New site grid connection scheme generation strategy configuration method based on user-defined template

Abstract

The invention relates to the technical field of grid-connected scheme generation, in particular to a new site grid-connected scheme generation strategy configuration method based on a custom template, which comprises the following steps: customizing a template of a grid-connected scheme according to the office network and data center type of a site through a graphical interface; the name of a site, the IP range of equipment and resources needing to be opened and accessed are input; and according to an IP allocation rule defined in the template, IP address pre-allocation and conflict detection are carried out on the site equipment. According to the method, a template of a grid-connected scheme is defined in advance, subsequent contents such as a security policy and an execution script can be automatically generated only by configuring two key information of an IP range and an appointed access resource, and meanwhile, the possible mismatching problem can be timely found and corrected by automatically checking the generated policy and the scheme, so that the security and protection of the grid-connected system is greatly improved. Compared with the traditional technology in the background technology, the method can effectively improve the configuration efficiency and ensure the strategy consistency.

Description

Technical Field

[0001] The present invention relates to the technical field of grid connection scheme generation, and in particular to a new site grid connection scheme generation strategy configuration method based on a custom template. Background Art

[0002] Configuring network security strategies often requires setting up multiple aspects separately. You need to manually determine the IP range first, then set up accessible resources one by one according to different business needs, and then write security strategies and execute scripts separately. This is a complex and time-consuming process involving multiple different operation links and systems.

[0003] In the existing technology, the network administrator first adds network security devices such as switches and firewalls at the station end, and then defines access policies on the network devices to determine which IP addresses or network segments can access specific destination resources, and which network services (such as HTTP, FTP, etc.) are allowed or prohibited. This is relatively basic and manual, lacking the flexibility and automation of custom text templates. It requires administrators to have an in-depth understanding of the command line operations of network devices, and when faced with complex network requirements, the configuration process may become cumbersome and error-prone.

[0004] Based on this, the present invention provides a new site grid connection solution generation strategy configuration method based on a custom template to solve the above-mentioned technical problems. Summary of the invention

[0005] The purpose of the present invention is to provide a new site grid connection solution generation strategy configuration method based on a custom template to solve the problems raised by the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A new site grid connection solution generation strategy configuration method based on a custom template is provided, including the following steps:

[0008] S1. Customize the grid connection solution template based on the site's office network and data center type through a graphical interface;

[0009] S2. Enter the site name, device IP range, and resources that need to be accessible;

[0010] S3. Pre-allocate IP addresses for site devices according to the IP allocation rules defined in the template and perform conflict detection;

[0011] S4. Generate security policy rules based on the pre-allocated IP addresses and the resources that need to be opened at the site, and display them in the format of the template;

[0012] S5. Adapt and generate executable policy scripts according to the device type and the policy to be activated;

[0013] S6. Use the object comparison algorithm to check whether the generated strategy is complete and perform necessary optimization;

[0014] S7. Send the generated policy script to the specified network device and verify the successful sending;

[0015] S8. Retrieve basic information and configuration data of mining equipment, and archive and update them;

[0016] S9. Provide a visual interface to display information such as the configured network topology, policy distribution, and device status, and collect user feedback on the configuration effect.

[0017] Preferably, the implementation steps of step S1 are:

[0018] S1.1. The user selects a template that matches the site office network or data center type from the preset template library as the basis, including enterprise branches and data centers;

[0019] S1.2. Set the start and end range of the IP address segment, as well as the subnet mask, define static IP allocation rules or dynamic DHCP allocation policies, and specify the IP allocation priority of the server or switch device type;

[0020] S1.3. Define the basic framework of security policies, including access control lists (ACLs), firewall rules, and set policy priorities and conflict resolution mechanisms;

[0021] S1.4. Determine which devices require remote access permissions, as well as SSH and HTTPS access methods, and set the format of the policy file, including XML and JSON, for subsequent automated processing;

[0022] S1.5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the equipment ledger, including fields for equipment name, model, serial number, and IP address;

[0023] S1.6. Check the completeness of the template settings to ensure that no items are missing, apply the template settings, and generate the initialized configuration files and policy framework.

