A multi-layer firewall rule generation and configuration method and device

Abstract

The present invention relates to a method for generating multi-layer firewall rules, comprising: S1: obtaining business information, and configuring five-tuple information corresponding to the business information; S2: establishing an access model corresponding to the business information according to the five-tuple information corresponding to each business information; S3: generating firewall rules corresponding to the business information according to the access model corresponding to the business information. The present invention establishes an access model corresponding to the business information based on the five-tuple information, and automatically generates firewall rules consistent with the business information according to the obtained access model. Compared with the prior art, the generated multi-layer firewall rules are simple and easy to understand, and unified firewall rules are established based on the business information, which overcomes the problem that the multi-layer firewall rules in the prior art are complex and prone to conflicts, and improves the generation efficiency of firewall rules while ensuring the security of system protection.

Description

Technical Field

[0001] The present invention relates to the technical field of network system security, and in particular to a method and device for generating and configuring multi-layer firewall rules. Background Art

[0002] A firewall is a key security technology used to protect computer networks from unauthorized access, malicious attacks, and data leaks. Firewalls are usually deployed at the border of a system network to filter network traffic according to predefined security policies and prevent bad traffic from entering the protected network. In order to prevent external dangers from bypassing the border firewall and entering the protected network, a multi-layer firewall mechanism has emerged. Firewalls are deployed on all hosts within the protected network, such as access gateways, business gateways, service nodes, storage nodes, etc. Firewalls are deployed to protect networks and systems from various types of attacks through multi-level protection mechanisms.

[0003] However, as the scale of business grows, the network system structure becomes more and more complex. For large-scale network system architecture, although the multi-level firewall mechanism protects the system from various types of attacks, the configuration and management of multi-layer firewall rules are more complicated. In the prior art, the firewall rule management system often needs to manually create the rules of each firewall, and conflicts are prone to occur between the firewall rules. It is also difficult to read and understand, which makes it more difficult to write and maintain the multi-layer firewall rules, thereby making the generation of rules under the multi-layer firewall mechanism inefficient. Summary of the invention

[0004] Based on this, the purpose of the present invention is to overcome the defects or shortcomings of the prior art, and provide a multi-layer firewall rule generation and configuration method and device, which utilizes a unified firewall management tool to construct an access model consistent with business information based on quintuple information, and automatically generates firewall rules consistent with business information through the constructed access model consistent with business information, thereby improving the efficiency of firewall rule generation while ensuring the security of system protection.

[0005] In one embodiment, a multi-layer firewall rule generation method is provided, comprising:

[0006] S1: Obtain business information and configure the five-tuple information corresponding to the business information;

[0007] S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0008] S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

[0009] Furthermore, in the step S2, the access model corresponding to the business information includes an access name corresponding to the business information and quintuple information.

[0010] Furthermore, in step S3, firewall rules corresponding to the business information are generated according to the category of the business information and the corresponding quintuple information.

[0011] Furthermore, the method further comprises:

[0012] S4: Obtain updated business information, and update corresponding quintuple information according to the updated business information;

[0013] S5: Establish an updated access model corresponding to the updated business information according to the updated quintuple information, and generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

[0014] Furthermore, in step S5, firewall rules corresponding to the updated business information are generated according to the category of the business information and the updated quintuple information.

[0015] In one embodiment, the present invention further provides a multi-layer firewall rule configuration method, comprising:

[0016] S1: Obtain business information and configure the five-tuple information corresponding to each business information;

[0017] S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0018] S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

[0019] S4: Obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information;

[0020] S5: Using the obtained configuration rules corresponding to the business information, configure rules for the multi-layer firewall.

[0021] Furthermore, in step S4, configuration rules corresponding to the business information are obtained according to the five-tuple information corresponding to the business information.

[0022] In one embodiment, the present invention further provides a multi-layer firewall rule generation device, comprising:

[0023] An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information;

[0024] A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0025] The generating unit is used to generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

[0026] Furthermore, the device also includes:

[0027] An updating unit, used to obtain updated business information and update corresponding quintuple information according to the updated business information;

[0028] The generating unit is further used to establish an updated access model corresponding to the updated business information according to the updated five-tuple information, and to generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

[0029] In one embodiment, the present invention further provides a multi-layer firewall rule configuration device, comprising:

[0030] An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information;

[0031] A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0032] A generating unit, used to generate a firewall rule corresponding to the business information according to an access model corresponding to the business information;

[0033] The configuration unit is used to obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information, and use the obtained configuration rules corresponding to the business information to perform rule configuration on the multi-layer firewall.

