Firewall policy verification method and device and storage medium

Abstract

The invention discloses a firewall policy verification method and device and a storage medium. Relates to the field of cloud computing, and the method comprises the steps that after a verification request for a firewall policy is detected, information of the firewall policy is determined, and the information of the firewall policy at least comprises a source machine address and a target machine address; generating a policy verification instruction based on the source machine address and the destination machine address; in response to the strategy verification instruction, a temporary static route is configured, and the temporary static route is used for connecting the target machine and the target container instance; according to the strategy verification instruction, the control center generates a container configuration list; and verifying the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result. Through application of the method and the device, the problem that verification cannot be carried out when the operation of remotely logging in the source address machine does not have permission to execute a firewall policy in a mode of initiating access through the source address machine in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and in particular to a firewall policy verification method, device and storage medium. Background Art

[0002] In the field of information network security, the verification of firewall policies is an important part of ensuring network communication security and business continuity. As the first line of defense of the network, the accuracy of firewall policy settings is directly related to whether it can effectively resist external attacks, prevent sensitive data leakage, and ensure legal access to internal network resources. Therefore, timely and effective verification of firewall policies is crucial to maintaining network security.

[0003] Traditional firewall policy verification methods mainly rely on initiating network access requests directly through the source address machine to test whether the firewall can release or block data flows according to the expected policy. This method is effective when the source address machine is in a controllable environment. The network administrator can log in to the source address machine, execute access commands manually or through scripts, and then observe the response of the destination address to determine whether the firewall policy is correctly implemented. However, in scenarios such as bank-enterprise interconnection and inter-bank interconnection, a significant problem is that the source address machine is often not under the management of the financial institution, but is controlled by a partner or a third party. For example, the other end of an enterprise-level dedicated line or an Internet VPN dedicated line may be a server or network device of a partner enterprise or regulatory department. In this case, the network administrator does not have the authority to remotely log in to the partner's source address machine, and cannot directly initiate a verification request through the source address. This permission restriction not only increases the difficulty of firewall policy verification, but also makes it difficult to automate the verification process, reducing the efficiency and coverage of verification.

[0004] With regard to the problem in the related art of verifying firewall policies by initiating access through a source address machine, verification cannot be performed when there is no permission to perform operations of remotely logging into the source address machine. No effective solution has been proposed yet. Summary of the invention

[0005] The main purpose of the present application is to provide a firewall policy verification method, device and storage medium to solve the problem in the related art that the firewall policy is verified by initiating access through the source address machine, and verification cannot be performed when there is no permission to perform the operation of remotely logging into the source address machine.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for verifying a firewall policy is provided. The method comprises: after detecting a verification request for a firewall policy, determining information of the firewall policy, wherein the information of the firewall policy includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; in response to the policy verification instruction, configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; performing verification on the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result.

[0007] Furthermore, generating a policy verification instruction based on the source machine address and the destination machine address includes: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; if the direction verification result is a forward access relationship, generating a first policy verification instruction, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; if the direction verification result is a reverse access relationship, generating a second policy verification instruction, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0008] Further, in the case of generating the first policy verification instruction, responding to the policy verification instruction, configuring a temporary static route includes: responding to the first policy verification instruction, constructing an internal detection zone in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate a source machine in the internal zone of the firewall; remotely logging into the internal core router through the control center, and configuring a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address in the internal zone of the firewall.

[0009] Furthermore, after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method also includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of the first container configuration list, and the first container configuration list includes information for configuring the first container instance and the first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance; executes the first verification script through the first container instance to obtain a first verification result; sends the first verification result to the first container instance through the first temporary static route; after receiving the first verification result through the first container instance, sends the first verification result to the control center.

[0010] Furthermore, in the case of generating a second policy verification instruction, responding to the policy verification instruction and configuring a temporary static route includes: responding to the second policy verification instruction, constructing an external detection zone in the external zone of the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate a source machine in the external zone of the firewall; remotely logging into an external core router through a control center, and configuring a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the external zone of the firewall.

[0011] Furthermore, after remotely logging into the external core router through the control center and configuring the second temporary static route, the method also includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of the second container configuration list, and the second container configuration list includes information for configuring the second container instance and the second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; executes the second verification script through the second container instance to obtain a second verification result; sends the second verification result to the second container instance through the second temporary static route; after receiving the second verification result through the second container instance, sends the second verification result to the control center.

[0012] Furthermore, after performing verification on the firewall policy based on the temporary static route, the target container instance and the verification script to obtain the verification result, the method also includes: if the verification result indicates that the access verification passes and the hop tracking reaches the destination machine, then the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracking passes the firewall, then the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracking does not pass the firewall, then the firewall policy is determined to be invalid.

[0013] Furthermore, after verifying the firewall policy based on the temporary static route, the target container instance and the verification script and obtaining the verification result, the method also includes: deleting the temporary static route through the control center; sending a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to close the target container instance; after the container cloud platform receives the shutdown request, the target container instance is closed.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a firewall policy verification device is provided. The device includes: a first determination unit, which is used to determine the information of the firewall policy after detecting the verification request for the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; a first generation unit, which is used to generate a policy verification instruction based on the source machine address and the destination machine address; a response unit, which is used to respond to the policy verification instruction and configure a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; a second generation unit, which is used to generate a container configuration list by the control center according to the policy verification instruction, wherein the container configuration list includes information for configuring the target container instance and the verification script; a verification unit, which is used to perform verification on the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result.

