Access rule management method, device and equipment based on access control matrix

Abstract

The invention provides an access rule management method, device and equipment based on an access control matrix, and relates to the technical field of network security, and the method comprises the steps: obtaining a source address and a target address; generating an access control matrix based on the source address, the target address, the protocol and the target port, and determining target network equipment and passing network equipment based on the access control matrix; automatically generating corresponding access control rules for the target network equipment and the path network equipment based on the target network equipment and the access control matrix thereof, and automatically generating corresponding access control rules for the path network equipment and the access control matrix thereof; and correspondingly configuring the access control rule to the target network equipment and the path network equipment to realize access control of the target network equipment and the path network equipment. According to the invention, through the access control matrix, a visual and structured interface is provided, so that a manager can clearly check, edit and manage the network access control rule.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an access rule management method, device and equipment based on an access control matrix. Background Art

[0002] With the rapid development of information technology, the enterprise network environment is becoming increasingly complex, and network security threats are also increasing, which puts higher requirements on the information security protection of enterprises. To meet this challenge, enterprises generally deploy network firewalls at key nodes of the enterprise network to achieve comprehensive security control of network access.

[0003] Traditional firewall access control methods mainly rely on access control lists (ACLs). ACLs match and filter packets entering and leaving the network by defining a series of rules, each of which contains five pieces of information: source address, source port, destination address, destination port, and protocol. This method can better meet security control needs when the number of rules is small and the network environment is relatively simple.

[0004] However, in actual applications, the enterprise network environment is often very complex, especially in scenarios with high security requirements, where both inbound and outbound access needs to be strictly controlled. In addition, as the enterprise scale expands and the business develops, multiple firewall devices may be deployed in the network. These factors have led to a sharp increase in the number of ACL rules, making rule management extremely cumbersome and complex.

[0005] Specifically, when the number of ACL rules is huge, operational managers will face huge challenges in understanding and maintaining the rules. On the one hand, although each rule is easy to understand when viewed individually, many rules are intertwined, which easily leads to rule conflicts and redundancy, increasing the difficulty of management; on the other hand, due to the large number of rules, it is difficult to quickly and accurately locate the rules that match specific business needs, thus affecting the effective implementation of security policies.

[0006] Therefore, a method, apparatus and device for managing access rules based on an access control matrix are proposed. Summary of the invention

[0007] This specification provides an access rule management method, device and equipment based on an access control matrix. Through the access control matrix, an intuitive and structured interface is provided, allowing administrators to clearly view, edit and manage network access control rules.

[0008] This specification provides an access rule management method based on an access control matrix, including:

[0009] Get the source address, destination address, protocol, and destination port;

[0010] Generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix;

[0011] Based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, corresponding access control rules are automatically generated for the target network device and the path network device;

[0012] The access control rules are configured to the target network device and the path network device accordingly to implement access control of the target network device and the path network device.

[0013] Optionally, generating an access control matrix based on the source address, the target address, the protocol, and the target port includes:

[0014] The source address is taken as the subject, the target address is taken as the object, and the protocol and the target port separated by a preset separator are taken as permissions to obtain an access control matrix.

[0015] Optionally, the source address is used as the subject, the target address is used as the object, and the protocol and the target port separated by a preset separator are used as permissions to obtain an access control matrix, including:

[0016] generating an object capability table header based on all the target addresses;

[0017] Decoding the subject capability table of the source address one by one, generating a row in the control matrix, namely, data of the target structure, and adding it to the output buffer; wherein the target structure includes a dictionary structure;

[0018] The data in the dictionary structure are parsed in turn, and the corresponding header display data is matched to obtain an access control matrix.

[0019] Optionally, also include:

[0020] Determine whether the target network device and / or the path network device need to generate rules;

[0021] When the target network device and / or the path network device need to generate a rule, adding a first identifier to the target network device and / or the path network device;

[0022] When the target network device and / or the path network device do not need to generate a rule, a second identifier is added to the target network device and / or the path network device.

