Heterogeneous firewall management method and device, computer equipment and storage medium

Abstract

The embodiment of the invention discloses a heterogeneous firewall management method and device, computer equipment and a storage medium, and relates to the technical field of firewalls. Comprising the steps that a management request for at least one firewall device in heterogeneous firewall devices is received, and the heterogeneous firewall devices comprise a plurality of different types of firewall devices; based on the request type of the management request, determining a control instruction corresponding to the management request, the control instruction being used for controlling a firewall policy through a unified management model, and the unified management model being used for performing unified management on firewall policies of a plurality of different types of firewall devices in the heterogeneous firewall device; processing based on the control instruction to obtain a processing result; and displaying based on the processing result. By adopting the method provided by the embodiment of the invention, different heterogeneous firewalls can be managed in a unified manner.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of firewall technology, and in particular to a heterogeneous firewall management method, apparatus, computer equipment, and storage medium. Background Art

[0002] In the field of network security, firewalls are widely used as the most common network security protection devices. As the first line of defense for network security, firewalls play a role by setting network access control policies, integrating network access rights, enforcing the principle of least privilege, preventing unauthorized access, and reducing network risks.

[0003] In the related art, a manual method is usually adopted to manage firewall policies, which has many disadvantages when the network scale continues to expand and the business changes frequently.

[0004] On the one hand, for security purposes, firewalls in enterprise networks usually have multiple different brands, and the access control policy configurations of different brands of devices are also different. In daily use, it will cause a great learning cost for security policy managers, and it is more prone to errors than a single platform. The number of firewalls in medium and large organizations can reach dozens to hundreds, and each device usually has thousands of policy rules, totaling nearly one million policies. Analyzing the effectiveness of firewall policy settings and policy searches have become inefficient due to the massive amount of policies and the linkage of multiple firewalls.

[0005] On the other hand, the access control policy of the firewall is directly related to network connectivity and security. As long as the network structure and business change, the access control policy needs to be changed accordingly. However, frequent manual policy changes will greatly increase security risks and occupy a lot of human resources. Summary of the invention

[0006] The embodiment of the present application provides a heterogeneous firewall management method, device, computer equipment and storage medium. The technical solution is as follows:

[0007] On the one hand, an embodiment of the present application provides a heterogeneous firewall management method, the method comprising:

[0008] Receiving a management request for at least one firewall device among heterogeneous firewall devices, wherein the heterogeneous firewall devices include multiple firewall devices of different types;

[0009] Determine, based on the request type of the management request, a control instruction corresponding to the management request, the control instruction being used to control the firewall policy through a unified management model, the unified management model being used to uniformly manage the firewall policies of multiple different types of the firewall devices in the heterogeneous firewall devices;

[0010] Performing processing based on the control instruction to obtain a processing result;

[0011] Display is performed based on the processing results.

[0012] On the other hand, an embodiment of the present application provides a heterogeneous firewall management device, the device comprising:

[0013] A receiving module, configured to receive a management request for at least one firewall device among heterogeneous firewall devices, wherein the heterogeneous firewall devices include multiple firewall devices of different types;

[0014] a determination module, configured to determine, based on a request type of the management request, a control instruction corresponding to the management request, wherein the control instruction is used to control the firewall policy of the heterogeneous firewall device through a unified management model, and the unified management model is used to uniformly manage the firewall policy of the heterogeneous firewall device;

[0015] A processing module, used to perform processing based on the control instruction to obtain a processing result;

[0016] A display module is used to display based on the processing result.

[0017] On the other hand, an embodiment of the present application provides a computer device, which includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the method described in any of the above embodiments.

[0018] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor to implement the method described in the above aspects.

[0019] On the other hand, an embodiment of the present application provides a computer program product, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above aspects.

[0020] In an embodiment of the present application, a control instruction corresponding to the management request is determined based on the request type of the management request. The control instruction is used to control the firewall policy through a unified management model. The unified management model is used to uniformly manage the firewall policies of multiple different types of firewall devices in heterogeneous firewall devices, thereby achieving unified management of different heterogeneous firewalls. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a heterogeneous firewall management method provided by an exemplary embodiment of the present application;

[0023] Figure 2 is an architectural diagram of a heterogeneous firewall management system provided by an exemplary embodiment of the present application;

[0024] Figure 3 It is a schematic diagram of operation steps related to the storage component provided by an exemplary embodiment of the present application when the request type of the management request is to add a firewall policy or modify a firewall policy;

[0025] Figure 4 It is a schematic diagram of operation steps related to the interactive component provided by an exemplary embodiment of the present application when the request type of the management request is to add a firewall policy or modify a firewall policy;

[0026] Figure 5 It is a schematic diagram of operation steps related to the storage component and the interaction component when the request type of the management request is to delete a firewall policy, provided by an exemplary embodiment of the present application;

[0027] Figure 6 It is a schematic diagram of operation steps related to the storage component provided by an exemplary embodiment of the present application when the request type of the management request is to query the firewall policy;

[0028] Figure 7 is a flow chart of determining a unified management model provided by an exemplary embodiment of the present application;

[0029] Figure 8 is a schematic diagram of a unified management model provided by an exemplary embodiment of the present application;

[0030] Fig. 9 is a schematic diagram of processing multiple parallel management requests provided by an exemplary embodiment of the present application;

[0031] Fig.10 is a structural block diagram of a heterogeneous firewall management device provided by an exemplary embodiment of the present application;

[0032] Fig.11 It is a structural diagram of a computer device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0034] For security purposes, firewalls in enterprise networks usually have multiple different brands, and the access control policy configurations of devices of different brands are also different. In the embodiments of the present application, firewall devices of different brands or different access control policy configurations are referred to as heterogeneous firewalls.