[0034] Compared with the prior art, the multi-layer firewall rule generation method described in the present invention establishes an access model corresponding to the business information based on the five-tuple information, and automatically generates firewall rules consistent with the business information based on the obtained access model. Compared with the prior art, the multi-layer firewall rules automatically generated based on the five-tuple information are simple and easy to understand, and a unified firewall rule is established based on the business information, so that the multi-layer firewalls in the network business system all adopt unified access rules, which overcomes the problem that the multi-layer firewall rules in the prior art are complex and prone to conflicts, and improves the efficiency of firewall rule generation while ensuring the security of system protection.

[0035] For better understanding and implementation, the present invention is described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1A schematic diagram of an application environment of a multi-layer firewall rule generation and configuration method provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of a flow chart of a multi-layer firewall rule generation method provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of the topological structure of a network service system provided by an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of a multi-layer firewall rule configuration method provided by an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of the structure of a multi-layer firewall rule generation and configuration device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0042] In the prior art, when building a multi-layer firewall mechanism in a network business system, the rules of each firewall conflict with each other, and each firewall rule needs to be written and associated, which makes the rule generation efficiency of the firewall management tool low and prone to errors; and when encountering network problems, it is often difficult to identify and troubleshoot. In order to solve this problem, the inventor of this solution starts with the business information of the network business system, builds an access model consistent with the business information based on the five-tuple information, and uses the firewall unified management platform to automatically generate firewall rules based on the constructed access model consistent with the business information, thereby improving the efficiency of firewall rule generation while ensuring the security of system protection.

[0043] The scheme of the present invention is described in detail below with reference to the accompanying drawings.

[0044] In this example, see Figure 1 , a schematic diagram of the application environment of the multi-layer firewall rule generation and configuration method is given, which includes a network service system 1 and a central server 2. Each client in the network service system 1 communicates with each server to perform network communication. The server may include an application server, a data server, a storage server, etc. The network service system 1 deploys a border firewall ( Figure 1The network service system 1 is a network service system that is used to manage multiple layers of firewalls, and multiple layers of firewalls are used to manage multiple layers of firewalls. The central server 2 is provided with a unified firewall management tool, which is used to automatically generate and configure firewall rules through the multi-layer firewall rule generation and configuration method provided by the present invention, thereby achieving multi-layer protection for the network service system. It is understandable that the unified firewall management tool can be an existing tool.

[0045] Specifically, in one embodiment, if Figure 2 As shown, the present invention provides a multi-layer firewall rule generation method, which is applied to a central server and includes:

[0046] S1: Obtain business information and configure the five-tuple information corresponding to the business information;

[0047] It can be understood that the central server communicates with each server in the network business system through network communication, and can obtain business information in the network business system from each server. At the same time, the central server is configured with a security authentication and authorization mechanism, and only authorized personnel can access the central server. A firewall unified management tool is installed in the central server, which first collects and obtains business information in the network business system, and then configures the five-tuple information corresponding to each business information through the firewall unified management tool for unified modeling. Among them, business information can be obtained from various channels, such as customer interviews, network equipment logs, application logs, databases, etc. Figure 3 As shown, a schematic diagram of the topology structure of a network service system is given as an example. Based on the schematic diagram of the topology structure, the service information of the network service system is obtained as follows:

[0048] User Alice uses the FTP application to connect to server server1;

[0049] The FTP service port number is 21;

[0050] User Alice’s IP address is 192.168.1.100;

[0051] The IP address of server1 is 192.168.2.200.

[0052] The network protocol used is TCP;

[0053] After obtaining the corresponding service information, the five-tuple information corresponding to the service information is configured based on the five-tuple rule. It can be understood that the five-tuple rule includes the source address, source port, destination address, destination port and protocol. Specifically, the five-tuple information corresponding to the above service information is shown in Table 1 below:

[0054] name value Alice 192.168.1.100 Alice-port ANY server1 192.168.2.200 port1 21 protocol TCP

[0055] Table 1 Five-tuple information

[0056] S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0057] Specifically, after obtaining the business information, the corresponding quintuple information is obtained for each business information based on the quintuple rule, and the access model corresponding to the business information in the network business system is obtained by analyzing the quintuple information corresponding to each business information in the network business system; it can be understood that the access model corresponding to the business information includes the access name corresponding to the business information and the quintuple information.