[0023] Optionally, the automatically generating corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, includes:

[0024] Obtaining the IP and mask of the target network device and / or the route network device;

[0025] Taking the IP and mask of the target network device and / or the routed network device as the primary key, a network device interface dictionary is constructed; wherein the IP and the mask are used as the key of the network device interface dictionary, and the device name of the target network device and / or the routed network device is used as the value of the network device interface dictionary;

[0026] Traversing the network device interface dictionary, determining the interface network segment of each network interface based on the IP and the mask, and constructing a network segment array dictionary; wherein the interface network segment is used as the key of the network segment array dictionary, and the device name of the target network device and / or the path network device is used as the value of the network device interface dictionary;

[0027] Traverse the network segment array dictionary, extract the key with value>1 in the network segment array dictionary, determine that the corresponding target network device and / or the path network device are associated, and construct a device neighbor table; wherein the device name of the target network device and / or the path network device is used as the key of the device neighbor table, and the associated target network device and / or the path network device is used as the value of the device neighbor table;

[0028] Traversing the device neighbor table, recursively querying the key in the device neighbor table, taking all the network devices in the path that are not direct neighbors of the target network device as the key of the device routing information table, and taking the device names of all the network devices in the path as the value of the device routing information table;

[0029] The device routing information table is traversed, and the target network device and / or the path network device added with the second identifier are directly added to the Internet boundary device table, and the device name of the target network device and / or the path network device added with the first identifier is used as the key of the access control rule set, and the access control rule information of the target network device and / or the path network device added with the first identifier is used as the value of the access control rule set to obtain the access control rule set.

[0030] Optionally, the automatically generating corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, further includes:

[0031] Match the source address and the target address respectively based on the network segment array dictionary to determine a source device set and a target device set;

[0032] If the source device set or the target device set is empty, use the devices in the Internet edge device table as corresponding set members; if both the source device set and the target device set are empty, execution ends;

[0033] Checking the first hop device and the last call device in each path device information based on the device routing information table, if they are the same as the source device or the target device, discarding the corresponding path device information;

[0034] Based on the access control rule set, corresponding access control rules are matched for the target network device and the path network device.

[0035] Optionally, configuring the access control rule to the target network device and the path network device to implement access control of the target network device and the path network device includes:

[0036] The access control rules are written into the configuration file of the target network device or the route network device, and the device name is used as the file name to implement access control of the target network device and the route network device.

[0037] This specification provides an access control device based on an access control matrix, comprising:

[0038] The acquisition module is used to obtain the source address, destination address, protocol, and destination port;

[0039] A first generating module, configured to generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix;

[0040] A second generation module is used to automatically generate corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix;

[0041] The configuration module is used to configure the access control rules to the target network device and the path network device accordingly, so as to implement access control of the target network device and the path network device.

[0042] Optionally, the first generating module includes:

[0043] The source address is taken as the subject, the target address is taken as the object, and the protocol and the target port separated by a preset separator are taken as permissions to obtain an access control matrix.

[0044] Optionally, the source address is used as the subject, the target address is used as the object, and the protocol and the target port separated by a preset separator are used as permissions to obtain an access control matrix, including:

[0045] generating an object capability table header based on all the target addresses;

[0046] Decoding the subject capability table of the source address one by one, generating a row in the control matrix, namely, data of the target structure, and adding it to the output buffer; wherein the target structure includes a dictionary structure;

[0047] The data in the dictionary structure are parsed in turn, and the corresponding header display data is matched to obtain an access control matrix.

[0048] Optionally, also include:

[0049] Determine whether the target network device and / or the path network device need to generate rules;

[0050] When the target network device and / or the path network device need to generate a rule, adding a first identifier to the target network device and / or the path network device;

[0051] When the target network device and / or the path network device do not need to generate a rule, a second identifier is added to the target network device and / or the path network device.

[0052] Optionally, the second generating module includes:

[0053] Obtaining the IP and mask of the target network device and / or the route network device;

[0054] Taking the IP and mask of the target network device and / or the routed network device as the primary key, a network device interface dictionary is constructed; wherein the IP and the mask are used as the key of the network device interface dictionary, and the device name of the target network device and / or the routed network device is used as the value of the network device interface dictionary;

[0055] Traversing the network device interface dictionary, determining the interface network segment of each network interface based on the IP and the mask, and constructing a network segment array dictionary; wherein the interface network segment is used as the key of the network segment array dictionary, and the device name of the target network device and / or the path network device is used as the value of the network device interface dictionary;

