Firewall rule generation method, system and device and storage medium

Abstract

The invention provides a firewall rule generation method, system and device and a storage medium. The method comprises the following steps: acquiring a plurality of reservation time plans of a firewall, wherein each reservation time plan comprises a specified reservation time period under a specified reservation date; determining a first plan and at least one second plan in the plurality of appointment time plans; combining the first plan and the at least one second plan to obtain at least one third plan; and generating a firewall rule corresponding to the at least one third plan. According to the embodiment of the invention, the first plan and the at least one second plan are combined to obtain the at least one third plan, and the corresponding firewall rule is generated according to the at least one third plan, so that the number of the appointment time plans needing to generate the firewall rule is reduced, the number of the generated firewall rules is also reduced, and the generation efficiency of the firewall rule is improved. Therefore, the conditions that the performance of the gateway equipment is reduced, the memory consumption is excessive, the management difficulty of the firewall rule is increased and the like are avoided.

Description

Technical Field

[0001] The present application relates to the field of firewall technology, and in particular to a method, system, device and storage medium for generating firewall rules. Background Art

[0002] Firewall is an important function of gateway devices, which can defend against network attacks, intercept malicious traffic, manage ports and services, record and monitor network activities, and prevent internal information leakage. These advantages enable firewalls to better cope with the current complex and changing network environment and provide more secure and efficient network services for enterprises and individuals.

[0003] The firewall can also support the Schedule table time reservation function. For example, it can control the flow of data packets in different time periods according to the reservation time plan in the Schedule table, thereby enhancing the flexibility of network control.

[0004] However, a firewall rule can only be configured with one appointment time plan. If there are multiple appointment time plans in the Schedule table, a firewall rule needs to be generated for each appointment time plan. If too many firewall rules are generated, the performance of the gateway device will be reduced, the memory consumption will be excessive, and the management of the firewall rules will be more difficult. Summary of the invention

[0005] The present application provides a method, system, device and storage medium for generating firewall rules, aiming to reduce the number of generated firewall rules, thereby avoiding performance degradation of gateway devices, excessive memory consumption, and increased difficulty in managing firewall rules.

[0006] In one aspect, the present application provides a method for generating a firewall rule, the method for generating a firewall rule comprising:

[0007] Acquire multiple appointment time plans of the firewall, each of which includes a specified appointment time period under a specified appointment date;

[0008] Determine a first plan and at least one second plan from the plurality of appointment time plans, wherein the designated appointment time period in the first plan is taken as a first time set, the designated appointment time period in each of the second plans is taken as a second time set, and the union of the second time sets in at least one of the second plans is taken as the first time set;

[0009] Merging the first plan and at least one of the second plans to obtain at least one third plan, wherein the designated appointment date in at least one of the third plans includes the designated appointment date in the first plan and the designated appointment date in at least one of the second plans, and the designated appointment time period in at least one of the third plans includes the designated appointment time period in at least one of the second plans;

[0010] A firewall rule corresponding to at least one of the third plans is generated.

[0011] In a possible implementation of the present application, determining a first plan and at least one second plan from the plurality of appointment time plans includes:

[0012] Among the plurality of appointment time plans, each of the appointment time plans is sequentially used as a plan to be tested, and the designated appointment time period in the plan to be tested is used as a time set to be tested;

[0013] Determine at least one target plan from the plurality of appointment time plans, wherein the designated appointment time period in each target plan is taken as a target set, and each target set is a subset of the time set to be detected;

[0014] If the union of the target sets in at least one of the target plans is the time set to be detected, the plan to be detected is used as the first plan, and at least one of the target plans is used as at least one of the second plans.

[0015] In a possible implementation of the present application, the merging of the first plan and at least one of the second plans to obtain at least one third plan includes:

[0016] If there is only one second plan among the plurality of appointment time plans, the designated appointment date in the first plan and the designated appointment date in the second plan are both used as the designated appointment date in the third plan;

[0017] Using the designated appointment time period in the second plan as the designated appointment time period in the third plan;

[0018] The third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

[0019] In a possible implementation of the present application, the merging of the first plan and at least one of the second plans to obtain at least one third plan includes:

[0020] If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are the same, the designated appointment date in the first plan and the designated appointment dates in the multiple second plans are all used as the designated appointment date in the one third plan;

[0021] Using the designated appointment time period in any of the second plans as the designated appointment time period in the third plan;

[0022] The third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

[0023] In a possible implementation of the present application, the merging of the first plan and at least one of the second plans to obtain at least one third plan includes:

[0024] If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are different, then for each of the second plans, the designated appointment date in the first plan and the designated appointment date in the second plan are used as the designated appointment date in one of the third plans, thereby obtaining the designated appointment dates in the multiple third plans;

[0025] For each of the second plans, taking the designated reservation time period in the second plan as the designated reservation time period in one of the third plans, thereby obtaining a plurality of designated reservation time periods in the third plans;

[0026] A plurality of the third plans are generated respectively by using the designated reservation dates and the designated reservation time periods in the plurality of the third plans.