[0035] In the related technologies, manual management of heterogeneous firewalls is inefficient and prone to errors, making it difficult for enterprises to implement fine-grained management of firewall policies and unable to accurately control and restrict network access rights, resulting in redundant, outdated or conflicting firewall policies, wasting network resources and firewall performance, reducing the work efficiency of the network security team, making it impossible to respond to policy changes and security incidents in a timely manner, and consuming a large amount of human resources.

[0036] Therefore, the embodiment of the present application proposes a heterogeneous firewall management method, which realizes unified management of different heterogeneous firewall devices through a heterogeneous firewall management system, improves the existing firewall policy management mechanism, improves policy management efficiency, reduces security risks, reduces resource consumption, simplifies management processes and enhances visual monitoring capabilities; realizes the processing of configuration differences of equipment of different brands, and provides unified policy analysis and evaluation functions, reduces human errors, improves efficiency, and ensures the consistency and accuracy of firewall policies.

[0037] See also Figure 1 , Figure 1 The flowchart of a heterogeneous firewall management method provided by an exemplary embodiment of the present application includes the following steps.

[0038] Step 101: receiving a management request for at least one firewall device among heterogeneous firewall devices, where the heterogeneous firewall devices include multiple firewall devices of different types.

[0039] The management request is a request for managing at least one firewall device of the heterogeneous firewall devices.

[0040] In some embodiments, the management request may be determined by a user by filling out a user work ticket.

[0041] In some embodiments, a management request corresponds to a firewall policy. For example, if the management request is to enable the collaborative office system to access the unified identity authentication system, then to implement the management request, the corresponding firewall policy should include the source address (IP address of the collaborative office system), source port (port of the collaborative office system), destination address (IP address of the unified identity authentication system) and destination port (port of the unified identity authentication system). The management request can only be implemented if the heterogeneous firewall device generates this firewall policy.

[0042] In some embodiments, the heterogeneous firewall management method can be implemented by a heterogeneous firewall management system, wherein the heterogeneous firewall management system includes a display component, a control component, a storage component, and an interaction component.

[0043] In some embodiments, in response to a management request for at least one firewall device in a heterogeneous firewall device, a presentation component receives the management request and passes the management request to a control component, the presentation component is used to provide a user interface, and the heterogeneous firewall device includes multiple firewall devices of different types.

[0044] The display component is used to provide a user interface and receive user operation requests. Users make requests by interacting with the display component. For example, users can perform operations such as device management, task delivery, and policy configuration through the display component.

[0045] See also Figure 2 , Figure 2 It is an architectural diagram of a heterogeneous firewall management system provided by an exemplary embodiment of the present application.

[0046] like Figure 2 As shown, the presentation component 211 in the heterogeneous firewall management system 210 can be used to perform two-way communication with the user 201 .

[0047] In some embodiments, the user 201 may input a management request through the work order filling interface of the presentation component 211 , and the presentation component 211 receives the management request.

[0048] In some embodiments, the presentation component 211 may receive the processing result fed back by the control component 212 , and present the processing result to the user 201 .

[0049] The presentation component 211 may also be configured to communicate bidirectionally with the control component 212 .

[0050] In some embodiments, the presentation component 211 receives the management request and passes the management request to the control component 212 .

[0051] The heterogeneous firewall device 220 includes multiple firewall devices of different types, such as firewall 221, firewall 222, firewall 223, etc.

[0052] Optionally, different types of heterogeneous firewall devices have different brands or different access control policy configurations.

[0053] Step 102, based on the request type of the management request, determine the control instruction corresponding to the management request, the control instruction is used to control the firewall policy through a unified management model, and the unified management model is used to uniformly manage the firewall policies of multiple different types of firewall devices in heterogeneous firewall devices.

[0054] In some embodiments, the control instruction is generated by a control component. In some embodiments, the control instruction can be used to control a storage component in a heterogeneous firewall management system. In other embodiments, the control instruction can also be used to control a storage component and an interaction component in a heterogeneous firewall management system.

[0055] The control component is used to implement the control function of the heterogeneous firewall management system 210. The control component is the basis of the overall architecture and is the core component that connects the display component, storage component and interaction component. It has core logical functions such as providing services, receiving requests from various components, processing data models, and returning request responses.

[0056] like Figure 2 In the embodiment, the control component 212 can be used to implement two-way communication with the display component 211, the storage component 213 and the interaction component 214.

[0057] In some embodiments, different management requests may have different request types. In some embodiments, the request type of the management request includes but is not limited to adding a firewall policy, modifying a firewall policy, deleting a firewall policy, or querying a firewall policy, etc.

[0058] Different request types may correspond to different control instructions. Therefore, in some embodiments, the control component determines the control instruction corresponding to the management request based on the request type of the management request.