[0058] S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

[0059] Specifically, after obtaining the access model corresponding to the business information in the network business system based on the five-tuple information, the corresponding firewall rules are generated using the firewall unified management tool. For example, the five-tuple information corresponding to the above business information is: the source address is the network object Alice (192.161.1.100), the source port number is empty, the destination address is the network object Server1 (192.168.2.200), the destination port number is Port1 (21), and the protocol is TCP. The following firewall rules are automatically generated using the firewall unified management tool:

[0060] (1)IPTABLES-A INPUT-p tcp-m tcp-s 192.168.2.200--sport 21-d192.168.1.100-jACCEPT

[0061] (2)IPTABLES-A OUTPUT-p tcp-m tcp-s 192.168.1.100-d 192.168.2.200--dport 21-jACCEPT

[0062] In rule (1), A represents the network object ALice, A INPUT represents the network object Alice receiving data packet information, p tcp-m tcp represents the transmission protocol is TCP, s represents the source address is 192.168.2.200, sport represents the source port is 21, d represents the destination address is 192.168.1.100, and j ACCEPT represents that the data packet information that meets the above rules is allowed to pass; in rule (2), A OUTPUT represents the network object Alice sending data packet information, p tcp-m tcp represents the transmission protocol is TCP, s represents the source address is 192.168.1.100, d represents the destination address is 192.168.2.200, dport represents the destination port is 21, and j ACCEPT represents that the data packet information that meets the above rules is allowed to pass.

[0063] Therefore, it can be understood that after obtaining the access model, the category of the business information is analyzed, and then according to the category of the business information and the corresponding five-tuple information, the firewall rules corresponding to the business information are generated. Optionally, the category of its business information includes receiving data packet information, sending data packet information, forwarding data packet information, etc. The above automatically generated firewall rules are: when user Alice sends business information, the business information transmitted by TCP protocol from source address 192.168.1.100 is sent to port 21 and destination address 192.168.2.200, it is allowed to pass; when user Alice receives business information, the business information transmitted by TCP protocol from source address 192.168.2.200 and source port 21 is sent to destination address 192.168.1.100, it is allowed to pass.

[0064] The multi-layer firewall rule generation method provided in this embodiment establishes an access model corresponding to the business information based on the five-tuple information, and automatically generates firewall rules consistent with the business information based on the obtained access model. Compared with the prior art, the multi-layer firewall rules automatically generated based on the five-tuple information are simple and easy to understand, and a unified firewall rule is established based on the business information, so that the multi-layer firewalls in the network business system all adopt a unified access rule, which overcomes the problem that the multi-layer firewall rules in the prior art are complex and prone to conflicts, and improves the efficiency of firewall rule generation while ensuring the security of system protection.

[0065] Further, in one embodiment, see Figure 2 , the multi-layer firewall rule generation method further includes:

[0066] S4: Obtain updated business information, and update corresponding quintuple information according to the updated business information;

[0067] Specifically, when generating firewall rules, when the business information is updated, the updated business information is obtained, and the corresponding five-tuple information is updated according to the updated business information. For example, in the above business information, if the IP address of Server1 is changed to 192.168.3.200, the updated five-tuple information is as follows:

[0068] name value Alice 192.168.1.100 Alice-port ANY server1 192.168.3.200 port1 21 protocol TCP

[0069] Table 2 Updated quintuple information

[0070] S5: Establish an updated access model corresponding to the updated business information according to the updated quintuple information, and generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

[0071] For example, the five-tuple information corresponding to the updated service information is: the source address is the network object Alice (192.161.1.100), the source port number is empty, the destination address is the network object Server1 (192.168.3.200), the destination port number is Port1 (21), and the protocol is TCP. The following updated firewall rules are automatically generated using the firewall unified management tool:

[0072] (1)IPTABLES-A INPUT-p tcp-m tcp-s 192.168.3.200--sport 21-d192.168.1.100-jACCEPT

[0073] (2)IPTABLES-A OUTPUT-p tcp-m tcp-s 192.168.1.100-d 192.168.3.200--dport 21-jACCEPT

[0074] The meaning of each symbol is as described above. It can be understood that the automatically generated updated firewall rules are: when user Alice sends business information, business information transmitted from source address 192.168.1.100 with TCP protocol is sent to destination address 192.168.3.200 with port 21, it is allowed to pass; when user Alice receives business information, business information transmitted from source address 192.168.3.200 with source port 21 with TCP protocol is sent to destination address 192.168.1.100, it is allowed to pass.

[0075] The multi-layer firewall rule generation method provided in this embodiment, when business information is updated, only needs to modify and update the corresponding business information in the firewall unified management tool, that is, the updated firewall rules can be automatically generated according to the updated business information, making the modification and update of the firewall rules simpler and more convenient, and further improving the generation efficiency of the multi-layer firewall rules compared with the prior art.