[0027] In a possible implementation of the present application, the step of obtaining multiple appointment time plans of the firewall includes:

[0028] Obtaining a reservation time schedule for a time reservation function of the firewall;

[0029] Determining a data packet control strategy for each plan in the appointment time schedule;

[0030] In the reservation time schedule table, plans with the same data packet control strategy are taken as a plurality of reservation time plans.

[0031] In a possible implementation of the present application, the method for generating firewall rules further includes:

[0032] Detecting whether the appointment time schedule has been modified;

[0033] It is detected that the reservation time schedule is modified, and the step of obtaining the reservation time schedule of the time reservation function of the firewall is performed.

[0034] In one aspect, the present application provides a system for generating firewall rules, the system for generating firewall rules comprising:

[0035] A plan acquisition module, used to acquire multiple appointment time plans of the firewall, each of which includes a specified appointment time period under a specified appointment date;

[0036] A plan determination module, configured to determine a first plan and at least one second plan from the plurality of appointment time plans, wherein the designated appointment time period in the first plan is taken as a first time set, the designated appointment time period in each of the second plans is taken as a second time set, and the union of the second time sets in at least one of the second plans is taken as the first time set;

[0037] a plan merging module, configured to merge the first plan and at least one of the second plans to obtain at least one third plan, wherein the designated appointment date in at least one of the third plans includes the designated appointment date in the first plan and the designated appointment date in at least one of the second plans, and the designated appointment time period in at least one of the third plans includes the designated appointment time period in at least one of the second plans;

[0038] A rule generation module is used to generate a firewall rule corresponding to at least one of the third plans.

[0039] In one aspect, the present application further provides an electronic device, the electronic device comprising:

[0040] one or more processors;

[0041] Memory; and

[0042] One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor to implement the above-mentioned method for generating firewall rules.

[0043] On the one hand, the present application also provides a computer-readable storage medium on which a computer program is stored, and the computer program is loaded by a processor to execute the steps in the above-mentioned method for generating firewall rules.

[0044] On the one hand, an embodiment of the present application provides a computer program product, including a computer program or instructions, where the computer program or instructions are executed by a processor to implement the method for generating firewall rules as described in any one of the above items.

[0045] The firewall rule generation method, system, device and storage medium provided in the embodiments of the present application combine the first plan and at least one second plan to obtain at least one third plan, and then generate corresponding firewall rules according to the at least one third plan, so that the number of appointment time plans for which firewall rules need to be generated is reduced. In this way, the number of generated firewall rules is also reduced, thereby avoiding performance degradation of the gateway device, excessive memory consumption, and increased difficulty in managing the firewall rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 It is a flowchart of an embodiment of a method for generating firewall rules provided in an embodiment of the present application;

[0048] Figure 2 It is a schematic diagram of an embodiment of a merging process of a first plan and at least one second plan provided in an embodiment of the present application;

[0049] Figure 3 is a schematic diagram of another embodiment of a merging process of a first plan and at least one second plan provided in an embodiment of the present application;

[0050] Figure 4 It is a schematic diagram of the structure of an embodiment of a system for generating firewall rules provided in an embodiment of the present application;

[0051] Figure 5 It is a schematic diagram of the structure of an embodiment of an electronic device provided in the embodiments of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0053] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0054] In this application, the term "in some embodiments" is used to mean "used as an example, illustration or description". Any embodiment described in this application as "some embodiments" is not necessarily to be construed as being more preferred or advantageous than other embodiments. In order to enable any technician in the field to implement and use the present application, the following description is given. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present application can be implemented without using these specific details. In other examples, well-known principles and processes will not be elaborated in detail to avoid obscuring the description of the present application with unnecessary details. Therefore, the present application is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0055] The embodiments of the present application provide a method, system, device and storage medium for generating firewall rules, which are described in detail below.