[0056] Traverse the network segment array dictionary, extract the key with value>1 in the network segment array dictionary, determine that the corresponding target network device and / or the path network device are associated, and construct a device neighbor table; wherein the device name of the target network device and / or the path network device is used as the key of the device neighbor table, and the associated target network device and / or the path network device is used as the value of the device neighbor table;

[0057] Traversing the device neighbor table, recursively querying the key in the device neighbor table, taking all the network devices in the path that are not direct neighbors of the target network device as the key of the device routing information table, and taking the device names of all the network devices in the path as the value of the device routing information table;

[0058] The device routing information table is traversed, and the target network device and / or the path network device added with the second identifier are directly added to the Internet boundary device table, and the device name of the target network device and / or the path network device added with the first identifier is used as the key of the access control rule set, and the access control rule information of the target network device and / or the path network device added with the first identifier is used as the value of the access control rule set to obtain the access control rule set.

[0059] Optionally, the second generating module further includes:

[0060] Match the source address and the target address respectively based on the network segment array dictionary to determine a source device set and a target device set;

[0061] If the source device set or the target device set is empty, use the devices in the Internet edge device table as corresponding set members; if both the source device set and the target device set are empty, execution ends;

[0062] Checking the first hop device and the last call device in each path device information based on the device routing information table, if they are the same as the source device or the target device, discarding the corresponding path device information;

[0063] Based on the access control rule set, corresponding access control rules are matched for the target network device and the path network device.

[0064] Optionally, the configuration module includes:

[0065] The access control rules are written into the configuration file of the target network device or the route network device, and the device name is used as the file name to implement access control of the target network device and the route network device.

[0066] This specification also provides an electronic device, wherein the electronic device includes:

[0067] processor; and,

[0068] A memory storing computer executable instructions, which when executed cause the processor to perform any of the above methods.

[0069] The present specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, any of the above methods is implemented.

[0070] In the present invention, an intuitive and structured interface is provided through the access control matrix, so that managers can clearly view, edit and manage network access control rules. This two-dimensional table form greatly simplifies the management process of rules, so that even in the case of a large number of rules, rules can be easily found, added and modified. The access control matrix can systematically organize and manage network access control rules, avoiding conflicts and redundancies between rules. At the same time, through automated data processing and conversion mechanisms (such as converting the access control matrix into a capability table with source address as the primary key), the method improves the efficiency and accuracy of rule processing. Since the access control matrix stores rules in a structured manner, audit reports and statistical information can be easily generated. This helps managers to regularly evaluate and review the effectiveness, compliance and security of network access control policies. Through the automatic matching of multiple devices, firewalls and other network devices in the entire network can be intelligently identified, and corresponding access control rules can be automatically generated and matched according to the network topology and access control requirements. This greatly reduces the burden on firewall operators, and there is no need to manually consider which devices the rules should be configured on, thereby improving the efficiency and accuracy of network management. Through refined access control strategies, this method can effectively prevent unauthorized access and data leakage, and protect the security of network resources and sensitive information. At the same time, by regularly updating and optimizing access control rules, it can adapt to changes in network environment and business needs, ensuring the security and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0072] Figure 1 A schematic diagram of the principle of an access rule management method based on an access control matrix provided in an embodiment of this specification;

[0073] Figure 2 A schematic diagram of the structure of an access control device based on an access control matrix provided in an embodiment of this specification;

[0074] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification;

[0075] Figure 4 A schematic diagram of a computer-readable medium provided for an embodiment of this specification. DETAILED DESCRIPTION

[0076] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0077] The following is combined with Figure 1-4 The exemplary embodiments of the present invention are described more fully. However, the exemplary embodiments can be implemented in various forms, and it should not be understood that the present invention is limited to the embodiments set forth herein. On the contrary, providing these exemplary embodiments can make the present invention more comprehensive and complete, and it is more convenient to fully convey the inventive concept to those skilled in the art. The same reference numerals in the figures represent the same or similar elements, components or parts, and thus their repeated description will be omitted.

[0078] Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a specific embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.

[0079] In the description of specific embodiments, the features, structures, characteristics or other details described in the present invention are intended to enable those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can practice the technical solutions of the present invention without one or more of the specific features, structures, characteristics or other details.