[0024] Preferably, the implementation steps of step S2 are:

[0025] S2.1. Enter the basic information of the site name, geographical location, and network type into the system;

[0026] S2.2. According to the site scale and network planning, enter the starting and ending range of the device IP address and confirm that the IP range does not conflict with the existing network;

[0027] S2.3. Select the external or internal resources that the site needs to access from the resource list, including databases and servers, and specify the read-only, read-write permission level for accessing the resources;

[0028] S2.4. The system automatically saves the entered data and performs data verification to ensure the accuracy and completeness of the information.

[0029] Preferably, the implementation steps of step S3 are:

[0030] S3.1. Load IP allocation rules from the template;

[0031] S3.2. According to the device type and priority, assign an IP address to each device, record the assignment results, and generate an IP address assignment table;

[0032] S3.3. Compare the pre-assigned IP address with the IP address in the existing network to check if there is a conflict. If there is a conflict, automatically adjust the IP allocation or prompt the user to adjust it manually;

[0033] S3.4. Summarize the conflict detection results, including conflicting devices, IP addresses and suggested solutions, and provide them to users for reference so that they can make necessary adjustments.

[0034] Preferably, the implementation steps of step S4 are:

[0035] S4.1. Obtain the pre-assigned IP and site resource requirements of the device from the previous step;

[0036] S4.2. Generate corresponding security policy rules for each device based on resource access requirements. The rules include resources allowed / denied access, time range, and protocol type;

[0037] S4.3. Convert the policy rules into a readable text or configuration file format according to the format defined in the template;

[0038] S4.4. Display the generated policy rules in a graphical interface for users to review and confirm, and provide editing functions to allow users to make fine adjustments as needed.

[0039] Preferably, the implementation steps of step S5 are:

[0040] S5.1. Read the device inventory and identify the type of each device (including Cisco routers and Huawei firewalls);

[0041] S5.2. Select the corresponding policy script template from the script library according to the device type;

[0042] S5.3. Fill the previously generated security policy rules into the script template, and adjust the parameters and commands in the script according to the device characteristics;

[0043] S5.4. Compile the script to generate a policy configuration script that can be executed on the target device, and perform syntax checking to ensure that the script is correct;

[0044] S5.5. Save the generated script file to a specified location for subsequent distribution and use.

[0045] Preferably, the implementation steps of step S6 are:

[0046] S6.1. Read the generated strategy file and load it into the comparison algorithm;

[0047] S6.2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for any missing or incorrect configurations;

[0048] S6.3. Summarize the comparison results and generate a detailed comparison report, which points out the inconsistencies and provides optimization suggestions;

[0049] S6.4. Make necessary adjustments and optimizations to the strategy based on the comparison report to ensure its consistency and accuracy.

[0050] Preferably, the implementation steps of step S7 are:

[0051] S7.1. Select SSH, Telnet or SNMP delivery channel and configure connection parameters;

[0052] S7.2. Send the policy script to the target device through the selected delivery channel, monitor the delivery process, and ensure that the script is successfully transmitted;

[0053] S7.3. Log in to the target device, check whether the policy has been successfully loaded and is effective, and use commands or tools to verify the correctness of the policy configuration;

[0054] S7.4. Summarize the distribution results and generate a distribution report, which includes the distribution time, device name, distribution status and possible error information.

[0055] Preferably, the implementation steps of step S8 are:

[0056] S8.1. Set up the mining task in the system, specify the equipment, data items and mining cycle to be mined;

[0057] S8.2. Collect basic information and configuration data from the device through the network or API interface, including device status, IP address, and configuration parameters;

[0058] S8.3. Archive the collected data into a database or file system and organize the data to ensure the accuracy and readability of the data;

[0059] S8.4. Update the relevant information in the equipment ledger based on the recovered data to ensure that the equipment ledger is consistent with the actual situation.

[0060] Preferably, the implementation steps of step S9 are:

[0061] S9.1. Use graphical tools to design intuitive network topology maps, policy distribution maps, and device status panels;

[0062] S9.2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation;

[0063] S9.3. Display the distribution of security policies in the form of a chart or list, including which devices are applied to which policies;

[0064] S9.4. Update device status information in real time, including online / offline, CPU usage, and memory usage;

[0065] S9.5. Provide a feedback portal to allow users to submit their opinions and suggestions on configuration effects, and regularly organize user feedback to improve system functions and performance.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] The present invention predefines a template for the grid connection solution, and only needs to configure two key information, namely, the IP range and the specified access resources, to automatically generate subsequent contents such as security strategies and execution scripts. At the same time, by automatically verifying the generated strategies and solutions, possible mismatch problems can be discovered and corrected in a timely manner. In summary, the present invention can effectively improve configuration efficiency and ensure strategy consistency compared with traditional technologies in the background technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 The present invention is a flow chart of a new site grid connection solution generation strategy configuration method based on a custom template. DETAILED DESCRIPTION