[0076] Furthermore, in another embodiment, Figure 4 As shown, the present invention also provides a multi-layer firewall rule configuration method, which is applied to a central server and includes:

[0077] S1: Obtain business information and configure the five-tuple information corresponding to each business information;

[0078] It can be understood that the central server communicates with each server in the network business system through a communication connection to perform network communication, and can obtain business information in the network business system from each server. At the same time, a security authentication and authorization mechanism is configured in the central server, and only authorized personnel can access the central server. A firewall unified management tool is installed in the central server, and the business information in the network business system is first collected and obtained, and the five-tuple information corresponding to each business information is configured through the firewall unified management tool for unified modeling. Among them, the business information can be obtained from various channels, such as customer interviews, network equipment logs, application logs, databases, etc. Please refer to the aforementioned embodiment for its specific five-tuple information, which will not be repeated here.

[0079] S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0080] Specifically, after obtaining the business information, the corresponding quintuple information is obtained for each business information based on the quintuple rule, and the access model corresponding to the business information in the network business system is obtained by analyzing the quintuple information corresponding to all business information in the network business system; it can be understood that the access model includes the quintuple information corresponding to all business information.

[0081] S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

[0082] Specifically, after obtaining the access model corresponding to the business information in the network business system based on the five-tuple information, the corresponding firewall rules are generated using the firewall unified management tool. For example, the five-tuple information corresponding to the above business information is: the source address is the network object Alice (192.161.1.100), the source port number is empty, the destination address is the network object Server1 (192.168.2.200), the destination port number is Port1 (21), and the protocol is TCP. The following firewall rules are automatically generated using the firewall unified management tool:

[0083] (1)IPTABLES-A INPUT-p tcp-m tcp-s 192.168.2.200--sport 21-d192.168.1.100-jACCEPT

[0084] (2)IPTABLES-A OUTPUT-p tcp-m tcp-s 192.168.1.100-d 192.168.2.200--dport 21-jACCEPT

[0085] In rule (1), A represents the network object ALice, A INPUT represents the network object Alice receiving data packet information, p tcp-m tcp represents the transmission protocol is TCP, s represents the source address is 192.168.2.200, sport represents the source port is 21, d represents the destination address is 192.168.1.100, and j ACCEPT represents that the data packet information that meets the above rules is allowed to pass; in rule (2), A OUTPUT represents the network object Alice sending data packet information, p tcp-m tcp represents the transmission protocol is TCP, s represents the source address is 192.168.1.100, d represents the destination address is 192.168.2.200, dport represents the destination port is 21, and j ACCEPT represents that the data packet information that meets the above rules is allowed to pass.

[0086] Therefore, it can be understood that after obtaining the access model, the category of the business information is analyzed, and then according to the category of the business information and the corresponding five-tuple information, the firewall rules corresponding to the business information are generated. Optionally, the category of its business information includes receiving data packet information, sending data packet information, forwarding data packet information, etc. The above automatically generated firewall rules are: when user Alice sends business information, the business information transmitted by TCP protocol from source address 192.168.1.100 is sent to port 21 and destination address 192.168.2.200, it is allowed to pass; when user Alice receives business information, the business information transmitted by TCP protocol from source address 192.168.2.200 and source port 21 is sent to destination address 192.168.1.100, it is allowed to pass.

[0087] S4: Obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information;

[0088] Specifically, when the central server uses the unified firewall management tool to automatically generate firewall rules corresponding to business information, it needs to deploy the generated firewall rules to the boundary firewall and internal firewalls of the network business system. For example, for the automatically generated firewall rules mentioned above, when configuring the firewall rules for the network business system, the FTP access of user Alice is allowed on Alice's server firewall and Server1's firewall, and the router Router1 (192.168.1.50) firewall between Alice and Server1 is configured to allow Alice to access port 21 of Server1 and intercept other traffic information not related to business information. Specifically, the configuration rules deployed on the router Router1 (192.168.1.50) firewall are as follows:

[0089] IPTABLES-A FORWARD-p tcp-m tcp-s 192.168.1.100-d 192.168.2.200--dport21-jACCEPT

[0090] IPTABLES -A FORWARD -j DROP

[0091] Among them, it can be understood that the configuration rules obtained above are: when user Alice sends data packet information from source address 192.168.1.100 to destination address 192.168.2.200 and destination port 21 using TCP protocol, forwarding is allowed; other data packet information of user Alice that does not meet the above rules is intercepted and abandoned, and is not allowed to be forwarded.

[0092] S5: Using the obtained configuration rules corresponding to the business information, configure rules for the multi-layer firewall.