[0015] Furthermore, the first generation unit includes: a verification module, which is used to verify the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; a first generation module, which is used to generate a first policy verification instruction if the direction verification result is a forward access relationship, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; and a second generation module, which is used to generate a second policy verification instruction if the direction verification result is a reverse access relationship, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0016] Furthermore, the response unit includes: a first response module, which is used to respond to the first policy verification instruction when the first policy verification instruction is generated, and construct an internal detection zone in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine in the internal zone of the firewall; a first configuration module, which is used to remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address in the internal zone of the firewall.

[0017] Furthermore, the device also includes: a first sending unit, which is used to send a first configuration generation request to the internal container cloud platform through the control center after remotely logging into the internal core router through the control center and configuring the first temporary static route, wherein the first configuration generation request carries information of the first container configuration list, and the first container configuration list includes information for configuring the first container instance and the first verification script; a third generating unit, which is used to generate the first container instance and start the first container instance after the internal container cloud platform receives the first configuration generation request; a first execution unit, which is used to execute the first verification script through the first container instance to obtain a first verification result; a second sending unit, which is used to send the first verification result to the first container instance through the first temporary static route; and a third sending unit, which is used to send the first verification result to the control center after receiving the first verification result through the first container instance.

[0018] Furthermore, the response unit includes: a second response module, which is used to respond to the second policy verification instruction when the second policy verification instruction is generated, and construct an external detection zone in the external zone of the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine in the external zone of the firewall; a second configuration module, which is used to remotely log in to the external core router through the control center and configure a second temporary static route, wherein the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address of the external zone of the firewall.

[0019] Furthermore, the device also includes: a fourth sending unit, which is used to send a second configuration generation request to the external container cloud platform through the control center after remotely logging into the external core router through the control center and configuring the second temporary static route, wherein the second configuration generation request carries information of the second container configuration list, and the second container configuration list includes information for configuring the second container instance and the second verification script; a fourth generating unit, which is used to generate a second container instance and start the second container instance after the external container cloud platform receives the second configuration generation request; a second executing unit, which is used to execute the second verification script through the second container instance to obtain a second verification result; a fifth sending unit, which is used to send the second verification result to the second container instance through the second temporary static route; and a sixth sending unit, which is used to send the second verification result to the control center after receiving the second verification result through the second container instance.

[0020] Furthermore, the device also includes: a second determination unit, which is used to perform verification on the firewall policy based on the temporary static route, the target container instance and the verification script, and after obtaining the verification result, if the verification result indicates that the access verification is passed and the hop tracking reaches the destination machine, then determine that the firewall policy is valid; a third determination unit, which is used to determine that the firewall policy is valid but the destination machine is not started if the verification result indicates that the access verification fails but the hop tracking passes the firewall; and a fourth determination unit, which is used to determine that the firewall policy is invalid if the verification result indicates that the access verification fails and the hop tracking does not pass the firewall.

[0021] Furthermore, the device also includes: a deletion unit, which is used to perform verification on the firewall policy based on the temporary static route, the target container instance and the verification script, and after obtaining the verification result, delete the temporary static route through the control center; a seventh sending unit, which is used to send a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to close the target container instance; and a closing unit, which is used to close the target container instance after the container cloud platform receives the shutdown request.

[0022] According to another aspect of the present application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein when the program is running, a device where the computer-readable storage medium is located is controlled to execute any firewall policy verification method.

[0023] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a verification method for executing any firewall policy.

[0024] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, which implement the steps of any one of the above-mentioned firewall policy verification methods when executed by a processor.

[0025] In an embodiment of the present application, after detecting a verification request for a firewall policy, the information of the firewall policy is determined, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; a policy verification instruction is generated based on the source machine address and the destination machine address; in response to the policy verification instruction, a temporary static route is configured, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; based on the temporary static route, the target container instance and the verification script, the firewall policy is verified to obtain a verification result, which solves the technical problem that the firewall policy is verified by initiating access through the source address machine in the prior art, and the verification cannot be performed when there is no authority to perform the operation of remotely logging into the source address machine. In the present application, after detecting a verification request for a firewall policy, the information of the firewall policy is determined, the policy verification instruction is generated through the source machine address and the destination machine address in the information of the firewall policy, the temporary static route is configured and the container configuration list is generated according to the generated policy verification instruction, and then the firewall policy can be verified to obtain a verification result, thereby achieving the technical effect of improving the verification efficiency of the firewall policy. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0027] Figure 1 A hardware structure block diagram of a computer terminal for implementing a firewall policy verification method is shown;

[0028] Figure 2 It is a flowchart of a method for verifying a firewall policy according to an embodiment of the present application;

[0029] Figure 3 is a flowchart of executing a first policy verification instruction provided according to an embodiment of the present application;

[0030] Figure 4 is a flowchart of executing a second strategy verification instruction provided according to an embodiment of the present application;

[0031] Figure 5 It is a structural diagram of physical and logical network areas in a method for verifying a firewall policy provided in an embodiment of the present application;

[0032] Figure 6 It is a schematic diagram of a firewall policy verification method provided according to an embodiment of the present application;

[0033] Figure 7is a flowchart of an execution strategy verification end instruction provided according to an embodiment of the present application;

[0034] Figure 8 is a schematic diagram of a firewall policy verification device provided according to an embodiment of the present application;

[0035] Fig. 9 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] Example 1

[0039] According to an embodiment of the present application, a method embodiment for verifying a firewall policy is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0040] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a firewall policy verification method is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0041] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the verification method of the firewall policy in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the verification method of the firewall policy described above is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0044] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0045] Under the above operating environment, this application provides Figure 2 The verification method of the firewall policy shown. Figure 2 It is a flowchart of the firewall policy verification method according to Example 1 of the present application.