[0056] First, a method for generating firewall rules provided in an embodiment of the present application is introduced.

[0057] The method for generating firewall rules in the embodiment of the present application uses a generation system of firewall rules as an execution subject, and the generation system of firewall rules is set in an electronic device, and the electronic device can be a gateway device such as a router. For simplicity and convenience of description, the execution subject will be omitted in the subsequent method embodiments.

[0058] See also Figure 1 , Figure 1 The following is a flow chart of an embodiment of a method for generating firewall rules provided in an embodiment of the present application. The method for generating firewall rules includes:

[0059] 101. Obtain multiple appointment time plans of the firewall, each appointment time plan including a specified appointment time period under a specified appointment date.

[0060] In the embodiment of the present application, the firewall is set in the gateway device and supports the Schedule time reservation function. In order to realize the Schedule time reservation function, a reservation time schedule is set for the firewall, and the user can add a reservation time schedule in the reservation time schedule, so that the firewall can control the flow of data packets passing through the firewall in different time periods according to the reservation time schedule.

[0061] The appointment time plan refers to the plan of the time period during which the flow of data packets through the firewall needs to be controlled. The appointment time plan can be set by the user based on actual needs. For example, the user can set a plan that the flow of data packets through the firewall needs to be controlled from 9 am to 11 am every day, so that the firewall controls the flow of data packets through the firewall from 9 am to 11 am every day.

[0062] The designated appointment time period under the designated appointment date is the time period during which the flow of data packets passing through the firewall needs to be controlled. For example, the designated appointment date may be every day, and the designated appointment time period may be from 9 am to 11 am.

[0063] In some embodiments, each appointment time plan may also be associated with a data packet control strategy, so as to achieve adaptation to the corresponding application scenarios (such as bandwidth management, access control, secure access, etc.). Taking the application scenario of bandwidth management as an example, the corresponding data packet control strategy may be to limit the speed of data packets of a specific type (such as having a certain terminal device identifier), so that the data packets may be restricted in certain time periods to balance the network load and improve the overall network performance. Taking the application scenario of access control as an example, the corresponding data packet control strategy may be to prohibit or allow the transmission of data packets of a specific type (such as access to a specific network service, website, web page), so that access to certain network services may be closed in certain time periods, saving network bandwidth and network resources. Taking the application scenario of secure access as an example, the corresponding data packet control strategy may be to open or close a security access mechanism of a specific type (such as having a specific keyword, sensitive word), so that the security of network access may be improved in certain time periods to cope with potential security threats. Therefore, by associating the appointment time plan with the corresponding data packet control strategy, the firewall may execute the corresponding data packet control strategy on the data packets passing through the firewall according to the appointment time plan, so as to meet the network control requirements of the firewall in different application scenarios.

[0064] In some embodiments, obtaining multiple appointment time plans of the firewall may include: obtaining an appointment time plan table of the time appointment function of the firewall; determining a data packet control strategy for each plan in the appointment time plan table; in the appointment time plan table, using plans with the same data packet control strategy as multiple appointment time plans. It can be seen that the multiple appointment time plans of the firewall may have the same data packet control strategy, so as to facilitate the merging of different appointment time plans in step 103.

[0065] In a further embodiment, the user may modify the appointment time schedule based on actual needs, for example, a new schedule may be added, a schedule may be deleted, or a schedule may be adjusted in the appointment time schedule to modify the appointment time schedule. Since after the appointment time schedule is modified, different appointment time schedules in the appointment time schedule may be merged through the subsequent step 103, the method for generating firewall rules also includes: detecting whether the appointment time schedule has been modified; detecting that the appointment time schedule has been modified, executing the step of obtaining the appointment time schedule of the time reservation function of the firewall, so as to merge different appointment time schedules in the appointment time schedule using the subsequent step 103. Of course, step 101 and its subsequent steps may not be executed based on the timing of the appointment time schedule being modified, but may be executed regularly, which is not limited here.

[0066] 102. Determine a first plan and at least one second plan among multiple appointment time plans.

[0067] In the embodiment of the present application, the first plan is an appointment time plan, and the second plan is also an appointment time plan. Therefore, the first plan may include a specified appointment time period under a specified appointment date, and the second plan may also include a specified appointment time period under a specified appointment date. It should be noted that the specified appointment date in the first plan is different from the specified appointment date in the second plan, and / or the specified appointment time period in the first plan is different from the specified appointment time period in the second plan.