[0080] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0081] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0082] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0083] Figure 1 A schematic diagram of a principle of an access rule management method based on an access control matrix provided in an embodiment of this specification, the method may include:

[0084] S110: Obtain source address, destination address, protocol, and destination port;

[0085] S120: Generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix;

[0086] Optionally, the S120 includes:

[0087] The source address is taken as the subject, the target address is taken as the object, and the protocol and the target port separated by a preset separator are taken as permissions to obtain an access control matrix.

[0088] In the specific implementation of this specification, the source address of the network access behavior is taken as the subject and listed on the rows of the access control matrix; the target address of the network access behavior is taken as the object and listed on the columns of the access control matrix; the protocol and target port combination separated by a preset delimiter is used as the permission information and filled in the corresponding row and column intersections in the access control matrix.

[0089] When editing access control rules, administrators locate the corresponding row and column intersections in the access control matrix based on the source address (subject) and the target address (object); at this intersection, administrators can edit or modify permission information, that is, use the protocol and target port combination separated by preset delimiters to achieve control over specific network access behaviors. After the access control matrix is ​​built and edited, the network firewall or other security management and control equipment matches and filters network access behaviors according to the rules in the matrix to achieve access control.

[0090] By taking the source address as the subject, the target address as the object, and the combination of the protocol and the target port as the permission information, an intuitive and easy-to-understand access control matrix is ​​constructed, so that when managers edit access control rules, they only need to find the corresponding row and column intersections to edit, which greatly simplifies the complexity of rule management and improves work efficiency. At the same time, this method also improves the matching efficiency of rules and business needs, providing strong support for the network security protection of enterprises.

[0091] Optionally, the source address is used as the subject, the target address is used as the object, and the protocol and the target port separated by a preset separator are used as permissions to obtain an access control matrix, including:

[0092] generating an object capability table header based on all the target addresses;

[0093] Decoding the subject capability table of the source address one by one, generating a row in the control matrix, namely, data of the target structure, and adding it to the output buffer; wherein the target structure includes a dictionary structure;

[0094] The data in the dictionary structure are parsed in turn, and the corresponding header display data is matched to obtain an access control matrix.

[0095] Optionally, also include:

[0096] Determine whether the target network device and / or the path network device need to generate rules;

[0097] When the target network device and / or the path network device need to generate a rule, adding a first identifier to the target network device and / or the path network device;

[0098] When the target network device and / or the path network device do not need to generate a rule, a second identifier is added to the target network device and / or the path network device.

[0099] S130: Automatically generate corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix;

[0100] In a specific implementation of the present specification, the user enters the source address and target address information, and uses the same processing flow to process both; given that the same device may be used as both the source address and the target address in multiple rules, the system supports adding the address information to the subject capability table and the object information table at the same time; the subject capability table is used to record devices that can be used as source addresses and their related information, and the object information table is used to record devices that can be used as target addresses and their related information.

[0101] Enter the information of all network devices that perform three-layer routing forwarding in the network, including device name, network interface address and mask, etc. For firewall devices that need to generate access control rules, they should be specially marked when entering, and it should be noted that rules need to be generated, i.e. the first mark; firewalls or routers directly connected to the Internet should be marked to distinguish their special role as network boundaries, i.e. the second mark; according to the rule instruction format requirements of different devices, enter the corresponding rule template to generate access control rules that meet the device requirements.

[0102] For example, $src represents the source address, $dst represents the destination address, $proto represents the protocol, and $port represents the destination port. If the device is a Huawei firewall, the rule template entered is:

[0103] Ip service-set $proto-$port

[0104] Service 0protocol$proto destination-port$port

[0105] quit

[0106] security-policy

[0107] Rule name$src-$dst-$port

[0108] Source-address$src

[0109] Destination-address$dst

[0110] service$proto-$port

[0111] action permit

[0112] quit

[0113] ).

[0114] For the target network device and its access control matrix, the access control rules applicable to the network device are automatically generated based on the source address (subject), target address (object) and permission information (such as protocol, port, etc.) defined in the matrix; for the path network device and its access control matrix, the forwarding or filtering rules on the path device are also automatically generated based on the matrix information to ensure the correct transmission and access control of data in the network; the generated rules must comply with the entered rule template format to ensure that the rules can be correctly parsed and executed by the target network device or the path network device. The generated access control rules are verified to ensure that there are no rule conflicts, no redundancy, and that they meet business needs; the rules are optimized and adjusted based on the verification results to improve the security and efficiency of the network.