[0093] The multi-layer firewall rule deployment method provided in this embodiment establishes an access model corresponding to the business information based on the five-tuple information, and automatically generates firewall rules consistent with the business information based on the obtained access model, and obtains the corresponding configuration rules based on the generated firewall rules consistent with the business information, and uses the obtained configuration rules to configure the multi-layer firewall rules. Compared with the prior art, the present invention automatically generates multi-layer firewall rules based on five-tuple information, establishes unified firewall rules based on business information, and generates corresponding configuration rules to perform multi-layer firewall rule deployment on the network business system, thereby realizing multi-layer in-depth protection for the network business system.

[0094] Furthermore, in this embodiment, when business information is updated, corresponding firewall rules are automatically generated based on the updated business information, and the updated configuration rules are automatically synchronized and generated using the firewall unified management tool. The configuration rules can be synchronized to the firewall to complete the automatic modification of the firewall rules. There is no need for management personnel to tediously log in to each server node or component in the network business system and modify them by handwriting commands, which avoids errors in the writing of firewall rules and further improves the efficiency of multi-layer in-depth protection for the network business system.

[0095] Furthermore, in another embodiment, Figure 5 As shown, the present invention provides a multi-layer firewall rule generation device 1, which is applied to a central server and includes:

[0096] An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information;

[0097] A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0098] A generating unit, used to generate a firewall rule corresponding to the business information according to an access model corresponding to the business information;

[0099] An updating unit, used to obtain updated business information and update corresponding quintuple information according to the updated business information;

[0100] The generating unit is further used to establish an updated access model corresponding to the updated business information according to the updated five-tuple information, and to generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

[0101] Further, in another embodiment, see further Figure 5The present invention provides a multi-layer firewall rule configuration device, which is applied to a central server and includes:

[0102] An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information;

[0103] A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information;

[0104] A generating unit, used to generate a firewall rule corresponding to the business information according to an access model corresponding to the business information;

[0105] The configuration unit is used to obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information, and use the obtained configuration rules corresponding to the business information to perform rule configuration on the multi-layer firewall.

[0106] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A multi-layer firewall rule generation method, characterized in that: include: S1: Obtain business information and configure the five-tuple information corresponding to the business information; S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information; S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

2. The multi-layer firewall rule generation method according to claim 1, characterized in that: In the step S2, the access model corresponding to the business information includes an access name and quintuple information corresponding to the business information.

3. The multi-layer firewall rule generation method according to claim 2, characterized in that: In the step S3, firewall rules corresponding to the business information are generated according to the category of the business information and the corresponding five-tuple information.

4. The multi-layer firewall rule generation method according to claim 3, characterized in that: The method further comprises: S4: Obtain updated business information, and update corresponding quintuple information according to the updated business information; S5: Establish an updated access model corresponding to the updated business information according to the updated quintuple information, and generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

5. The multi-layer firewall rule generation method according to claim 4, characterized in that: In the step S5, a firewall rule corresponding to the updated business information is generated according to the category of the business information and the updated five-tuple information.

6. A multi-layer firewall rule configuration method, characterized in that: include: S1: Obtain business information and configure the five-tuple information corresponding to each business information; S2: establishing an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information; S3: Generate firewall rules corresponding to the business information according to the access model corresponding to the business information. S4: Obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information; S5: Using the obtained configuration rules corresponding to the business information, configure rules for the multi-layer firewall.

7. The multi-layer firewall rule configuration method according to claim 6, characterized in that: In the step S4, the configuration rules corresponding to the business information are obtained according to the five-tuple information corresponding to the business information.

8. A multi-layer firewall rule generation device, characterized in that: include: An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information; A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information; The generating unit is used to generate firewall rules corresponding to the business information according to the access model corresponding to the business information.

9. The multi-layer firewall rule generation device according to claim 8, characterized in that: The device also includes: An updating unit, used to obtain updated business information and update corresponding quintuple information according to the updated business information; The generating unit is further used to establish an updated access model corresponding to the updated business information according to the updated five-tuple information, and to generate firewall rules corresponding to the updated business information according to the updated access model corresponding to the business information.

10. A multi-layer firewall rule configuration device, characterized in that: include: An acquisition unit, used to acquire business information and configure five-tuple information corresponding to the business information; A determination unit, used to establish an access model corresponding to each piece of business information according to the five-tuple information corresponding to the business information; A generating unit, used to generate a firewall rule corresponding to the business information according to an access model corresponding to the business information; The configuration unit is used to obtain configuration rules corresponding to the business information according to the generated firewall rules corresponding to the business information, and use the obtained configuration rules corresponding to the business information to perform rule configuration on the multi-layer firewall.

Images