[0068] The designated reservation time period in the first plan is taken as a first time set, and the designated reservation time period in each second plan is taken as a second time set. The determined first plan and at least one second plan need to satisfy the following preset condition: the union of the second time sets in at least one second plan is the first time set, so that the first plan and at least one second plan are merged according to the same time period in the designated reservation time period in step 103.

[0069] In some embodiments, determining a first plan and at least one second plan from among multiple appointment time plans may include: from among the multiple appointment time plans, taking each appointment time plan in turn as a plan to be tested, and taking a specified appointment time period in the plan to be tested as a time set to be tested; determining at least one target plan from among the multiple appointment time plans, wherein the specified appointment time period in each target plan is taken as a target set, and each target set is a subset of the time set to be tested, that is, the specified appointment time period in each target plan is included in the specified appointment time period in the plan to be tested; if the union of the target sets in at least one target plan is the time set to be tested, taking the plan to be tested as the first plan, and taking at least one target plan as at least one second plan, so that the above-mentioned preset conditions can be met between the determined first plan and the at least one second plan.

[0070] 103. Merge the first plan and at least one second plan to obtain at least one third plan.

[0071] In an embodiment of the present application, the merging of the first plan and at least one second plan is implemented based on network services such as iptables. Taking iptables as an example, iptables is an IP data packet filtering system, so a firewall can be established based on iptables. The "-m time module" in iptables has the following characteristics: multiple reservation date parameters can be configured for the same reservation time period to indicate that this firewall rule is effective in the same reservation time period under different reservation dates. For example, the firewall rule that takes effect from 9:40 to 9:59 from Monday to Friday can be:

[0072] iptables-I FORWARD-s 172.17.1.132-d 192.168.1.119-m time--timestart09:40--timestop 09:59--weekdays 1,2,3,4,5-j DROP

[0073] Therefore, based on this feature, the first plan and at least one second plan can be merged according to the same reservation time period and different reservation dates to obtain at least one third plan.

[0074] In some embodiments, the merging of the first plan and at least one second plan can be specifically divided into a variety of different merging scenarios, such as only one second plan among multiple appointment time plans, multiple second plans among multiple appointment time plans, and the like.

[0075] Taking the example that there is only one second plan among multiple appointment time plans, merging the first plan and at least one second plan to obtain at least one third plan may include: if there is only one second plan among multiple appointment time plans, merging the specified appointment date in the first plan and the specified appointment date in the second plan to obtain a specified appointment date in the third plan, that is, the specified appointment date in the third plan includes both the specified appointment date in the first plan and the specified appointment date in the second plan; using the specified appointment time period in the second plan as the specified appointment time period in the third plan; and generating a third plan using the specified appointment date and the specified appointment time period in the third plan. It can be seen that if there is only one second plan among multiple appointment time plans, only one third plan is generated. For example Figure 2 As shown in , the specified appointment time period for the specified appointment date in the first plan can be from 0:30 to 3:00 every Tuesday, and the specified appointment time period for the specified appointment date in the second plan can be from 0:30 to 3:00 every Wednesday. Then, the specified appointment time period for the specified appointment date in the combined third plan can be from 0:30 to 3:00 every Tuesday and Wednesday.

[0076] Taking the case where there are multiple second plans in multiple appointment time plans as an example, merging the first plan and at least one second plan to obtain at least one third plan may include: if there are multiple second plans in multiple appointment time plans, and the designated appointment time periods in the multiple second plans are the same, then merging the designated appointment date in the first plan and the designated appointment dates in the multiple second plans to obtain a designated appointment date in the third plan, that is, the designated appointment date in the third plan includes both the designated appointment date in the first plan and the designated appointment dates in the multiple second plans; since the designated appointment time periods in the multiple second plans are the same, the designated appointment time period in any second plan can be used as the designated appointment time period in the third plan; using the designated appointment date and designated appointment time period in a third plan to generate a third plan. It can be seen that if there are multiple second plans in multiple appointment time plans, but the designated appointment time periods in the multiple second plans are the same, only one third plan is generated. For example Figure 2 As shown in , the specified appointment time period for the specified appointment date in the first plan can be from 0:30 to 3:00 every Tuesday, the specified appointment time period for the specified appointment date in the second plan can be from 0:30 to 3:00 every Wednesday, and the specified appointment time period for the specified appointment date in another second plan can be from 0:30 to 3:00 every Thursday. Then, the specified appointment time period for the specified appointment date in the combined third plan can be from 0:30 to 3:00 every Tuesday, Wednesday and Thursday.

