodiment determines the target access policy of component 1 based on the source address and target protocol, it is also necessary to perform compliance detection on the target access policy before the target access policy can be deployed to component 1, thereby effectively improving the access security of component 1.

[0128] Specifically, take the scenario where access policy needs to be enabled as an example. Figure 7 As shown, Figure 6 The method shown in the application process includes but is not limited to steps S710 to S760:

[0129] Step S710: The user fills in the declarative intent identification policy activation template to describe the access policy to be activated in the activation template, wherein the description information may include but is not limited to the target system, target address, target port, source address, protocol and other information.

[0130] Step S720: The access policy management module obtains the end-to-end links involved in the activation intention through the graph database, specifically obtaining the access links about the target system, target address and port described in the activation intention, and identifying the host (virtual device or container), load balancer and firewall to which it belongs.

[0131] Step S730: The access policy template generates access policies corresponding to nodes in the link according to the intent, and can generate access policies for different components based on source addresses and protocols.

[0132] Step S740: Detect whether there is a conflict in the access policy based on the graph data corresponding to the graph model. Specifically, it can be to detect the compliance of the policy to be issued. Among them, the compliance detection includes conflict detection, duplicate policy detection, etc. If the detection fails, adjust the policy and then detect again, and execute step S750; if the detection passes, execute step S760.

[0133] Step S750, determine whether the number of adjustments exceeds the maximum re-execution threshold; if so, end the process; otherwise, execute step S730.

[0134] Step S760: Send policies to components in the data center through multiple dimensions. Specifically, in this embodiment, after passing the compliance check, multiple types of protocols and capabilities are sent to components in the data center for configuration.

[0135] In the embodiment of the present application, the data center access policy processing method of the embodiment of the present application is applied to Figure 8 In the interactive architecture diagram shown in FIG. 1 , this embodiment includes but is not limited to steps S810 to S840:

[0136] Step S810, obtaining data center components;

[0137] Step S820: The original access policies of various components are collected through the real-time computing framework, and the original access policies are cleaned, parsed, and scenario-calculated in sequence, and then the corresponding access policies are sent to the graph data for storage;

[0138] Step S830: adapting the graph model in the graph data storage, and then sending the stored access policy to the network policy management;

[0139] Step S840: Visualize the access policy in the network policy management, and issue the access policy based on the declarative intent information.

[0140] From the above content, it can be seen that the embodiment of the present application presents complex access policy relationships in a graphical manner through graph model design and storage methods, so that managers can intuitively understand and manage access policies and improve query and analysis efficiency; through diversified collection and configuration methods, the comprehensiveness and accuracy of access policies can be effectively improved; through streaming computing engine processing, real-time processing and storage of a large number of access policies can be achieved, thereby improving management efficiency; through declarative intent recognition, the configuration difficulty can be effectively simplified, so that users do not need to understand the access policy configuration methods of various components, thereby effectively improving configuration efficiency.

[0141] Reference Fig. 9 , an embodiment of the present application provides a data center access policy processing device, the device comprising:

[0142] The first module 910 is used to collect the original access policies of various components;

[0143] The second module 920 is used to process the original access policy through the stream computing engine to obtain a first access policy;

[0144] The third module 930 is used to construct a graph model according to the first access strategy;

[0145] The fourth module 940 is used to store the first access strategy in the graph database according to the graph model;

[0146] The fifth module 950 is used to manage the first access strategy in the graph database in a visual manner to obtain a second access strategy;

[0147] The sixth module 960 is used to obtain access policy intention information;

[0148] The seventh module 970 is used to execute the configuration process of the second access policy in the component according to the access policy intention information.

[0149] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0150] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above data center access policy processing method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0151] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0152] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0153] The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0154] The memory 1020 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1020 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1020, and the processor 1010 calls and executes the data center access policy processing method of the embodiment of this application;

[0155] Input / output interface 1030, used to implement information input and output;

[0156] The communication interface 1040 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0157] Bus 1050 , which transmits information between various components of the device (e.g., processor 1010 , memory 1020 , input / output interface 1030 , and communication interface 1040 );

[0158] The processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 are connected to each other in communication within the device via a bus 1050 .

[0159] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data center access policy processing method is implemented.

[0160] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0161] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0162] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0163] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0164] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0165] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0166] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0167] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0168] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0169] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0170] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0171] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0172] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A data center access policy processing method, characterized in that: The method comprises the following steps: Collect the original access policies of various components; Processing the original access policy through a streaming computing engine to obtain a first access policy; Building a graph model according to the first access strategy; Storing the first access strategy in a graph database according to the graph model; Managing the first access strategy in the graph database in a visual manner to obtain a second access strategy; Get access policy intent information; The configuration process of the second access policy in the component is executed according to the access policy intention information.

2. The method according to claim 1, characterized in that The original access policies of various components are collected, including: Get component type; Configure the collection mode of the component according to the component type; The original access policy of the corresponding component is collected through the collection method.

3. The method according to claim 1, characterized in that The processing of the original access policy by the stream computing engine includes: Cleaning the original access policy to obtain a cleaned access policy; Performing a first classification on the cleaned access policy to obtain an access policy type; Parsing the cleaned access policy according to the access policy type to obtain a parsing result; The cleansed access policy is secondly classified according to the analysis processing result and the access policy scenario.

4. The method according to claim 3, characterized in that The parsing and processing of the cleaned access policy according to the access policy type includes: Identify the source information and port information of each access policy type corresponding to the cleaned access policy; Creating a class vertex according to the source information and the port information; An belonging edge relationship is created according to the class vertex and the connecting edge.

5. The method according to claim 3, characterized in that: The second classification of the cleansed access policy according to the analysis processing result and the access policy scenario includes: When it is determined according to the analysis processing result that the host class source and target address in the access policy scenario cannot be matched, determining that the cleaned access policy is an invalid policy; When it is determined according to the analysis processing result that the network segment source and target address in the access policy scenario cannot be matched, the cleaned access policy is determined to be an out-of-bounds policy.

6. The method according to claim 1, characterized in that The step of constructing a graph model according to the first access strategy includes: Construct object vertices of the graph model according to the objects in the first access strategy; Constructing the relationship edge of the graph model according to the relationship object in the first access strategy; The graph model is generated according to the object vertices and the relationship edges.

7. The method according to claim 1, characterized in that The process of configuring the second access policy in the component according to the access policy intention information includes: Obtain the target system, target address, target port, source address and target protocol in the access policy intention information; determining a target component from among a plurality of components according to the target system, the target address, and the target port; determining a target access policy for the target component from the second access policy based on the source address and the target protocol; Performing compliance testing on the target access policy to obtain a test result; The target access policy is configured into the target component according to the detection result.

8. A data center access policy processing device, characterized in that: The device comprises: The first module is used to collect the original access policies of various components; The second module is used to process the original access policy through a stream computing engine to obtain a first access policy; A third module is used to construct a graph model according to the first access strategy; A fourth module is used to store the first access strategy in a graph database according to the graph model; A fifth module is used to manage the first access strategy in the graph database in a visual manner to obtain a second access strategy; The sixth module is used to obtain access policy intent information; The seventh module is used to execute the configuration process of the second access policy in the component according to the access policy intention information.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images