[0069] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0070] Example:

[0071] See also Figure 1 The present invention proposes a method for configuring a new site grid connection solution generation strategy based on a custom template, specifically, comprising the following steps:

[0072] S1. Customize the grid connection solution template based on the site's office network and data center type through a graphical interface;

[0073] Specifically, the implementation steps of step S1 are:

[0074] S1.1. The user selects a template that matches the site office network or data center type from the preset template library as the basis, including enterprise branches and data centers;

[0075] S1.2. Set the start and end range of the IP address segment, as well as the subnet mask, define static IP allocation rules or dynamic DHCP allocation policies, and specify the IP allocation priority of the server or switch device type;

[0076] S1.3. Define the basic framework of security policies, including access control lists (ACLs), firewall rules, and set policy priorities and conflict resolution mechanisms;

[0077] S1.4. Determine which devices require remote access permissions, as well as SSH and HTTPS access methods, and set the format of the policy file, including XML and JSON, for subsequent automated processing;

[0078] S1.5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the equipment ledger, including fields for equipment name, model, serial number, and IP address;

[0079] S1.6. Check the integrity of the template settings to ensure that there are no missing items, apply the template settings, and generate the initialization configuration file and policy framework;

[0080] Through this step, define basic information such as IP allocation rules, policy generation rules, security device access and policy format, device type, and device ledger format of site equipment. At the same time, initialize the template to ensure the smooth progress of subsequent steps.

[0081] S2. Enter the site name, device IP range, and resources that need to be accessible;

[0082] Specifically, the implementation steps of step S2 are:

[0083] S2.1. Enter the basic information of the site name, geographical location, and network type into the system;

[0084] S2.2. According to the site scale and network planning, enter the starting and ending range of the device IP address and confirm that the IP range does not conflict with the existing network;

[0085] S2.3. Select the external or internal resources that the site needs to access from the resource list, including databases and servers, and specify the read-only, read-write permission level for accessing the resources;

[0086] S2.4. The system automatically saves the entered data and performs data verification to ensure the accuracy and completeness of the information;

[0087] This step provides basic data support for subsequent configuration;

[0088] S3. Pre-allocate IP addresses for site devices according to the IP allocation rules defined in the template and perform conflict detection;

[0089] Specifically, the implementation steps of step S3 are:

[0090] S3.1. Load IP allocation rules from the template;

[0091] S3.2. According to the device type and priority, assign an IP address to each device, record the assignment results, and generate an IP address assignment table;

[0092] S3.3. Compare the pre-assigned IP address with the IP address in the existing network to check if there is a conflict. If there is a conflict, automatically adjust the IP allocation or prompt the user to adjust it manually;

[0093] S3.4. Summarize the conflict detection results, including conflicting devices, IP addresses and suggested solutions, and provide them to users for reference so that they can make necessary adjustments;

[0094] This step ensures that the assigned IP addresses do not conflict, thus improving the accuracy and efficiency of configuration;

[0095] S4. Generate security policy rules based on the pre-allocated IP addresses and the resources that need to be opened at the site, and display them in the format of the template;

[0096] Specifically, the implementation steps of step S4 are:

[0097] S4.1. Obtain the pre-assigned IP and site resource requirements of the device from the previous step;

[0098] S4.2. Generate corresponding security policy rules for each device based on resource access requirements. The rules include resources allowed / denied access, time range, and protocol type;

[0099] S4.3. Convert the policy rules into a readable text or configuration file format according to the format defined in the template;

[0100] S4.4. Display the generated policy rules in a graphical interface for users to view and confirm, and provide editing functions to allow users to make fine adjustments as needed;

[0101] Through this step, policy rules are generated, manual operations are reduced, and configuration efficiency is improved;

[0102] S5. Adapt and generate executable policy scripts according to the device type and the policy to be activated;

[0103] Specifically, the implementation steps of step S5 are:

[0104] S5.1. Read the device inventory and identify the type of each device (including Cisco routers and Huawei firewalls);

[0105] S5.2. Select the corresponding policy script template from the script library according to the device type;

[0106] S5.3. Fill the previously generated security policy rules into the script template, and adjust the parameters and commands in the script according to the device characteristics;

[0107] S5.4. Compile the script to generate a policy configuration script that can be executed on the target device, and perform syntax checking to ensure that the script is correct;

[0108] S5.5. Save the generated script file to a specified location for subsequent distribution and use;

[0109] This step ensures that the policy script matches the device type, improving the script's compatibility and execution efficiency.