[0115] Optionally, the S130 includes:

[0116] Obtaining the IP and mask of the target network device and / or the route network device;

[0117] Taking the IP and mask of the target network device and / or the routed network device as the primary key, a network device interface dictionary is constructed; wherein the IP and the mask are used as the key of the network device interface dictionary, and the device name of the target network device and / or the routed network device is used as the value of the network device interface dictionary;

[0118] Traversing the network device interface dictionary, determining the interface network segment of each network interface based on the IP and the mask, and constructing a network segment array dictionary; wherein the interface network segment is used as the key of the network segment array dictionary, and the device name of the target network device and / or the path network device is used as the value of the network device interface dictionary;

[0119] Traverse the network segment array dictionary, extract the key with value>1 in the network segment array dictionary, determine that the corresponding target network device and / or the path network device are associated, and construct a device neighbor table; wherein the device name of the target network device and / or the path network device is used as the key of the device neighbor table, and the associated target network device and / or the path network device is used as the value of the device neighbor table;

[0120] Traversing the device neighbor table, recursively querying the key in the device neighbor table, taking all the network devices in the path that are not direct neighbors of the target network device as the key of the device routing information table, and taking the device names of all the network devices in the path as the value of the device routing information table;

[0121] The device routing information table is traversed, and the target network device and / or the path network device added with the second identifier are directly added to the Internet boundary device table, and the device name of the target network device and / or the path network device added with the first identifier is used as the key of the access control rule set, and the access control rule information of the target network device and / or the path network device added with the first identifier is used as the value of the access control rule set to obtain the access control rule set.

[0122] In the specific implementation of this specification, the network device interface dictionary is traversed, the interface segment of each network interface is determined based on the IP and mask, and a segment array dictionary is constructed, for example: {"subject":"source address 1","destination address 1":"tcp:80,443","destination address 2":"tcp:3389"}).

[0123] After reading a source address capability table record, the system will first decode it. Then, the system will go through each decoded element one by one. For each target element, the system will independently generate an access control list (ACL) record. Taking the sample data {"subject":"source address 1","destination address 1":"tcp:80,443","destination address 2":"tcp:3389"} as an example, this data will be split into the following two ACL records: Source address 1 is allowed to access TCP ports 80 and 443 of destination address 1. Source address 1 is allowed to access TCP port 3389 of destination address 2. Through this processing method, the system can ensure that each ACL record clearly and accurately reflects the access control relationship between the source address and the destination address.

[0124] Optionally, the S130 further includes:

[0125] Match the source address and the target address respectively based on the network segment array dictionary to determine a source device set and a target device set;

[0126] If the source device set or the target device set is empty, use the devices in the Internet edge device table as corresponding set members; if both the source device set and the target device set are empty, execution ends;

[0127] Checking the first hop device and the last call device in each path device information based on the device routing information table, if they are the same as the source device or the target device, discarding the corresponding path device information;

[0128] Based on the access control rule set, corresponding access control rules are matched for the target network device and the path network device.

[0129] In a specific implementation of the present specification, based on the network segment array dictionary (Net_Devices), the source address and the target address are matched respectively to determine the source device set and the target device set; if the source device set is empty, the devices in the Internet edge device table (Edge_Device) are used as members of the source device set; if the target device set is empty, the devices in the Internet edge device table (Edge_Device) are used as members of the target device set; if both the source device set and the target device set are empty, the execution ends and no access control rules are generated (i.e., neither the source address nor the target address is in this network). Based on the device routing information table (Device_Routes), the first hop device and the last hop device in each path device information are checked; if the first hop device is the same as any device in the source device set, or the last hop device is the same as any device in the target device set, the path device information is regarded as duplicate invalid information and discarded; this step is intended to remove records that are duplicated with other path device information from the second hop to the second to last hop information to improve the efficiency of subsequent processing. For the source devices, target devices and path devices that have been screened in the above steps, use the device name to call the access control rule set dictionary (Devices_Rules); if there is a record of the corresponding device name in the access control rule set dictionary, it is necessary to generate access control rules for the device; add the current rules (including source address, target address, path device information and corresponding access control policy) to the value of the corresponding device name in the access control rule set dictionary; this step is to ensure that each device has corresponding access control rules, and these rules can accurately reflect the access relationship between devices.