[0077] Taking the case where there are multiple second plans in multiple appointment time plans as an example, merging the first plan and at least one second plan to obtain at least one third plan may include: if there are multiple second plans in multiple appointment time plans, and the designated appointment time periods in the multiple second plans are different, then for each second plan, merging the designated appointment date in the first plan and the designated appointment date in the second plan to obtain a designated appointment date in the third plan, thereby obtaining the designated appointment dates in the multiple third plans; for each second plan, using the designated appointment time period in the second plan as the designated appointment time period in the third plan, thereby obtaining the designated appointment time period in the multiple third plans; using the designated appointment dates and designated appointment time periods in the multiple third plans to generate multiple third plans respectively. It can be seen that if there are multiple second plans in multiple appointment time plans, but the designated appointment time periods in the multiple second plans are different, multiple third plans are generated. For example Figure 3 As shown in, the specified appointment time period for the specified appointment date in the first plan can be from 0:30 to 3:00 every Tuesday, the specified appointment time period for the specified appointment date in the second plan can be from 1:30 to 3:00 every Wednesday, and the specified appointment time period for the specified appointment date in the other second plan can be from 0:30 to 2:00 every Thursday. Then two third plans can be merged (the specified appointment time period for the specified appointment date in one third plan can be from 1:30 to 3:00 every Tuesday and Wednesday, and the specified appointment time period for the specified appointment date in the other third plan can be from 0:30 to 2:00 every Tuesday and Thursday).

[0078] from Figure 3 It can be seen that when there are multiple second plans in the multiple appointment time plans, but the designated appointment time periods in the multiple second plans are different, the designated appointment time period in the first plan is divided to obtain multiple segments of the designated appointment time period (for example Figure 3 Then, the segments of different specified appointment time periods and the specified appointment dates in the first plan are merged with different second plans to obtain a third plan, thereby "internalizing" the first plan in multiple second plans, thereby reducing the number of appointment time plans that need to generate firewall rules.

[0079] It can also be seen from the above embodiments that in the above-mentioned various merging scenarios, the first plan is "internally digested", and since the number of the third plans obtained by the merger is less than or equal to the number of the second plans, the number of appointment time plans that ultimately need to generate firewall rules will be reduced.

[0080] 104. Generate a firewall rule corresponding to at least one third plan.

[0081] In the embodiment of the present application, a firewall rule is generated for each third plan, so that the firewall controls the flow of data packets passing through the firewall according to the generated firewall rule.

[0082] For example, if the designated appointment time period under the designated appointment date in the third plan is from 0:30 to 3:00 every Tuesday and Wednesday, the corresponding firewall rules can be:

[0083] iptables -I FORWARD -s 172.17.1.132-d 192.168.1.119-m time--timestart00:30--timestop 03:00--weekdays 2,3-j DROP

[0084] For example, the designated appointment time period under the designated appointment date in the third plan is from 0:30 to 3:00 every Tuesday, Wednesday, and Thursday. The corresponding firewall rules can be:

[0085] iptables -I FORWARD -s 172.17.1.132-d 192.168.1.119-m time--timestart00:30--timestop 03:00--weekdays 2,3,4-j DROP

[0086] For example, if the designated appointment time period under the designated appointment date in the third plan is from 1:30 to 3:00 every Tuesday and Wednesday, the corresponding firewall rules can be:

[0087] iptables -I FORWARD -s 172.17.1.132-d 192.168.1.119-m time--timestart01:30--timestop 03:00--weekdays 2,3-j DROP

[0088] For example, if the designated appointment time period under the designated appointment date in the third plan is from 0:30 to 2:00 every Tuesday and Thursday, the corresponding firewall rules can be:

[0089] iptables -I FORWARD -s 172.17.1.132-d 192.168.1.119-m time--timestart00:30--timestop 02:00--weekdays 2,4-j DROP

[0090] In some embodiments, since the first plan and the second plan are both associated with the same data packet control policy, the third plan obtained by merging the first plan and the second plan can also be associated with the data packet control policy, so that the firewall can execute the corresponding data packet control policy on the data packets passing through the firewall according to the generated firewall rules.