[0046] Step S201, after detecting a verification request for a firewall policy, determining information of the firewall policy, wherein the information of the firewall policy at least includes a source machine address and a destination machine address.

[0047] Optionally, the above-mentioned firewall policy can be a series of rules and operations defined in a network firewall to control the flow of data packets in and out of the network. The firewall policy determines whether a data packet is allowed to pass through the firewall and enter or leave the protected network based on preset security rules and business requirements. Firewall policy is one of the core functions of the firewall and is crucial for network security protection. The information of the above-mentioned firewall policy may include network parameters such as source machine address, destination machine address, destination machine service port, protocol type, access type (allow or deny), connection time, etc.

[0048] For example, a financial institution needs to verify a newly set firewall policy that allows transmission control protocol connections from the server of partner enterprise A (source machine address is 192.168.1.100) to the internal server of the firewall policy (destination machine address is 10.0.0.100). In the network architecture of the firewall policy, the firewall is located between the internal detection zone and the external detection zone, and the container cloud platform is deployed in the internal detection zone and the external detection zone to create container instances. After detecting the verification request for this firewall policy, the front-end service collects and determines the information of the firewall policy, including the source machine address (192.168.1.100), the destination machine address (10.0.0.100), the destination machine service port (e.g. 80), the protocol type (e.g., transmission control protocol), etc.

[0049] Step S202: Generate a policy verification instruction based on the source machine address and the destination machine address.

[0050] Optionally, the above-mentioned policy verification instructions are used to instruct the container cloud platform to perform specific actions to verify the validity of the firewall policy. The policy verification instructions can be divided into two types: a first policy verification instruction and a second policy verification instruction. The first policy verification instruction is used to verify the firewall policy that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall, and the second policy verification instruction is used to verify the firewall policy that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0051] Step S203, in response to the policy verification instruction, a temporary static route is configured, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address.

[0052] For example, the control center remotely logs in to the financial institution's internal core router and configures a temporary static route with the destination address being the source machine address 192.168.1.100 and the next hop pointing to the internal detection zone. This temporary static route ensures that the response data packet of the destination machine will be sent to the container instance in the internal detection zone, rather than entering the financial institution's internal business zone or directly returning to the source machine.

[0053] Step S204: According to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script.

[0054] For example, the control center automatically generates a container configuration list that describes in detail the configuration information of the target container instance, including the network card IP address set to 192.168.1.100 (simulating the source machine address). After the container is started, a verification script is executed immediately. The script contains a series of commands to test whether the transmission control protocol connection is successful.

[0055] Step S205 , verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result.

[0056] For example, the internal container cloud platform generates and starts the target container instance according to the container configuration list. After the target container instance is started, the verification script is automatically executed to initiate a transmission control protocol connection request to the destination machine address 10.0.0.100. Due to the existence of temporary static routing, the response information of the destination machine will be returned to the target container instance. The target container instance analyzes the response information to determine whether the firewall policy is effective, and finally returns the verification result to the control center, which then analyzes and feeds back to the front-end service.

[0057] Through the above technical solution, the automation of firewall policy verification is realized, and there is no need to manually log in to the source machine to perform the test, which reduces the complexity and error rate of manual operation and greatly improves the verification efficiency. Therefore, financial institutions can not only verify the effectiveness of firewall policies efficiently and accurately, but also reduce labor costs and improve the efficiency and flexibility of network management.

[0058] In summary, the firewall policy verification method provided by the embodiment of the present application determines the information of the firewall policy after detecting the verification request for the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; generates a policy verification instruction based on the source machine address and the destination machine address; responds to the policy verification instruction, configures a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; based on the temporary static route, the target container instance and the verification script, the firewall policy is verified to obtain the verification result, which solves the technical problem that the firewall policy is verified by initiating access by the source address machine in the prior art, and the verification cannot be performed when there is no authority to perform the operation of remotely logging in to the source address machine. In the present application, after detecting the verification request for the firewall policy, the information of the firewall policy is determined, the policy verification instruction is generated by the source machine address and the destination machine address in the information of the firewall policy, the temporary static route is configured and the container configuration list is generated according to the generated policy verification instruction, and then the firewall policy can be verified to obtain the verification result, thereby achieving the technical effect of improving the verification efficiency of the firewall policy.

[0059] In an optional embodiment, generating a policy verification instruction based on a source machine address and a destination machine address includes the following steps:

[0060] Step 1: Verify the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result.

[0061] Optionally, the control center can determine the transmission direction of the data flow in the firewall policy based on the source machine address and the destination machine address in the firewall policy information. If the source machine address is located in the internal area of ​​the firewall, and the destination machine address is located in the external area of ​​the firewall, the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall, which is called a forward access relationship; conversely, if the source machine address is located in the external area of ​​the firewall, and the destination machine address is located in the internal area of ​​the firewall, the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall, which is called a reverse access relationship.