[0130] By accurately matching the source address and the destination address, determining the source device set and the destination device set, and checking the validity of the path device information based on the device routing information table, an accurate set of access control rules is finally generated. This method improves the efficiency and accuracy of generating network device access control rules, and provides strong support for network security management.

[0131] S140: configuring the access control rules to the target network device and the path network device accordingly, so as to implement access control of the target network device and the path network device.

[0132] Optionally, the S140 includes:

[0133] The access control rules are written into the configuration file of the target network device or the route network device, and the device name is used as the file name to implement access control of the target network device and the route network device.

[0134] In the specific implementation of this specification, the rule set is written into a configuration file named after the device name; the configuration file of each device uses the name of the device as the file name to facilitate subsequent management and deployment; the content of the configuration file is the access control rules that the device needs to execute, including key information such as source address, destination address, protocol type, port number, etc. The generated configuration file is transmitted to the corresponding target network device and the path network device; the configuration file is loaded or applied on the device so that the device can perform access control according to the rules in the configuration file; during the deployment process, the correctness and completeness of the configuration file are ensured to avoid security issues caused by errors or omissions in the rules. The deployed network devices are verified and tested to ensure that the access control rules can take effect correctly; the execution and effect of the rules are checked by simulating access requests and monitoring network traffic; the rules are adjusted and optimized as necessary according to the verification results to improve the security and stability of the network.

[0135] In the present invention, an intuitive and structured interface is provided through the access control matrix, so that managers can clearly view, edit and manage network access control rules. This two-dimensional table form greatly simplifies the management process of rules, so that even in the case of a large number of rules, rules can be easily found, added and modified. The access control matrix can systematically organize and manage network access control rules, avoiding conflicts and redundancies between rules. At the same time, through automated data processing and conversion mechanisms (such as converting the access control matrix into a capability table with source address as the primary key), the method improves the efficiency and accuracy of rule processing. Since the access control matrix stores rules in a structured manner, audit reports and statistical information can be easily generated. This helps managers to regularly evaluate and review the effectiveness, compliance and security of network access control policies. Through the automatic matching of multiple devices, firewalls and other network devices in the entire network can be intelligently identified, and corresponding access control rules can be automatically generated and matched according to the network topology and access control requirements. This greatly reduces the burden on firewall operators, and there is no need to manually consider which devices the rules should be configured on, thereby improving the efficiency and accuracy of network management. Through refined access control strategies, this method can effectively prevent unauthorized access and data leakage, and protect the security of network resources and sensitive information. At the same time, by regularly updating and optimizing access control rules, it can adapt to changes in network environment and business needs, ensuring the security and stability of the network.

[0136] Figure 2 A schematic diagram of a principle of an access control device based on an access control matrix provided in an embodiment of this specification, the device may include:

[0137] The acquisition module 10 is used to obtain the source address, the destination address, the protocol, and the destination port;

[0138] A first generating module 20, configured to generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix;

[0139] A second generation module 30, for automatically generating corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix;

[0140] The configuration module 40 is used to configure the access control rules to the target network device and the path network device accordingly, so as to implement access control of the target network device and the path network device.

[0141] Optionally, the first generating module includes:

[0142] The source address is taken as the subject, the target address is taken as the object, and the protocol and the target port separated by a preset separator are taken as permissions to obtain an access control matrix.

[0143] Optionally, the source address is used as the subject, the target address is used as the object, and the protocol and the target port separated by a preset separator are used as permissions to obtain an access control matrix, including:

[0144] generating an object capability table header based on all the target addresses;

[0145] Decoding the subject capability table of the source address one by one, generating a row in the control matrix, namely, data of the target structure, and adding it to the output buffer; wherein the target structure includes a dictionary structure;

[0146] The data in the dictionary structure are parsed in turn, and the corresponding header display data is matched to obtain an access control matrix.

[0147] Optionally, also include:

[0148] Determine whether the target network device and / or the path network device need to generate rules;

[0149] When the target network device and / or the path network device need to generate a rule, adding a first identifier to the target network device and / or the path network device;

[0150] When the target network device and / or the path network device do not need to generate a rule, a second identifier is added to the target network device and / or the path network device.