[0091] It can be seen from the above embodiments that the method for generating firewall rules provided in the embodiments of the present application, by merging the first plan and at least one second plan, obtains at least one third plan, and then generates corresponding firewall rules according to the at least one third plan, without generating corresponding firewall rules according to the first plan and / or the second plan, so that the number of appointment time plans for which firewall rules need to be generated is reduced. In this way, the number of generated firewall rules will also be reduced, thereby avoiding performance degradation of the gateway device, excessive memory consumption, and increased difficulty in managing firewall rules.

[0092] In order to better implement the method for generating firewall rules in the embodiment of the present application, based on the method for generating firewall rules, the embodiment of the present application also provides a system for generating firewall rules, such as Figure 4 As shown, the firewall rule generation system 400 includes:

[0093] The plan acquisition module 401 is used to acquire multiple appointment time plans of the firewall, each appointment time plan includes a specified appointment time period under a specified appointment date;

[0094] The plan determination module 402 is used to determine a first plan and at least one second plan from the multiple appointment time plans, wherein the appointment time period specified in the first plan is used as a first time set, the appointment time period specified in each second plan is used as a second time set, and the union of the second time sets in the at least one second plan is used as the first time set;

[0095] The plan merging module 403 is used to merge the first plan and the at least one second plan to obtain at least one third plan, wherein the designated appointment date in the at least one third plan includes the designated appointment date in the first plan and the designated appointment date in the at least one second plan, and the designated appointment time period in the at least one third plan includes the designated appointment time period in the at least one second plan;

[0096] The rule generation module 404 is used to generate a firewall rule corresponding to at least one third plan.

[0097] The firewall rule generation system provided in the embodiment of the present application combines the first plan and at least one second plan to obtain at least one third plan, and then generates corresponding firewall rules according to the at least one third plan, so that the number of appointment time plans for which firewall rules need to be generated is reduced. In this way, the number of generated firewall rules will also be reduced, thereby avoiding performance degradation of gateway devices, excessive memory consumption, and increased difficulty in managing firewall rules.

[0098] In some embodiments, the plan determination module 402 is further configured to:

[0099] In the multiple appointment time plans, each appointment time plan is sequentially used as a plan to be tested, and the appointment time period specified in the plan to be tested is used as a set of time to be tested;

[0100] Determine at least one target plan from the multiple appointment time plans, wherein the appointment time period specified in each target plan is taken as a target set, and each target set is a subset of the time set to be detected;

[0101] If the union of the target sets in at least one target plan is a time set to be detected, the plan to be detected is used as the first plan, and the at least one target plan is used as at least one second plan.

[0102] In some embodiments, the plan merging module 403 is further configured to:

[0103] If there is only one second plan among the multiple appointment time plans, the designated appointment date in the first plan and the designated appointment date in the second plan are merged to obtain a designated appointment date in the third plan;

[0104] Using the designated appointment time period in the second plan as a designated appointment time period in the third plan;

[0105] A third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

[0106] In some embodiments, the plan merging module 403 is further configured to:

[0107] If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are the same, then the designated appointment date in the first plan and the designated appointment dates in the multiple second plans are merged to obtain a designated appointment date in the third plan;

[0108] Using any designated appointment time period in the second plan as a designated appointment time period in the third plan;

[0109] A third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

[0110] In some embodiments, the plan merging module 403 is further configured to:

[0111] If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are different, then for each second plan, the designated appointment date in the first plan and the designated appointment date in the second plan are merged to obtain a designated appointment date in a third plan, thereby obtaining multiple designated appointment dates in the third plans;

[0112] For each second plan, use the designated appointment time period in the second plan as a designated appointment time period in a third plan, thereby obtaining a plurality of designated appointment time periods in the third plan;

[0113] A plurality of third plans are generated respectively by using the designated reservation dates and the designated reservation time periods in the plurality of third plans.

[0114] In some embodiments, the plan acquisition module 401 is further used to:

[0115] Get the appointment time schedule of the time appointment function of the firewall;

[0116] Determine the data packet control strategy for each plan in the appointment time schedule;

[0117] In the appointment time schedule table, plans with the same data packet control strategy are treated as multiple appointment time plans.

[0118] In some embodiments, the plan acquisition module 401 is further used to:

[0119] Check whether the appointment schedule has been modified;

[0120] It is detected that the reservation time schedule is modified, and the step of obtaining the reservation time schedule of the time reservation function of the firewall is executed.