[0059] In a possible scenario, the request type of the management request is to add a firewall policy, modify a firewall policy, or delete a firewall policy. In this case, the control instruction corresponding to the management request is used to control the storage component and the interaction component.

[0060] In a possible scenario, the request type of the management request is to query a firewall policy, and the control instruction corresponding to the management request is used to control a storage component.

[0061] Optionally, the firewall policy includes fields such as applicant unit, application name, destination system name, source address, destination address, source port, destination port, protocol and action. When the firewall receives network traffic, it matches the attributes of the traffic with the fields of the firewall policy and then performs the corresponding allow or deny action.

[0062] The storage component 213 is used to store data related to the management process of the heterogeneous firewall management system, such as firewall policies, user work orders, or operation logs, user accounts and other data.

[0063] In some embodiments, a unified management model is stored in the storage component, and the storage component stores the firewall policies of the heterogeneous firewall devices through the unified management model, wherein the unified management model is used to uniformly manage the heterogeneous firewall devices.

[0064] Optionally, the unified management model includes a work order model, an address model, an address content model, an address or group model, a service model, a service content model, a service or group model and a policy model.

[0065] Optionally, the unified management model also includes a firewall matching model, or other models for unified management of heterogeneous firewall devices, which is not limited in this application.

[0066] For more information about the unified management model, see Figure 8 And the related descriptions are not repeated here.

[0067] The interaction component 214 is used to implement data interaction between the control component 212 and the heterogeneous firewall device 220 .

[0068] The interactive component 214 can communicate with multiple brands and types of firewall devices to collect and distribute information. For example, the interactive component 214 can collect security zones configured on the firewall, such as the untrust zone, trust zone, and DMZ (Demilitarized Zone), as well as existing policies, addresses, and services on the firewall, and can distribute firewall policies to corresponding firewall devices.

[0069] The control instruction is used to send to the control object so that the control object completes the function required to realize the management request. In some embodiments, the control object of the control instruction includes a storage component; in other embodiments, the control object of the control instruction includes a storage component and an interaction component.

[0070] Step 103: Processing is performed based on the control instruction to obtain a processing result.

[0071] In some embodiments, the control object receives the control instruction, performs processing based on the control instruction, obtains a processing result, and feeds the processing result back to the control component.

[0072] In some embodiments, the control object is a storage component 213, which can add firewall policies, delete firewall policies, modify firewall policies, or query firewall policies based on control instructions, and feed back the processing results (such as a successful deletion message or a query result) to the control component 212.

[0073] In some embodiments, the control object is the interactive component 214, which can send the firewall policy to the corresponding firewall in the heterogeneous firewall device 220 based on the control instruction, and feedback the processing result (such as the message of successful sending) to the control component 212.

[0074] Step 104: Display based on the processing result.

[0075] In some embodiments, the control component feeds back the processing result to the presentation component, so that the presentation component presents the feedback result.

[0076] For example, the control component 212 may send a message that the firewall policy is successfully deleted, or a message that the firewall policy is successfully sent to the corresponding firewall, to the display component 211, so that the display component 211 displays it to the user.

[0077] Compared with a single firewall, a platform that can operate multiple firewalls must redesign a new architecture. The heterogeneous firewall management system proposed in the embodiment of the present application allows integration with firewall devices of multiple brands and architectures in the existing network, can identify user needs, intelligently generate firewall policies and match them to specific firewalls.

[0078] To summarize, based on the request type of the management request, the control instruction corresponding to the management request is determined. The control instruction is used to control the firewall policy through a unified management model. The unified management model is used to uniformly manage the firewall policies of multiple different types of firewall devices in heterogeneous firewall devices, thereby realizing unified management of different heterogeneous firewalls.

[0079] In a possible scenario, when the request type of the management request is to add a firewall policy or to modify a firewall policy, the control object includes a storage component.

[0080] In some embodiments, when the request type of the management request is to add a firewall policy or to modify a firewall policy, a control instruction including a virtual firewall policy is generated based on the management request.

[0081] The virtual firewall policy is a firewall policy to be added or a firewall policy to be modified.

[0082] In some embodiments, the virtual firewall policy in the control instruction is compared with the firewall policy in the unified management model to obtain a comparison result.

[0083] When the comparison result indicates that the virtual firewall policy is inconsistent with the firewall policy in the unified management model, the virtual firewall policy is stored in the unified management model to obtain a first processing result, which indicates that the storage is successful.

[0084] See also Figure 3 , Figure 3 It is a schematic diagram of operation steps related to the storage component provided by an exemplary embodiment of the present application when the request type of the management request is to add a firewall policy or modify a firewall policy.

[0085] The schematic diagram includes the following steps.

[0086] Step 3.1: User 301 fills in a user work order and sends a management request to presentation component 311. The request type of the management request is to add a firewall policy or modify a firewall policy.

[0087] Step 3.2: The presentation component 311 sends the management request to the control component 312.

[0088] Step 3.3: The control component 312 generates a virtual firewall policy based on the management request; the control component 312 sends a control instruction including the virtual firewall policy to the storage component 313.

[0089] The virtual firewall policy refers to a temporarily generated firewall policy. The storage component compares the virtual firewall policy with the existing firewall policies in the unified management model to determine whether to add the virtual firewall policy.