[0151] Optionally, the second generating module includes:

[0152] Obtaining the IP and mask of the target network device and / or the route network device;

[0153] Taking the IP and mask of the target network device and / or the routed network device as the primary key, a network device interface dictionary is constructed; wherein the IP and the mask are used as the key of the network device interface dictionary, and the device name of the target network device and / or the routed network device is used as the value of the network device interface dictionary;

[0154] Traversing the network device interface dictionary, determining the interface network segment of each network interface based on the IP and the mask, and constructing a network segment array dictionary; wherein the interface network segment is used as the key of the network segment array dictionary, and the device name of the target network device and / or the path network device is used as the value of the network device interface dictionary;

[0155] Traverse the network segment array dictionary, extract the key with value>1 in the network segment array dictionary, determine that the corresponding target network device and / or the path network device are associated, and construct a device neighbor table; wherein the device name of the target network device and / or the path network device is used as the key of the device neighbor table, and the associated target network device and / or the path network device is used as the value of the device neighbor table;

[0156] Traversing the device neighbor table, recursively querying the key in the device neighbor table, taking all the network devices in the path that are not direct neighbors of the target network device as the key of the device routing information table, and taking the device names of all the network devices in the path as the value of the device routing information table;

[0157] The device routing information table is traversed, and the target network device and / or the path network device added with the second identifier are directly added to the Internet boundary device table, and the device name of the target network device and / or the path network device added with the first identifier is used as the key of the access control rule set, and the access control rule information of the target network device and / or the path network device added with the first identifier is used as the value of the access control rule set to obtain the access control rule set.

[0158] Optionally, the second generating module further includes:

[0159] Match the source address and the target address respectively based on the network segment array dictionary to determine a source device set and a target device set;

[0160] If the source device set or the target device set is empty, use the devices in the Internet edge device table as corresponding set members; if both the source device set and the target device set are empty, execution ends;

[0161] Checking the first hop device and the last call device in each path device information based on the device routing information table, if they are the same as the source device or the target device, discarding the corresponding path device information;

[0162] Based on the access control rule set, corresponding access control rules are matched for the target network device and the path network device.

[0163] Optionally, the configuration module includes:

[0164] The access control rules are written into the configuration file of the target network device or the route network device, and the device name is used as the file name to implement access control of the target network device and the route network device.

[0165] The functions of the device in the embodiment of the present invention have been described in the above method embodiment, so for details not provided in the description of this embodiment, please refer to the relevant description in the above embodiment, and no further description will be given here.

[0166] Based on the same inventive concept, an embodiment of this specification also provides an electronic device.

[0167] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0168] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Figure 3 The electronic device 300 according to the embodiment of the present invention is described. Figure 3 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0169] like Figure 3 As shown, the electronic device 300 is in the form of a general computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components (including the storage unit 320 and the processing unit 310), a display unit 340, etc.

[0170] The storage unit stores program codes, which can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the above processing method section of this specification. For example, the processing unit 310 can perform the following steps: Figure 1 Steps shown.

[0171] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .

[0172] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0173] Bus 330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0174] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable viewers to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 through the bus 330. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0175] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, including a number of instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the present invention. When the computer program is executed by a data processing device, the computer-readable medium can implement the above method of the present invention, that is: Figure 1 The method shown.

[0176] Figure 4 A schematic diagram of a computer-readable medium provided for an embodiment of this specification.

[0177] accomplish Figure 1 The computer program of the method shown can be stored on one or more computer readable media. The computer readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0178] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0179] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the viewer computing device, partially on the viewer device, as a stand-alone software package, partially on the viewer computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the viewer computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0180] In summary, the present invention can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that general data processing devices such as microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0181] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0182] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0183] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An access rule management method based on an access control matrix, characterized in that: include: Get the source address, destination address, protocol, and destination port; Generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix; Based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, corresponding access control rules are automatically generated for the target network device and the path network device; The access control rules are configured to the target network device and the path network device accordingly to implement access control of the target network device and the path network device.