[0121] In addition to the above-described method and system for generating firewall rules, an embodiment of the present application further provides an electronic device, which integrates any one of the firewall rule generation systems provided in the embodiments of the present application, and the electronic device includes:

[0122] one or more processors;

[0123] Memory; and

[0124] One or more applications, wherein the one or more applications are stored in a memory and are configured to execute the steps of any embodiment of the method for generating firewall rules by a processor.

[0125] The present application also provides an electronic device that integrates any one of the firewall rule generation systems provided in the present application. Figure 5 As shown, it shows a schematic diagram of the structure of the electronic device involved in the embodiment of the present application, specifically:

[0126] The electronic device may include components such as a processor 501 with one or more processing cores, a storage unit 502 with one or more computer-readable storage media, a power supply 503, and an input unit 504. Those skilled in the art will appreciate that Figure 5 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0127] The processor 501 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the storage unit 502 and calling data stored in the storage unit 502, it executes various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. Optionally, the processor 501 may include one or more processing cores; preferably, the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501.

[0128] The storage unit 502 can be used to store software programs and modules. The processor 501 executes various functional applications and data processing by running the software programs and modules stored in the storage unit 502. The storage unit 502 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the storage unit 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the storage unit 502 may also include a memory controller to provide the processor 501 with access to the storage unit 502.

[0129] The electronic device also includes a power supply 503 for supplying power to each component. Preferably, the power supply 503 can be logically connected to the processor 501 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 503 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0130] The electronic device may further include an input unit 504, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0131] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically, in the embodiment of the present application, the processor 501 in the electronic device will load the executable file corresponding to the process of one or more application programs into the storage unit 502 according to the following instructions, and the processor 501 will run the application program stored in the storage unit 502, thereby realizing various functions, as follows:

[0132] Acquire multiple appointment time plans of a firewall, each appointment time plan includes a specified appointment time period under a specified appointment date; determine a first plan and at least one second plan from the multiple appointment time plans, wherein the specified appointment time period in the first plan is taken as a first time set, the specified appointment time period in each second plan is taken as a second time set, and the union of the second time sets in at least one second plan is the first time set; merge the first plan and at least one second plan to obtain at least one third plan, wherein the specified appointment date in at least one third plan includes the specified appointment date in the first plan and the specified appointment date in at least one second plan, and the specified appointment time period in at least one third plan includes the specified appointment time period in at least one second plan; generate a firewall rule corresponding to the at least one third plan.

[0133] To this end, an embodiment of the present application provides a computer-readable storage medium, which may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. The computer-readable storage medium stores a plurality of instructions, which can be loaded by a processor to execute the steps in any method for generating firewall rules provided in an embodiment of the present application. For example, the instruction can execute the following steps:

[0134] Acquire multiple appointment time plans of a firewall, each appointment time plan includes a specified appointment time period under a specified appointment date; determine a first plan and at least one second plan from the multiple appointment time plans, wherein the specified appointment time period in the first plan is taken as a first time set, the specified appointment time period in each second plan is taken as a second time set, and the union of the second time sets in at least one second plan is the first time set; merge the first plan and at least one second plan to obtain at least one third plan, wherein the specified appointment date in at least one third plan includes the specified appointment date in the first plan and the specified appointment date in at least one second plan, and the specified appointment time period in at least one third plan includes the specified appointment time period in at least one second plan; generate a firewall rule corresponding to the at least one third plan.

[0135] In addition, an embodiment of the present application further provides a computer program product or a computer program, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes to implement the method for generating firewall rules as described in any one of the above items, for example:

[0136] Acquire multiple appointment time plans of a firewall, each appointment time plan includes a specified appointment time period under a specified appointment date; determine a first plan and at least one second plan from the multiple appointment time plans, wherein the specified appointment time period in the first plan is taken as a first time set, the specified appointment time period in each second plan is taken as a second time set, and the union of the second time sets in at least one second plan is the first time set; merge the first plan and at least one second plan to obtain at least one third plan, wherein the specified appointment date in at least one third plan includes the specified appointment date in the first plan and the specified appointment date in at least one second plan, and the specified appointment time period in at least one third plan includes the specified appointment time period in at least one second plan; generate a firewall rule corresponding to the at least one third plan.