[0062] Step 2: If the direction verification result is a forward access relationship, a first policy verification instruction is generated, wherein the forward access relationship means that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall.

[0063] Optionally, when it is determined that the transmission direction of the data flow is a forward access relationship, the control center can generate a first policy verification instruction. The first policy verification instruction can include necessary information for creating a container instance on the container cloud platform of the internal detection zone, simulating the network behavior of the source machine, and configuring a temporary static route to ensure that the verification request data packet initiated from the internal detection zone to the firewall external zone can be correctly routed to the destination machine, and at the same time, the response data packet of the destination machine will also be correctly routed back to the container instance of the internal detection zone.

[0064] Step three: if the direction verification result is a reverse access relationship, a second policy verification instruction is generated, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0065] Optionally, when the transmission direction of the data flow is a reverse access relationship, the control center can generate a second policy verification instruction. The second policy verification instruction is used to create a container instance on the container cloud platform in the external detection zone and configure a temporary static route to ensure that the verification request data packet initiated from the external detection zone to the internal zone can be correctly routed to the destination machine. At the same time, the response data packet of the destination machine will also be correctly routed back to the container instance in the external detection zone.

[0066] For example, a financial institution wants to verify a firewall policy that allows a server from a cooperative enterprise D (the source machine address is 203.0.113.50, located in the firewall's external zone) to access a server inside the financial institution (the destination machine address is 10.0.1.100, located in the firewall's internal zone), and the allowed communication protocol is HTTP (port 80). The control center will first verify that this is an access request from the firewall's external zone to the firewall's internal zone, i.e., a reverse access relationship. Then, because it is a reverse access relationship, the control center generates a second policy verification instruction, which contains the source machine address 203.0.113.50 and the destination machine address 10.0.1.100, as well as other related parameters, such as the destination port 80 and the protocol HTTP.

[0067] In summary, the above technical solution improves the flexibility and response speed of verification by automatically identifying the transmission direction of the data flow and generating corresponding policy verification instructions, which facilitates subsequent policy adjustments.

[0068] In an optional embodiment, when the first policy verification instruction is generated, in response to the policy verification instruction, configuring a temporary static route may include the steps of:

[0069] In the first step, in response to the first policy verification instruction, an internal detection zone is constructed in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate a source machine in the internal zone of the firewall.

[0070] Optionally, an internal detection zone is constructed in the internal zone of the firewall. A network administrator may designate a dedicated area as the internal detection zone. This area is constructed to safely verify the firewall policy without affecting the actual business network. In this internal detection zone, the control center may generate and start a first container instance. The configuration and behavior of this first container instance will simulate the source machine in the internal zone of the firewall, and is used to initiate an access request to verify the validity of the policy.

[0071] The second step is to remotely log in to the internal core router through the control center and configure the first temporary static route, where the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address of the internal zone of the firewall.

[0072] Optionally, in order to ensure that the data packets in the verification process can be correctly routed to the first container instance in the internal detection zone, rather than directly sent to the actual external destination address, the control center can remotely log in to the internal core router and configure a first temporary static route. The first temporary static route has the highest priority, and the destination address is set to the source machine address in the internal zone of the firewall (that is, the address of the first container instance), and the next hop points to the internal detection zone. In this way, all verification requests sent from the source machine address and the responses from the destination address will be directed to the internal detection zone through this temporary route and received and processed by the first container instance.

[0073] For example, a financial institution needs to verify the validity of a firewall policy that allows an internal server (source machine address is 192.168.10.50, located in the internal zone of the firewall) to access the Hypertext Transfer Protocol (HTTP) service of an external website (for example, the destination machine address is 8.8.8.8, external zone). In the architecture of the internal network of the financial institution, the firewall is located between the internal detection zone and the external detection zone. The control center builds an internal detection zone in the internal zone of the firewall, where a first container instance will be generated. The IP address of the container instance is set to 192.168.10.50 to simulate the access behavior of the internal server. This container instance will run a simple script to initiate an HTTP connection request. The control center remotely logs in to the internal core router and configures a first temporary static route with the destination address set to 192.168.10.50 and the next hop pointing to the internal detection zone. This route ensures that all access requests from 192.168.10.50 can be redirected to the first container instance in the internal detection zone, rather than being sent directly to the external destination address 8.8.8.8.

[0074] In summary, through the above technical solution, the internal detection area is constructed and the first temporary static route is configured, which ensures that the data in the verification process will not be leaked to the external network, thereby protecting the security of the internal network.

[0075] In an optional embodiment, if Figure 3 As shown, after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes:

[0076] Step S301: Send a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of a first container configuration list, and the first container configuration list includes information for configuring a first container instance and a first verification script.

[0077] Optionally, the first container configuration list may include all configuration information required to start the first container instance, such as network parameters, IP address (simulating the address of the internal source machine), and the first verification script. The first configuration generation request is initiated by the control center to generate and start the first container instance to simulate the behavior of the source machine, thereby verifying the effectiveness of the firewall policy. The first configuration generation request carries the information of the first container configuration list to ensure that the container instance can accurately simulate a specific network environment and access behavior.

[0078] Step S302: After receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance.