[0090] In some embodiments, the control component 312 can determine the source address, source port, destination address and destination port based on the management request to generate a corresponding virtual firewall policy. For example, if the management request is to enable the collaborative office system to access the unified identity authentication system, the virtual firewall policy should include the source address (IP address of the collaborative office system), source port (port of the collaborative office system), destination address (IP address of the unified identity authentication system) and destination port (port of the unified identity authentication system).

[0091] The control instructions including the virtual firewall policy are used to control the storage component, and the virtual firewall policy is compared with the existing firewall policy in the unified management model.

[0092] Step 3.4. The storage component 313 compares the virtual firewall policy with the firewall policy in the unified management model to obtain a comparison result. When the comparison result indicates that the virtual firewall policy is inconsistent with the existing firewall policy, the storage component 313 stores the virtual firewall policy as the virtual firewall policy and determines the first processing result as a successful storage. The storage component 313 sends the first processing result to the control component 312.

[0093] Optionally, when the comparison result indicates that the virtual firewall policy is consistent with the existing firewall policy, it means that the virtual firewall policy has been stored in the unified management model. Therefore, the storage component determines the processing result as duplicate storage and sends a message to the control component indicating that the duplicate storage caused the storage failure, so that the control component informs the user through the display component that the virtual firewall policy already exists.

[0094] Step 3.5: The control component 312 sends the first processing result to the display component 311.

[0095] Step 3.6: The display component 311 displays the first processing result to the user 301.

[0096] In some embodiments, when the first processing result indicates successful storage and the first processing result passes the review, the computer device sends the virtual firewall policy contained in the control instruction to the corresponding firewall device in the heterogeneous firewall device to obtain a second processing result, and the second processing result indicates that the firewall device successfully receives the virtual firewall policy.

[0097] See also Figure 4 , Figure 4 It is a schematic diagram of operation steps related to the interactive components provided by an exemplary embodiment of the present application when the request type of the management request is to add a firewall policy or modify a firewall policy.

[0098] Step 4.1: User 301 reviews the first processing result, and after passing the review, sends a review success message to presentation component 311.

[0099] Step 4.2: When the first processing result passes the review, the display component 311 feeds back a review success message to the control component 312.

[0100] Step 4.3: Upon receiving the audit success message, the control component 312 sends the control instruction including the virtual firewall policy to the interaction component 314.

[0101] The control instruction including the virtual firewall policy is used to control the interaction component 314 so that the interaction component 314 sends the virtual firewall policy to the corresponding firewall in the heterogeneous firewall device 320.

[0102] Step 4.4: The interaction component 314 receives the control instruction including the virtual firewall policy, and sends the virtual firewall policy to the heterogeneous firewall device 320 based on the control instruction.

[0103] Step 4.5: The interaction component 314 processes at least one firewall device among the heterogeneous firewall devices based on the virtual firewall policy to obtain a second processing result.

[0104] Optionally, the second processing result is a message indicating a successful delivery or a message indicating a failed delivery.

[0105] Step 4.6: The interaction component 314 sends the second processing result to the control component 312.

[0106] Step 4.7: The control component 312 sends the second processing result to the display component 311.

[0107] Step 4.8: The display component 311 displays the second processing result to the user 301.

[0108] In a possible scenario, the request type of the management request is to delete a firewall policy, and the control objects of the control component include a storage component and an interaction component.

[0109] In some embodiments, when the request type of the management request is to delete a firewall policy, a control instruction containing the firewall policy to be deleted is determined, and the firewall policy to be deleted in the control instruction is compared with the firewall policy in the unified management model to obtain a comparison result.

[0110] See also Figure 5 , Figure 5 It is a schematic diagram of operation steps related to the storage component and the interaction component provided by an exemplary embodiment of the present application when the request type of the management request is to delete the firewall policy.

[0111] The schematic diagram includes the following steps.

[0112] Step 5.1: User 501 fills in a user work order and sends a deletion request to presentation component 511. The deletion request is a management request of a request type of deleting a firewall policy.

[0113] Step 5.2: The presentation component 511 sends the deletion request to the control component 512.

[0114] Step 5.3: The control component 512 sends the control instruction including the firewall policy to be deleted to the storage component 513.

[0115] In some embodiments, when the comparison result indicates that the firewall policy to be deleted is consistent with the firewall policy in the unified management model, the firewall policy to be deleted is deleted to obtain a third processing result, and the third processing result indicates that the deletion is successful.

[0116] Step 5.4: The storage component 513 compares the firewall policy to be deleted with the firewall policy in the unified management model to obtain a comparison result; if the comparison result indicates that the firewall policy to be deleted is consistent with the existing firewall policy, the storage component deletes the firewall policy to be deleted and determines the third processing result as a successful deletion.

[0117] Step 5.5: The control component 512 sends the control instruction including the firewall policy to be deleted to the interaction component 514.

[0118] In some embodiments, a control instruction including the firewall policy to be deleted is sent to a corresponding firewall device in the heterogeneous firewall devices to obtain a fourth processing result, which indicates that the firewall device successfully deletes the firewall policy to be deleted.

[0119] Step 5.6 and step 5.7: The interaction component 514 deletes the corresponding firewall policy in the heterogeneous firewall device based on the firewall policy to be deleted, and obtains a fourth processing result.