2. The access rule management method based on the access control matrix according to claim 1, characterized in that: The generating of the access control matrix based on the source address, the target address, the protocol, and the target port includes: The source address is taken as the subject, the target address is taken as the object, and the protocol and the target port separated by a preset separator are taken as permissions to obtain an access control matrix.

3. The access rule management method based on the access control matrix according to claim 2, characterized in that: The source address is used as the subject, the target address is used as the object, and the protocol and the target port separated by a preset separator are used as permissions to obtain an access control matrix, including: generating an object capability table header based on all the target addresses; Decoding the subject capability table of the source address one by one, generating a row in the control matrix, namely, data of the target structure, and adding it to the output buffer; wherein the target structure includes a dictionary structure; The data in the dictionary structure are parsed in turn, and the corresponding header display data is matched to obtain an access control matrix.

4. The access rule management method based on the access control matrix according to claim 3, characterized in that: Also includes: Determine whether the target network device and / or the path network device need to generate rules; When the target network device and / or the path network device need to generate a rule, adding a first identifier to the target network device and / or the path network device; When the target network device and / or the path network device do not need to generate a rule, a second identifier is added to the target network device and / or the path network device.

5. The access rule management method based on the access control matrix according to claim 4, characterized in that: The automatically generating corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, includes: Obtaining the IP and mask of the target network device and / or the route network device; Taking the IP and mask of the target network device and / or the routed network device as the primary key, a network device interface dictionary is constructed; wherein the IP and the mask are used as the key of the network device interface dictionary, and the device name of the target network device and / or the routed network device is used as the value of the network device interface dictionary; Traversing the network device interface dictionary, determining the interface network segment of each network interface based on the IP and the mask, and constructing a network segment array dictionary; wherein the interface network segment is used as the key of the network segment array dictionary, and the device name of the target network device and / or the path network device is used as the value of the network device interface dictionary; Traverse the network segment array dictionary, extract the key with value>1 in the network segment array dictionary, determine that the corresponding target network device and / or the path network device are associated, and construct a device neighbor table; wherein the device name of the target network device and / or the path network device is used as the key of the device neighbor table, and the associated target network device and / or the path network device is used as the value of the device neighbor table; Traversing the device neighbor table, recursively querying the key in the device neighbor table, taking all the network devices in the path that are not direct neighbors of the target network device as the key of the device routing information table, and taking the device names of all the network devices in the path as the value of the device routing information table; The device routing information table is traversed, and the target network device and / or the path network device added with the second identifier are directly added to the Internet boundary device table, and the device name of the target network device and / or the path network device added with the first identifier is used as the key of the access control rule set, and the access control rule information of the target network device and / or the path network device added with the first identifier is used as the value of the access control rule set to obtain the access control rule set.

6. The access rule management method based on the access control matrix according to claim 5, characterized in that: The method of automatically generating corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix, respectively, also includes: Match the source address and the target address respectively based on the network segment array dictionary to determine a source device set and a target device set; If the source device set or the target device set is empty, use the devices in the Internet edge device table as corresponding set members; if both the source device set and the target device set are empty, execution ends; Checking the first hop device and the last call device in each path device information based on the device routing information table, if they are the same as the source device or the target device, discarding the corresponding path device information; Based on the access control rule set, corresponding access control rules are matched for the target network device and the path network device.

7. The access rule management method based on the access control matrix according to claim 6, characterized in that: The step of configuring the access control rules to the target network device and the path network device to implement access control of the target network device and the path network device includes: The access control rules are written into the configuration file of the target network device or the route network device, and the device name is used as the file name to implement access control of the target network device and the route network device.

8. An access control device based on an access control matrix, characterized in that: include: The acquisition module is used to obtain the source address, destination address, protocol, and destination port; A first generating module, configured to generate an access control matrix based on the source address, the target address, the protocol, and the target port, and determine a target network device and a passing network device based on the access control matrix; A second generation module is used to automatically generate corresponding access control rules for the target network device and the path network device based on the target network device and its access control matrix, the path network device and its access control matrix; The configuration module is used to configure the access control rules to the target network device and the path network device accordingly, so as to implement access control of the target network device and the path network device.

9. An electronic device, wherein: The electronic device includes: processor; and, A memory storing computer executable instructions which, when executed, cause the processor to perform a method according to any one of claims 1-7.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method of any one of claims 1 to 7 is implemented.

Images