[0079] Optionally, after receiving the first configuration generation request, the internal container cloud platform can create a first container instance according to the first container configuration list and immediately start the first container instance. Configuring the first container instance with the same address as the internal source machine can simulate the source machine of the internal network.

[0080] Step S303: Execute a first verification script through the first container instance to obtain a first verification result.

[0081] Optionally, the first verification script may include a command for testing the validity of the firewall policy to confirm whether the data can pass through the firewall smoothly according to the firewall policy.

[0082] Step S304: Send the first verification result to the first container instance through the first temporary static route.

[0083] Optionally, after the first verification script is executed, the first container instance generates a first verification result, which may include information about whether the firewall policy allows access, and details of the firewall's behavior during the access process. The first verification result can be sent back to the first container instance through the first temporary static route, which ensures a closed loop of test data and avoids impact on the external network.

[0084] Step S305: After receiving the first verification result through the first container instance, the first verification result is sent to the control center.

[0085] Optionally, after the first verification result is sent to the control center, the control center may analyze the result to determine the effectiveness of the firewall policy, and may feed back the result to the front-end service or network administrator.

[0086] In summary, through the above technical solution, the first container instance simulates the network environment and access behavior of the internal source machine, which can accurately test the effectiveness of the firewall policy and ensure the reliability of the verification results. Secondly, the first container instance is isolated from the real business environment, which can reduce the impact of the test process on the production system, and also avoid the security risks that may be caused by directly operating the external source machine.

[0087] In an optional embodiment, when the second policy verification instruction is generated, in response to the policy verification instruction, configuring a temporary static route may include the following steps:

[0088] In the first step, in response to the second policy verification instruction, an external detection zone is constructed in the external zone of the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate a source machine in the external zone of the firewall.

[0089] Optionally, an external detection zone for testing can be built in the firewall external zone, which is specifically used to generate and manage the second container instance for firewall policy verification. By operating in the external detection zone, direct access to the actual external source machine can be avoided, reducing security risks and making the testing process more flexible and controllable.

[0090] The second step is to remotely log in to the external core router through the control center and configure the second temporary static route, where the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address of the firewall external zone.

[0091] Optionally, configuring a second temporary static route with the highest priority can ensure that the verification request data packet sent from the source machine address is sent to the second container instance in the external detection zone instead of being directly sent to the internal business zone.

[0092] For example, a financial institution needs to verify whether its firewall correctly opens HTTPS (port 443) access from the external partner enterprise E (source machine address is 123.123.123.123) to the internal server (destination machine address is 10.0.0.10). First, an area is demarcated outside the firewall as an external detection area, which is isolated from the network environment of the actual partner enterprise and is used to generate and manage the second container instance. Next, the control center remotely logs in to the external core router and configures a second temporary static route with a destination address of 123.123.123.123 and a next hop pointing to the external detection area. This route ensures that all HTTPS access requests issued from 123.123.123.123 will be redirected to the second container instance in the external detection area, and will not directly reach the internal server of the financial institution through a dedicated communication line.

[0093] In summary, through the above steps, a container instance is built in the external detection area, which avoids the uncontrollable risks brought by directly operating the external source machine. At the same time, it also ensures that the verification process will not affect the internal business area, thereby improving the security of the overall network.

[0094] In an optional embodiment, if Figure 4 As shown, after remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes:

[0095] Step S401: Send a second configuration generation request to an external container cloud platform through a control center, wherein the second configuration generation request carries information of a second container configuration list, and the second container configuration list includes information for configuring a second container instance and a second verification script.

[0096] Optionally, the control center generates a second container configuration list, which may include network parameters, IP addresses, and a second verification script for reverse access verification. Subsequently, the control center sends a second configuration generation request to the external container cloud platform, requesting the generation and startup of the second container instance.

[0097] Step S402: After receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance.

[0098] Optionally, after receiving the second configuration generation request, the external container cloud platform builds a second container instance according to the information in the second container configuration list and immediately starts the second container instance. The address of the second container instance is set to the source machine address specified in the firewall policy to simulate the behavior of the external source machine.

[0099] Step S403: Execute a second verification script through the second container instance to obtain a second verification result.

[0100] Optionally, the second verification script can attempt to establish a connection with the destination machine inside the firewall and record whether the connection is successful and any network obstacles encountered on the way, such as firewall blocking. The second verification script can include using a standard network testing tool to check the availability of the HTTPS service.

[0101] Step S404: Send the second verification result to the second container instance through the second temporary static route.

[0102] Optionally, the second verification result can be sent back to the second container instance via the second temporary static route. This is because the second temporary static route has pointed the next hop of the destination machine address to the second container instance in the external detection area, thereby ensuring that all response data packets enter the pre-set test environment.

[0103] Step S405: After receiving the second verification result through the second container instance, the second verification result is sent to the control center.

[0104] Optionally, after receiving the second verification result, the second container instance can forward the second verification result to the control center. The control center can analyze these results to determine whether the firewall policy allows or blocks access from the external source machine to the internal destination machine as expected.

[0105] In summary, through the above steps S401-S405, by building a second container instance in the external detection area, direct operation of the external source machine is avoided, the security risk is reduced, and the test environment is isolated from the actual production network, ensuring the continuity and stability of the existing network operation.