[0137] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0138] The above is a detailed introduction to a method, system, device and storage medium for generating firewall rules provided in an embodiment of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. A method for generating firewall rules, characterized in that: The method for generating the firewall rule comprises: Acquire multiple appointment time plans of the firewall, each of which includes a specified appointment time period under a specified appointment date; Determine a first plan and at least one second plan from the plurality of appointment time plans, wherein the designated appointment time period in the first plan is taken as a first time set, the designated appointment time period in each of the second plans is taken as a second time set, and the union of the second time sets in at least one of the second plans is taken as the first time set; Merging the first plan and at least one of the second plans to obtain at least one third plan, wherein the designated appointment date in at least one of the third plans includes the designated appointment date in the first plan and the designated appointment date in at least one of the second plans, and the designated appointment time period in at least one of the third plans includes the designated appointment time period in at least one of the second plans; A firewall rule corresponding to at least one of the third plans is generated.

2. The method for generating firewall rules according to claim 1, characterized in that: Determining a first plan and at least one second plan from among the plurality of appointment time plans comprises: Among the plurality of appointment time plans, each of the appointment time plans is sequentially used as a plan to be tested, and the designated appointment time period in the plan to be tested is used as a time set to be tested; Determine at least one target plan from the plurality of appointment time plans, wherein the designated appointment time period in each target plan is taken as a target set, and each target set is a subset of the time set to be detected; If the union of the target sets in at least one of the target plans is the time set to be detected, the plan to be detected is used as the first plan, and at least one of the target plans is used as at least one of the second plans.

3. The method for generating firewall rules according to claim 1, characterized in that: The step of merging the first plan and at least one of the second plans to obtain at least one third plan includes: If there is only one second plan among the multiple appointment time plans, the designated appointment date in the first plan and the designated appointment date in the second plan are combined to obtain the designated appointment date in the third plan; Using the designated appointment time period in the second plan as the designated appointment time period in the third plan; The third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

4. The method for generating firewall rules according to claim 1, characterized in that: The step of merging the first plan and at least one of the second plans to obtain at least one third plan includes: If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are the same, then the designated appointment date in the first plan and the designated appointment dates in the multiple second plans are merged to obtain the designated appointment date in the third plan; Using the designated appointment time period in any of the second plans as the designated appointment time period in the third plan; The third plan is generated by using the designated reservation date and the designated reservation time period in the third plan.

5. The method for generating firewall rules according to claim 1, characterized in that: The step of merging the first plan and at least one of the second plans to obtain at least one third plan includes: If there are multiple second plans in the multiple appointment time plans, and the designated appointment time periods in the multiple second plans are different, then for each of the second plans, the designated appointment date in the first plan and the designated appointment date in the second plan are merged to obtain the designated appointment date in one third plan, thereby obtaining the designated appointment dates in multiple third plans; For each of the second plans, taking the designated reservation time period in the second plan as the designated reservation time period in one of the third plans, thereby obtaining a plurality of designated reservation time periods in the third plans; A plurality of the third plans are generated respectively by using the designated reservation dates and the designated reservation time periods in the plurality of the third plans.

6. The method for generating firewall rules according to any one of claims 1 to 5, characterized in that: The method of obtaining multiple appointment time plans of the firewall includes: Obtaining a reservation time schedule for a time reservation function of the firewall; Determining a data packet control strategy for each plan in the appointment time schedule; In the reservation time schedule table, plans with the same data packet control strategy are taken as a plurality of reservation time plans.

7. The method for generating firewall rules according to claim 6, characterized in that: The method for generating the firewall rules also includes: Detecting whether the appointment time schedule has been modified; It is detected that the reservation time schedule is modified, and the step of obtaining the reservation time schedule of the time reservation function of the firewall is performed.

8. A system for generating firewall rules, characterized in that: The firewall rule generation system includes: A plan acquisition module, used to acquire multiple appointment time plans of the firewall, each of which includes a specified appointment time period under a specified appointment date; A plan determination module, configured to determine a first plan and at least one second plan from the plurality of appointment time plans, wherein the designated appointment time period in the first plan is taken as a first time set, the designated appointment time period in each of the second plans is taken as a second time set, and the union of the second time sets in at least one of the second plans is taken as the first time set; a plan merging module, configured to merge the first plan and at least one of the second plans to obtain at least one third plan, wherein the designated appointment date in at least one of the third plans includes the designated appointment date in the first plan and the designated appointment date in at least one of the second plans, and the designated appointment time period in at least one of the third plans includes the designated appointment time period in at least one of the second plans; A rule generation module is used to generate a firewall rule corresponding to at least one of the third plans.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; Memory; and One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor to implement the method for generating firewall rules according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in the method for generating firewall rules according to any one of claims 1 to 7.

Images