[0120] Step 5.8: The interaction component 514 feeds back the fourth processing result to the control component 512.

[0121] Step 5.9: The control component 512 feeds back the third and fourth processing results to the display component 511.

[0122] Step 5.10: The presentation component 511 feeds back the third and fourth processing results to the user 501.

[0123] In a possible scenario, the request type of the management request is querying a firewall policy, and the control object of the control component includes a storage component.

[0124] In some embodiments, when the request type of the management request is to query the firewall policy, a control request containing the query condition is determined; based on the control request, a query result corresponding to the query condition is determined from the unified management model, and the query result is determined as the fifth processing result.

[0125] Optionally, the query conditions include firewall device information, source address information, destination address information, etc.

[0126] See also Figure 6 , Figure 6It is a schematic diagram of operation steps related to the storage component provided by an exemplary embodiment of the present application when the request type of the management request is to query the firewall policy.

[0127] The schematic diagram includes the following steps.

[0128] Step 6.1: User 601 fills in a user work order and sends a query request to presentation component 611. The query request is a management request of a request type of querying a firewall policy.

[0129] Step 6.2: The presentation component 611 sends the query request to the control component 612.

[0130] Step 6.3: The control component 612 sends a control request including the query condition to the storage component 613.

[0131] Step 6.4: The storage component 613 determines the query firewall policy corresponding to the query condition from the unified management model, and determines the query firewall policy as the fifth processing result.

[0132] Step 6.5: The control component 612 feeds back the fifth processing result to the display component 611.

[0133] Step 6.6: The presentation component 611 feeds back the fifth processing result to the user 601.

[0134] For the convenience of expansion, the method proposed in the embodiment of the present application will not modify the data model of the original firewall. However, due to the differences in data models between firewall suppliers of different brands, and the database storage model of a single firewall and the database storage model of a firewall centralized management platform, there are also some differences in fields. Therefore, in the embodiment of the present application, a unified management model that supports heterogeneous firewalls and massive data is designed to solve the problem of data model differences between different devices and improve the efficiency and convenience of security operation and maintenance.

[0135] Optionally, the unified management model includes a relational data model, such as a table including multiple fields.

[0136] Optionally, the unified management model includes non-relational data models, such as objects in a programming language, and each model includes attribute fields of the model and behavior methods of the model.

[0137] See also Figure 7 , Figure 7 It is a flowchart for determining a unified management model provided by an exemplary embodiment of the present application.

[0138] The flow chart includes the following steps.

[0139] Step 711, for the firewall devices in the heterogeneous firewall devices, a unified work order model, address model and service model are determined.

[0140] The work order model is used to describe the five-tuple field corresponding to the management request, and the five-tuple field includes a source address field, a destination address field, a protocol field, a source port field, and a destination port field.

[0141] The address model is used to describe source address information and destination address information.

[0142] The service model is used to describe the protocol information, source port information, and destination port information.

[0143] See also Figure 8 , Figure 8 It is a schematic diagram of a unified management model provided by an exemplary embodiment of the present application.

[0144] like Figure 8 As shown, the unified management model includes a work order model 811 , an address model 812 , and a service model 813 .

[0145] Step 721, based on the address model, determine the address content model and the address or group model.

[0146] Among them, the address content model and the address or group model are references to the address model, and the address content model is used to describe the IP address range and subnet mask corresponding to the source address and the destination address, and the address or group model is used to describe the source address and the destination address as a single address or a group of addresses.

[0147] like Figure 8 As shown, the unified management model includes an address content model 821 and an address or group model 822 .

[0148] Step 722: Determine the service content model and the service or group model based on the service model.

[0149] The service content model and the service or group model are references to the service model, and the service content model is used to describe the port range and protocol type, and the service or group model is used to describe the service as a single service or a group of services.

[0150] like Figure 8 As shown, the unified management model includes a service content model 823 and a service or group model 824 .

[0151] Step 723, determine the policy model based on the work order model, address model and service model.

[0152] In some embodiments, a policy model may be generated based on fields of a work order model, references to an address or group model, and references to a service or group model.

[0153] The policy model is used to describe the firewall policy corresponding to the firewall device in the heterogeneous firewall device. The firewall policy includes one or more of the applicant, application name, destination system name, source address, destination address, source port, destination port, protocol and access action.

[0154] For example, a firewall policy usually includes fields such as applicant unit, application name, destination system name, source address, destination address, source port, destination port, protocol and action. Among them, the applicant unit, application name and destination system name are derived from the work order field, while the source address and destination address are derived from the address or address group model, and the source port, destination port and protocol are derived from the service or service group model.

[0155] like Figure 8 As shown, the unified management model includes a policy model 831 .

[0156] In some embodiments, a unified management model may be formed based on a work order model, an address model, a service model, and a policy model.

[0157] Step 731, forming a unified management model based on the work order model, address model, address content model, address or group model, service model, service content model, service or group model and policy model.

[0158] like Figure 8 As shown, the unified management model includes a work order model 811 , an address model 812 , a service model 813 , an address content model 821 , an address or group model 822 , a service content model 823 , a service or group model 824 and a policy model 831 .