[0106] In an optional embodiment, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain the verification result, the method further includes:

[0107] If the verification result indicates that the access verification is passed and the hop tracking reaches the destination machine, it is determined that the firewall policy is effective.

[0108] Optionally, the above-mentioned hop trace is a network diagnostic tool used to determine the network path that a data packet passes through from a source address to a destination address.

[0109] For example, the firewall policy is designed to allow an internal server (IP address 10.0.0.10) to initiate an HTTPS (port 443) request to access an external website (IP address 8.8.8.8). The first container instance (simulating 10.0.0.10) attempts to establish an HTTPS connection with the external destination address 8.8.8.8. Perform a hop trace to confirm whether the packet has passed the firewall. The verification result is that the HTTPS connection is successful, and the hop trace result shows that the packet has passed the firewall and finally arrived at 8.8.8.8. This shows that the firewall policy allows the internal server to access the external website and the firewall policy is effective.

[0110] If the verification result indicates that access verification failed but hop tracking passed the firewall, it is determined that the firewall policy is effective but the destination machine is not started.

[0111] For example, the firewall policy allows the external partner enterprise E (IP address 130.123.123.123) to initiate an SSH (port 22) request to access the internal server (IP address 10.1.1.20). The second container instance (simulating 130.123.123.123) attempts to establish an SSH connection with the internal destination address 10.1.1.20 and performs a hop trace to confirm whether the data packet passes through the firewall. The verification result is that the SSH connection failed, but the hop trace shows that the data packet did pass through the firewall but failed to reach port 22 of 10.1.1.20. This indicates that the firewall policy allows external access, but it may be that the SSH service of the internal server is not started or the firewall of the internal server blocks the connection, and the policy itself is valid.

[0112] If the verification result indicates that the access verification fails and the hop tracking does not pass the firewall, it is determined that the firewall policy is invalid.

[0113] For example, the firewall policy is designed to allow an internal server (IP address 10.0.0.10) to initiate an SMTP mail service (port 25) request to access an external mail server (IP address 205.123.45.67). The first container instance (simulating 10.0.0.10) attempts to establish an SMTP connection with the external destination address 205.123.45.67, and performs a hop trace to confirm whether the data packet passes through the firewall. The verification result is that the SMTP connection failed, and the hop trace result shows that the data packet failed to pass through the firewall and reach 205.123.45.67. This indicates that the firewall policy may not allow the internal server to access the external mail server, or there is an error in the policy configuration, which needs to be rechecked or adjusted.

[0114] In summary, through the analysis of the above three situations, combining access verification and hop tracking can more accurately evaluate the effectiveness of firewall policies and quickly identify policy configuration problems or destination machine status problems.

[0115] For example, the verification method of the firewall policy based on this embodiment includes entities such as the container cloud platform, container instance, front-end service, and control center, as well as logical network areas such as the external detection area, internal detection area, external interconnection area, and internal business area. Figure 5 Figure 2 shows the structure of the physical and logical network areas in the firewall policy verification method. Figure 6 The following is a schematic diagram of the firewall policy verification method. The firewall policy can be verified by the following steps:

[0116] In the first step, when the front-end service detects a request for firewall policy verification, it first requires the completion and verification of the firewall policy information, and then sends the firewall security policy information and policy verification instructions to the control center;

[0117] In the second step, if the control center receives the first policy verification instruction, it remotely logs into the internal core router and configures a temporary static route with the highest priority;

[0118] In the third step, the control center will automatically generate a container configuration list and request the internal container cloud platform to generate and start the required container instance. After the container instance is started, it will automatically execute the verification script and return the result of the script execution to the control center;

[0119] Step 4: After receiving the second policy verification instruction, the control center remotely logs into the external core router and configures a temporary static route with the highest priority;

[0120] In the fifth step, the control center will automatically generate a container configuration list and request the external container cloud platform to generate and start the required container instance. After the container instance is started, it will automatically execute the verification script and return the result of the script execution to the control center;

[0121] In the sixth step, the control center receives the return result from the container instance, analyzes the result, and sends it to the front-end service for display.

[0122] By verifying the firewall policy through the above steps, container instances are generated in the internal detection zone and the external detection zone, which can be used to simulate the real source machine and destination machine environment. They can also be isolated from the production environment, avoiding direct testing in the production network, reducing security risks, and preventing impact on normal business processes.

[0123] In an optional embodiment, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain the verification result, the method further includes:

[0124] The first step is to delete the temporary static route through the control center;

[0125] The second step is to send a shutdown request to the container cloud platform through the control center, where the shutdown request is a request to shut down the target container instance;

[0126] The third step is to close the target container instance after the container cloud platform receives the shutdown request.

[0127] For example, a financial institution completed a firewall policy verification from an internal server (IP address 10.0.0.10) to an external partner enterprise E (IP address 130.123.123.123). During the verification process, the container instance in the internal detection zone successfully simulated the behavior of the internal server and verified access through a temporary static route. The verification results show that the firewall policy is valid. After the verification is completed, the following steps will be executed:

[0128] The control center remotely logs in to the internal core router and deletes the previously configured temporary static route to ensure that all network traffic returned from 130.123.123.123 can be sent to 10.0.0.10 normally instead of being redirected to the container instance in the internal detection area.