[0110] S6. Use the object comparison algorithm to check whether the generated strategy is complete and perform necessary optimization;

[0111] Specifically, the implementation steps of step S6 are:

[0112] S6.1. Read the generated strategy file and load it into the comparison algorithm;

[0113] S6.2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for any missing or incorrect configurations;

[0114] S6.3. Summarize the comparison results and generate a detailed comparison report, which points out the inconsistencies and provides optimization suggestions;

[0115] S6.4. Make necessary adjustments and optimizations to the strategy based on the comparison report to ensure the consistency and accuracy of the strategy;

[0116] Through this step, we can ensure the consistency and accuracy of the strategy and timely discover and correct any problems that may exist;

[0117] S7. Send the generated policy script to the specified network device and verify the successful sending;

[0118] Specifically, the implementation steps of step S7 are:

[0119] S7.1. Select SSH, Telnet or SNMP delivery channel and configure connection parameters;

[0120] S7.2. Send the policy script to the target device through the selected delivery channel, monitor the delivery process, and ensure that the script is successfully transmitted;

[0121] S7.3. Log in to the target device, check whether the policy has been successfully loaded and is effective, and use commands or tools to verify the correctness of the policy configuration;

[0122] S7.4. Summarize the distribution results and generate a distribution report, which includes the distribution time, device name, distribution status and possible error information;

[0123] This step ensures that the policy script can be correctly delivered to the device, improving the reliability of the configuration.

[0124] S8. Retrieve basic information and configuration data of mining equipment, and archive and update them;

[0125] Specifically, the implementation steps of step S8 are:

[0126] S8.1. Set up the mining task in the system, specify the equipment, data items and mining cycle to be mined;

[0127] S8.2. Collect basic information and configuration data from the device through the network or API interface, including device status, IP address, and configuration parameters;

[0128] S8.3. Archive the collected data into a database or file system and organize the data to ensure the accuracy and readability of the data;

[0129] S8.4. Update the relevant information in the equipment ledger based on the recovered data to ensure that the equipment ledger is consistent with the actual situation;

[0130] Through this step, the digital management of equipment records is realized to ensure timely and accurate recording of equipment information;

[0131] S9. Provide a visual interface to display the configured network topology, policy distribution, device status and other information, and collect user feedback on the configuration effect;

[0132] Specifically, the implementation steps of step S9 are:

[0133] S9.1. Use graphical tools to design intuitive network topology maps, policy distribution maps, and device status panels;

[0134] S9.2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation;

[0135] S9.3. Display the distribution of security policies in the form of a chart or list, including which devices are applied to which policies;

[0136] S9.4. Update device status information in real time, including online / offline, CPU usage, and memory usage;

[0137] S9.5. Provide a feedback portal to allow users to submit comments and suggestions on configuration effects, and regularly organize user feedback to improve system functions and performance;

[0138] This step allows network administrators to intuitively understand the configuration effect, discover and solve problems in a timely manner, and continuously optimize functions and performance through user feedback.

[0139] In summary, through steps S1 to S9, the present invention predefines the template of the grid connection plan, and only needs to configure the two key information of IP range and specified access resources, so as to automatically generate security strategies, execution scripts and other subsequent contents. At the same time, by automatically verifying the generated strategies and plans, possible mismatch problems can be discovered and corrected in time.

[0140] In summary, compared with the traditional technology in the background art, the present invention can effectively improve the configuration efficiency and ensure the consistency of the policy.

[0141] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0142] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for configuring a new site grid connection plan generation strategy based on a custom template, characterized in that: The following steps are involved: S1. Customize the grid connection solution template according to the office network and data center type of the site through the graphical interface; S2. Enter the site name, device IP range, and resources that need to be accessible; S3. Pre-allocate IP addresses for site devices and perform conflict detection according to the IP allocation rules defined in the template; S4. Generate security policy rules based on the pre-allocated IP addresses and the resources that need to be opened at the site and display them in the format of the template; S5. Adapt and generate executable policy scripts according to the device type and the policy to be activated; S6. Use object comparison algorithm to check whether the generated strategy is complete and perform necessary optimization; S7. Send the generated policy script to the specified network device and verify the successful sending; S8. Retrieve basic information and configuration data of mining equipment and archive and update them; S9. Provide a visual interface to display information such as the configured network topology, policy distribution, and device status, and collect user feedback on the configuration effect.

2. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S1 are: S1.

1. The user selects a template that matches the site office network or data center type from the preset template library as the basis; S1.

2. Set the starting and ending range of the IP address segment and the subnet mask, define static IP allocation rules or dynamic DHCP allocation strategy, and specify the IP allocation priority of the server or switch device type; S1.

3. Define the basic framework of security policies, set policy priorities and conflict resolution mechanisms; S1.

4. Determine which devices require remote access permissions and format the policy file; S1.

5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the equipment inventory; S1.

6. After checking the integrity of the template settings, apply the template settings to generate the initialized configuration file and policy framework.

3. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S2 are: S2.

1. Enter the basic information of the site name, geographical location, and network type into the system; S2.

2. According to the site scale and network planning, enter the starting and ending range of the device IP address and confirm that the IP range does not conflict with the existing network; S2.

3. Select the external or internal resources that the site needs to access from the resource list, and specify the read-only, read-write permission level for accessing the resources; S2.

4. The system automatically saves the entered data and performs data verification.

4. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S3 are: S3.

1. Load IP allocation rules from the template; S3.

2. According to the device type and priority, assign an IP address to each device, record the assignment results, and generate an IP address assignment table; S3.

3. Compare the pre-assigned IP address with the IP address in the existing network to check if there is a conflict. If there is a conflict, automatically adjust the IP allocation or prompt the user to adjust it manually; S3.

4. Summarize the conflict detection results, including conflicting devices, IP addresses and suggested solutions, and provide them to users for reference.

5. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S4 are: S4.

1. Obtain the pre-assigned IP and site resource requirements of the device from the previous step; S4.

2. Generate corresponding security policy rules for each device based on resource access requirements; S4.

3. Convert the policy rules into a readable text or configuration file format according to the format defined in the template; S4.

4. Display the generated policy rules in a graphical interface and provide editing functions to allow users to make fine adjustments as needed.

6. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 5, characterized in that: The implementation steps of step S5 are: S5.

1. Read the equipment ledger and identify the type of each device; S5.

2. Select the corresponding policy script template from the script library according to the device type; S5.

3. Fill the security policy rules generated in step S4 into the script template, and adjust the parameters and commands in the script according to the device characteristics; S5.

4. Compile the script to generate a policy configuration script that can be executed on the target device and perform syntax checking; S5.

5. Save the generated script file to a specified location.

7. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S6 are: S6.

1. Read the generated strategy file and load it into the comparison algorithm; S6.

2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for any missing or incorrect configurations; S6.

3. Summarize the comparison results and generate a detailed comparison report, which points out the inconsistencies and provides optimization suggestions; S6.

4. Make necessary adjustments and optimizations to the strategy based on the comparison report.

8. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S7 are: S7.

1. Select SSH, Telnet or SNMP delivery channel and configure connection parameters; S7.

2. Send the policy script to the target device through the selected delivery channel and monitor the delivery process; S7.

3. Log in to the target device, check whether the policy has been successfully loaded and is effective, and use commands or tools to verify the correctness of the policy configuration; S7.

4. Summarize the distribution results and generate a distribution report, which includes the distribution time, device name, distribution status and possible error information.

9. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S8 are: S8.

1. Set up the mining task in the system, specify the equipment, data items and mining cycle to be mined; S8.

2. Retrieve basic information and configuration data from the device through the network or API interface; S8.

3. Archive the collected data into a database or file system and organize the data; S8.

4. Update the relevant information in the equipment ledger based on the recovered data.

10. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S9 are: S9.

1. Use graphical tools to design intuitive network topology maps, policy distribution maps, and device status panels; S9.

2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation; S9.

3. Display the distribution of security policies in the form of a chart or list, including which devices are applied to which policies; S9.

4. Update device status information in real time, including online / offline, CPU usage, and memory usage; S9.

5. Provide a feedback portal to allow users to submit comments and suggestions on configuration effects.

Images