[0159] Optionally, there are associations and references between the above models. Optionally, there is a one-to-many association between the work order model and the policy model; there is a many-to-many association between the address model and the address or group model; there is a one-to-many association between the address model and the address content model; there is a many-to-many association between the service model and the service or group model; there is a one-to-many association between the service model and the service content model. The policy model acts as a hub to link other models. It not only has a many-to-many association with the address or group model, but also has a many-to-many association with the service or group model, and has an association with the work order model.

[0160] In the embodiment of the present application, a unified management model is used to enable the management mechanism to flexibly handle different types of firewall policies and support the processing of multiple association relationships.

[0161] It should be noted that the above description only covers part of the core logic, and the actual model may include more fields and relationships.

[0162] In the embodiment of the present application, many models such as address or service are used instead of using only policy model, which has many advantages. First, reusability can be improved and data redundancy can be reduced. For example, under a single policy model, if 1000 businesses need to access port 80 of a certain system, it is necessary to generate and store 1000 data with port 80, while under a multi-model, no matter how many accesses there are, only one data with port 80 needs to be generated and stored in the service model, and the policy model can refer to the service model. Secondly, the efficiency of change can be improved. For example, originally 1000 businesses need to access port 80 of a certain system. Due to system upgrade, port 8080 needs to be accessed now. If it is a single model, it needs to be modified 1000 times, while under a multi-model, it only needs to modify port 80 in the service model to port 8080 once. At the same time, the query efficiency can be improved. For specific ports, addresses, etc. that need to be queried, it is only necessary to query in a specific model under a multi-model, while a single model needs to search in all data every time.

[0163] In some possible implementations, the heterogeneous firewall management method proposed in this application is applied to a scenario where there are multiple parallel management requests.

[0164] In some embodiments, the embodiments of the present application use an automated pipeline to process multiple parallel management requests. In some embodiments, the processing of a management request includes five stages, namely: processing user requests, generating policies, policy review, policy execution, and result processing.

[0165] See also Fig. 9 , Fig. 9 It is a schematic diagram of processing multiple parallel management requests provided by an exemplary embodiment of the present application.

[0166] like Fig. 9 As shown, the processing process of each management request includes five stages: processing user request, generating policy, policy review, policy execution and result processing, which are shown as 1 to 5 in the figure respectively.

[0167] In some embodiments, since the policy being added is compared with the previously executed policy at each review to prevent redundancy caused by adding duplicate policies, the review of the next policy must be performed after the previous policy is executed.

[0168] Taking the processing process 901 corresponding to the first management request and the processing process 902 corresponding to the second management request as examples, the third stage (policy review stage) in the processing process 902 needs to be started after the fourth stage (policy execution) in the processing process 901 is completed.

[0169] That is, in some embodiments, when the second processing result corresponding to the i-th management request indicates that the firewall device corresponding to the i-th management request successfully receives the virtual firewall policy, and the control instruction corresponding to the i+1-th management request is generated, the virtual firewall policy contained in the control instruction corresponding to the i+1-th management request is compared with the firewall policy in the unified management model to obtain the comparison result corresponding to the i+1-th management request.

[0170] Exemplarily, assuming that the processing time required for the five stages is the same, multiple management requests are processed in parallel by the method of the embodiment of the present application, and the time acceleration ratio corresponding to n management requests (n is a positive integer greater than 1) is:

[0171]

[0172] It can be seen that as n increases, λ also increases, that is, the ratio of the time of not processing multiple management requests in parallel to the time of processing multiple management requests in parallel becomes larger and larger, and there is That is, the time taken to process multiple management requests in parallel is reduced to two-fifths of the original time. Therefore, processing multiple management requests in parallel improves business efficiency.

[0173] See also Fig.10 , Fig.10 This is a structural block diagram of a heterogeneous firewall management device provided by an exemplary embodiment of the present application. The device includes:

[0174] A receiving module 1001 is used to receive a management request for at least one firewall device among heterogeneous firewall devices, wherein the heterogeneous firewall devices include multiple firewall devices of different types;

[0175] A determination module 1002, configured to determine a control instruction corresponding to the management request based on a request type of the management request, wherein the control instruction is used to control the firewall policy of the heterogeneous firewall device through a unified management model, and the unified management model is used to uniformly manage the firewall policy of the heterogeneous firewall device;

[0176] The processing module 1003 is used to process based on the control instruction to obtain a processing result;

[0177] The display module 1004 is used to display based on the processing result.

[0178] Optionally, the determination module 1002 is used to:

[0179] In the case where the request type of the management request is to add a firewall policy or to modify a firewall policy, a control instruction including a virtual firewall policy is generated based on the management request; the virtual firewall policy is the firewall policy to be added or the firewall policy to be modified;

[0180] Optionally, the processing module 1003 is used to:

[0181] Comparing the virtual firewall policy in the control instruction with the firewall policy in the unified management model to obtain a comparison result;

[0182] When the comparison result indicates that the virtual firewall policy is inconsistent with the firewall policy in the unified management model, the virtual firewall policy is stored in the unified management model to obtain a first processing result, which indicates successful storage.

[0183] Optionally, the processing module 1003 is used to:

[0184] When the first processing result indicates that the storage is successful and the first processing result passes the review, the virtual firewall policy contained in the control instruction is sent to the corresponding firewall device in the heterogeneous firewall device to obtain a second processing result, and the second processing result indicates that the firewall device successfully receives the virtual firewall policy.