[0129] The control center generates a shutdown request and sends it to the internal container cloud platform. The shutdown request contains the IP address of the container instance to be shut down (10.0.0.10) to ensure that the container instance in the internal detection area is shut down correctly;

[0130] After receiving the shutdown request, the internal container cloud platform finds and closes the container instance with IP address 10.0.0.10, releasing all related resources, including computing resources and network resources.

[0131] In summary, through the above steps, the technical solution of this embodiment not only improves the efficiency and security in the process of firewall policy verification, but also ensures the normal operation of the production environment after the verification, realizes the effective recovery of resources and cost control, and significantly improves the overall efficiency and security of network operation and maintenance.

[0132] For example, Figure 7 As shown, when executing the policy verification end instruction, the following steps can be performed:

[0133] In the first step, when the front-end service detects the firewall policy verification end request, it sends the firewall security policy information and the policy verification end instruction to the control center;

[0134] In the second step, after the control center receives the first policy verification completion instruction, it remotely logs into the internal core router and deletes the temporary static route;

[0135] In the third step, the control center sends the IP address of the container instance to the internal container cloud platform, requesting to shut down the corresponding container instance and reclaim related resources;

[0136] Step 4: After receiving the second policy verification completion instruction, the control center remotely logs into the external core router and deletes the temporary static route.

[0137] In the fifth step, the control center sends the IP address of the container instance to the external container cloud platform, requesting to shut down the corresponding container instance and reclaim related resources;

[0138] In the sixth step, the control center checks the running status of the container instance. If it finds that the container instance is still running, it requests the container cloud platform to forcibly destroy the corresponding container instance.

[0139] In summary, through the above steps, deleting the temporary static route ensures that the network traffic is restored to the normal path of the production environment, avoids network anomalies caused by the route configured during the test process, and ensures the continuity and stability of the business system. Shutting down the container instance and recycling resources avoids redundant resource occupation, reduces costs, and also reduces potential security risks, such as unnecessary network exposure.

[0140] Example 2

[0141] The embodiment of the present application also provides a firewall policy verification device. It should be noted that the firewall policy verification device of the embodiment of the present application can be used to execute the firewall policy verification method provided by the embodiment of the present application. The firewall policy verification device provided by the embodiment of the present application is introduced below.

[0142] According to an embodiment of the present application, a device for implementing the above-mentioned firewall policy verification method is also provided, such as Figure 8 As shown, the device includes: a first determining unit 801, a first generating unit 802, a responding unit 803, a second generating unit 804 and a verifying unit 805.

[0143] A first determining unit 801 is used to determine information of a firewall policy after detecting a verification request for the firewall policy, wherein the information of the firewall policy includes at least a source machine address and a destination machine address;

[0144] A first generating unit 802, configured to generate a policy verification instruction based on a source machine address and a destination machine address;

[0145] A response unit 803 is used to respond to the policy verification instruction and configure a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the address of the source machine;

[0146] The second generating unit 804 is used for the control center to generate a container configuration list according to the policy verification instruction, wherein the container configuration list includes information of configuring the target container instance and the verification script;

[0147] The verification unit 805 is used to verify the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result.

[0148] The firewall policy verification device provided by the embodiment of the present application determines the information of the firewall policy after detecting the verification request for the firewall policy through the first determination unit 801, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; the first generation unit 802 generates a policy verification instruction based on the source machine address and the destination machine address; the response unit 803 responds to the policy verification instruction and configures a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; the second generation unit 804 generates a container configuration list according to the policy verification instruction, wherein the container configuration list includes information for configuring the target container instance and the verification script; the verification unit 805 verifies the firewall policy based on the temporary static route, the target container instance and the verification script to obtain the verification result, thereby solving the problem in the related art that the firewall policy is verified by initiating access through the source address machine, and the verification cannot be performed when there is no authority to perform the operation of remotely logging into the source address machine. Thus, the technical effect of improving the verification efficiency of the firewall policy is achieved.

[0149] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the first generation unit 802 includes: a verification module, which is used to verify the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; a first generation module, which is used to generate a first policy verification instruction if the direction verification result is a forward access relationship, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; and a second generation module, which is used to generate a second policy verification instruction if the direction verification result is a reverse access relationship, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0150] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the response unit 803 includes: a first response module, which is used to respond to the first policy verification instruction when the first policy verification instruction is generated, and construct an internal detection zone in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine in the internal zone of the firewall; a first configuration module, which is used to remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address of the internal zone of the firewall.

[0151] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the device also includes: a first sending unit, which is used to send a first configuration generation request to the internal container cloud platform through the control center after remotely logging into the internal core router through the control center and configuring the first temporary static route, wherein the first configuration generation request carries information of the first container configuration list, and the first container configuration list includes information for configuring the first container instance and the first verification script; a third generation unit, which is used to generate the first container instance and start the first container instance after the internal container cloud platform receives the first configuration generation request; a first execution unit, which is used to execute the first verification script through the first container instance to obtain a first verification result; a second sending unit, which is used to send the first verification result to the first container instance through the first temporary static route; and a third sending unit, which is used to send the first verification result to the control center after receiving the first verification result through the first container instance.

[0152] Furthermore, the response unit 803 includes: a second response module, which is used to respond to the second policy verification instruction when the second policy verification instruction is generated, and construct an external detection zone in the external zone of the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine in the external zone of the firewall; a second configuration module, which is used to remotely log in to the external core router through the control center and configure a second temporary static route, wherein the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address of the external zone of the firewall.