[0185] Optionally, the processing module 1003 is used to:

[0186] When the second processing result corresponding to the i-th management request indicates that the firewall device corresponding to the i-th management request successfully receives the virtual firewall policy, and the control instruction corresponding to the i+1-th management request is generated, the virtual firewall policy contained in the control instruction corresponding to the i+1-th management request is compared with the firewall policy in the unified management model to obtain the comparison result corresponding to the i+1-th management request.

[0187] Optionally, the determination module 1002 is used to:

[0188] In a case where the request type of the management request is to delete a firewall policy, determining the control request including the firewall policy to be deleted;

[0189] Optionally, the processing module 1003 is used to:

[0190] Comparing the firewall policy to be deleted in the control request with the firewall policy in the unified management model to obtain a comparison result;

[0191] When the comparison result indicates that the firewall policy to be deleted is consistent with the firewall policy in the unified management model, the firewall policy to be deleted is deleted to obtain a third processing result, and the third processing result indicates that the deletion is successful;

[0192] The control request including the firewall policy to be deleted is sent to a corresponding firewall device in the heterogeneous firewall devices to obtain a fourth processing result, wherein the fourth processing result indicates that the firewall device successfully deletes the firewall policy to be deleted.

[0193] Optionally, the determination module 1002 is used to:

[0194] In a case where the request type of the management request is querying a firewall policy, determining the control request including the query condition;

[0195] Optionally, the processing module 1003 is used to:

[0196] Based on the control request, a query result corresponding to the query condition is determined from the unified management model, and the query result is determined as a fifth processing result.

[0197] Optionally, the apparatus further includes a unifying module, and before receiving the management request for at least one firewall device among the heterogeneous firewall devices, the unifying module is configured to:

[0198] For multiple different types of firewall devices in the heterogeneous firewall device, a unified work order model, address model and service model are determined, wherein the work order model is used to describe the five-tuple field corresponding to the firewall policy of the firewall device, and the five-tuple field includes a source address field, a destination address field, a protocol field, a source port field and a destination port field; the address model is used to describe the source address information and the destination address information; the service model is used to describe the protocol information, the source port information and the destination port information;

[0199] Based on the work order model, the address model and the service model, a policy model is determined, wherein the policy model is used to describe firewall policies corresponding to multiple different types of firewall devices in the heterogeneous firewall device, and the firewall policy includes one or more of an applicant, an application name, a destination system name, a source address, a destination address, a source port, a destination port, a protocol and an access action;

[0200] The unified management model is formed based on the work order model, the address model, the service model and the policy model.

[0201] Optional, unified module for:

[0202] Based on the address model, determine an address content model and an address or group model, wherein the address content model and the address or group model are references to the address model, and the address content model is used to describe the IP address range and subnet mask corresponding to the source address and the destination address, and the address or group model is used to describe the source address and the destination address as a single address or a group of addresses;

[0203] Based on the service model, determine a service content model and a service or group model, wherein the service content model and the service or group model are references to the service model, and the service content model is used to describe the port range and protocol type, and the service or group model is used to describe the service as a single service or a group of services;

[0204] The policy model is determined based on one or more of the work order model, the address model, the address content model, the address or group model, the service model, the service content model, and the service or group model.

[0205] See also Fig.11 , Fig.11 1 is a schematic diagram of the structure of a computer device provided by an exemplary embodiment of the present application. The computer device can be implemented as the heterogeneous firewall management system in the above embodiment.

[0206] The computer device may further include one or more of the following components: a processor 1110 and a memory 1120 .

[0207] Optionally, the processor 1110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 1120, and calling data stored in the memory 1120. Optionally, the processor 1110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 1110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a baseband chip. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content that needs to be displayed on the touch display; the NPU is used to implement artificial intelligence (AI) functions; and the baseband chip is used to process wireless communications. It is understandable that the above-mentioned baseband chip may not be integrated into the processor 1110, but may be implemented by a separate chip.

[0208] The memory 1120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 1120 includes a non-transitory computer-readable storage medium. The memory 1120 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 1120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data created according to the use of the electronic device (such as audio data, a phone book), etc.

[0209] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above figures does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figures, or a combination of certain components, or a different arrangement of components.

[0210] The embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction is stored, and the at least one instruction is loaded and executed by a processor to implement the method described in the above embodiment. Optionally, the computer-readable storage medium may include: ROM, RAM, solid state drive (SSD, Solid State Drives) or optical disk, etc. Among them, RAM may include resistance random access memory (ReRAM, Resistance Random Access Memory) and dynamic random access memory (DRAM, Dynamic Random Access Memory).

[0211] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in various optional implementations of the above aspects.

[0212] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A heterogeneous firewall management method, characterized in that: The method comprises: Receiving a management request for at least one firewall device among heterogeneous firewall devices, wherein the heterogeneous firewall devices include multiple firewall devices of different types; Determine, based on the request type of the management request, a control instruction corresponding to the management request, the control instruction being used to control the firewall policy through a unified management model, the unified management model being used to uniformly manage the firewall policies of multiple different types of the firewall devices in the heterogeneous firewall devices; Performing processing based on the control instruction to obtain a processing result; Display is performed based on the processing results.

2. The method according to claim 1, characterized in that The determining, based on the request type of the management request, a control instruction corresponding to the management request, includes: In the case where the request type of the management request is to add a firewall policy or to modify a firewall policy, a control instruction including a virtual firewall policy is generated based on the management request; the virtual firewall policy is the firewall policy to be added or the firewall policy to be modified; The processing based on the control instruction to obtain a processing result includes: Comparing the virtual firewall policy in the control instruction with the firewall policy in the unified management model to obtain a comparison result; When the comparison result indicates that the virtual firewall policy is inconsistent with the firewall policy in the unified management model, the virtual firewall policy is stored in the unified management model to obtain a first processing result, which indicates successful storage.

3. The method according to claim 2, characterized in that The processing based on the control instruction to obtain a processing result also includes: When the first processing result indicates that the storage is successful and the first processing result passes the review, the virtual firewall policy contained in the control instruction is sent to the corresponding firewall device in the heterogeneous firewall device to obtain a second processing result, and the second processing result indicates that the firewall device successfully receives the virtual firewall policy.

4. The method according to claim 3, characterized in that In the case where there are multiple parallel management requests, comparing the virtual firewall policy in the control instruction with the firewall policy in the unified management model to obtain a comparison result includes: When the second processing result corresponding to the i-th management request indicates that the firewall device corresponding to the i-th management request successfully receives the virtual firewall policy, and the control instruction corresponding to the i+1-th management request is generated, the virtual firewall policy contained in the control instruction corresponding to the i+1-th management request is compared with the firewall policy in the unified management model to obtain the comparison result corresponding to the i+1-th management request.

5. The method according to claim 1, characterized in that The determining, based on the request type of the management request, a control instruction corresponding to the management request, includes: In a case where the request type of the management request is to delete a firewall policy, determining the control instruction including the firewall policy to be deleted; The processing based on the control instruction to obtain a processing result includes: Comparing the firewall policy to be deleted in the control instruction with the firewall policy in the unified management model to obtain a comparison result; When the comparison result indicates that the firewall policy to be deleted is consistent with the firewall policy in the unified management model, the firewall policy to be deleted is deleted to obtain a third processing result, and the third processing result indicates that the deletion is successful; The control instruction including the firewall policy to be deleted is sent to a corresponding firewall device in the heterogeneous firewall devices to obtain a fourth processing result, wherein the fourth processing result indicates that the firewall device successfully deletes the firewall policy to be deleted.

6. The method according to claim 1, characterized in that The determining, based on the request type of the management request, a control instruction corresponding to the management request, includes: In a case where the request type of the management request is querying a firewall policy, determining the control instruction including the query condition; The processing based on the control instruction to obtain a processing result includes: Based on the control instruction, a query result corresponding to the query condition is determined from the unified management model, and the query result is determined as a fifth processing result.

7. The method according to claim 1, characterized in that Before receiving a management request for at least one firewall device among the heterogeneous firewall devices, the method further includes: For multiple different types of firewall devices in the heterogeneous firewall device, a unified work order model, address model and service model are determined, wherein the work order model is used to describe the five-tuple field corresponding to the firewall policy of the firewall device, and the five-tuple field includes a source address field, a destination address field, a protocol field, a source port field and a destination port field; the address model is used to describe the source address information and the destination address information; the service model is used to describe the protocol information, the source port information and the destination port information; Based on the work order model, the address model and the service model, a policy model is determined, wherein the policy model is used to describe firewall policies corresponding to multiple different types of firewall devices in the heterogeneous firewall device, and the firewall policy includes one or more of an applicant, an application name, a destination system name, a source address, a destination address, a source port, a destination port, a protocol and an access action; The unified management model is formed based on the work order model, the address model, the service model and the policy model.

8. The method according to claim 7, characterized in that The determining of the policy model based on the work order model, the address model and the service model includes: Based on the address model, determine an address content model and an address or group model, wherein the address content model and the address or group model are references to the address model, and the address content model is used to describe the IP address range and subnet mask corresponding to the source address and the destination address, and the address or group model is used to describe the source address and the destination address as a single address or a group of addresses; Based on the service model, determine a service content model and a service or group model, wherein the service content model and the service or group model are references to the service model, and the service content model is used to describe the port range and protocol type, and the service or group model is used to describe the service as a single service or a group of services; The policy model is determined based on one or more of the work order model, the address model, the address content model, the address or group model, the service model, the service content model, and the service or group model.

9. A heterogeneous firewall management device, characterized in that: The device comprises: A receiving module, configured to receive a management request for at least one firewall device among the heterogeneous firewall devices, wherein the heterogeneous firewall devices include multiple firewall devices of different types; a determination module, configured to determine, based on a request type of the management request, a control instruction corresponding to the management request, wherein the control instruction is used to control the firewall policy of the heterogeneous firewall device through a unified management model, and the unified management model is used to uniformly manage the firewall policy of the heterogeneous firewall device; A processing module, used to perform processing based on the control instruction to obtain a processing result; A display module is used to display based on the processing result.

10. A computer device, characterized in that: The computer device includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the heterogeneous firewall management method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the instruction is loaded and executed by the processor to implement the heterogeneous firewall management method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the heterogeneous firewall management method as described in any one of claims 1 to 8.

Images