[0153] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the device also includes: a fourth sending unit, which is used to send a second configuration generation request to the external container cloud platform through the control center after remotely logging into the external core router through the control center and configuring the second temporary static route, wherein the second configuration generation request carries information of the second container configuration list, and the second container configuration list includes information for configuring the second container instance and the second verification script; a fourth generating unit, which is used to generate a second container instance and start the second container instance after the external container cloud platform receives the second configuration generation request; a second execution unit, which is used to execute the second verification script through the second container instance to obtain a second verification result; a fifth sending unit, which is used to send the second verification result to the second container instance through the second temporary static route; and a sixth sending unit, which is used to send the second verification result to the control center after receiving the second verification result through the second container instance.

[0154] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the device also includes: a second determination unit, which is used to perform verification on the firewall policy based on a temporary static route, a target container instance, and a verification script, and after obtaining the verification result, if the verification result indicates that the access verification is passed and the hop tracking reaches the destination machine, then determine that the firewall policy is valid; a third determination unit, which is used to determine that the firewall policy is valid but the destination machine is not started if the verification result indicates that the access verification fails but the hop tracking passes the firewall; and a fourth determination unit, which is used to determine that the firewall policy is invalid if the verification result indicates that the access verification fails and the hop tracking fails to pass the firewall.

[0155] Optionally, in the firewall policy verification device provided in the embodiment of the present application, the device also includes: a deletion unit, which is used to perform verification on the firewall policy based on the temporary static route, the target container instance and the verification script, and after obtaining the verification result, delete the temporary static route through the control center; a seventh sending unit, which is used to send a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to close the target container instance; and a closing unit, which is used to close the target container instance after the container cloud platform receives the shutdown request.

[0156] It should be noted here that the above-mentioned first determination unit 801, first generation unit 802, response unit 803, second generation unit 804 and verification unit 805 correspond to steps S201 to S205 in Example 1, and the five units and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be part of the device and can be run in the computer terminal 10 provided in Example 1.

[0157] Example 3

[0158] The embodiment of the present application may provide a computer terminal, which may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal or an electronic device.

[0159] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of the computer network.

[0160] In this embodiment, the computer terminal can execute the following steps of the firewall policy verification method: after detecting a verification request for the firewall policy, determine the information of the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; generate a policy verification instruction based on the source machine address and the destination machine address; in response to the policy verification instruction, configure a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; perform verification on the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result.

[0161] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: generating a policy verification instruction based on the source machine address and the destination machine address includes: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; if the direction verification result is a forward access relationship, generating a first policy verification instruction, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; if the direction verification result is a reverse access relationship, generating a second policy verification instruction, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0162] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: when a first policy verification instruction is generated, responding to the policy verification instruction, configuring a temporary static route includes: responding to the first policy verification instruction, constructing an internal detection zone in the internal area of ​​the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine in the internal area of ​​the firewall; remotely logging into the internal core router through the control center, and configuring a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address in the internal area of ​​the firewall.

[0163] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method also includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of the first container configuration list, and the first container configuration list includes information for configuring the first container instance and the first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance; executes the first verification script through the first container instance to obtain a first verification result; sends the first verification result to the first container instance through the first temporary static route; after receiving the first verification result through the first container instance, sends the first verification result to the control center.

[0164] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: when a second policy verification instruction is generated, responding to the policy verification instruction, configuring a temporary static route includes: responding to the second policy verification instruction, constructing an external detection zone in the external area of ​​the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine in the external area of ​​the firewall; remotely logging into the external core router through the control center, and configuring a second temporary static route, wherein the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address of the external area of ​​the firewall.

[0165] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: after remotely logging into the external core router through the control center and configuring the second temporary static route, the method also includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of the second container configuration list, and the second container configuration list includes information for configuring the second container instance and the second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; executes the second verification script through the second container instance to obtain a second verification result; sends the second verification result to the second container instance through the second temporary static route; after receiving the second verification result through the second container instance, sends the second verification result to the control center.

[0166] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: after verifying the firewall policy based on the temporary static route, the target container instance and the verification script to obtain the verification result, the method also includes: if the verification result indicates that the access verification passes and the hop tracking reaches the destination machine, the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracking passes the firewall, the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracking does not pass the firewall, the firewall policy is determined to be invalid.

[0167] Optionally, the above-mentioned computer terminal can execute the program code of the following steps in the firewall policy verification method: after verifying the firewall policy based on the temporary static route, the target container instance and the verification script and obtaining the verification result, the method also includes: deleting the temporary static route through the control center; sending a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to close the target container instance; after the container cloud platform receives the shutdown request, it closes the target container instance.

[0168] Optionally, Fig. 9 is a structural block diagram of an electronic device according to an embodiment of the present application. Fig. 9 As shown, the electronic device may include: one or more ( Fig. 9 (only one is shown) processor 902, memory 904, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0169] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the firewall policy verification method and device in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned firewall policy verification method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The processor can call the information and application programs stored in the memory through the transmission device to execute the above steps in the above firewall policy verification method.

[0171] By adopting the embodiment of the present application, a solution for verifying a firewall policy is provided. After detecting a verification request for the firewall policy, the information of the firewall policy is determined, wherein the information of the firewall policy includes at least the source machine address and the destination machine address; a policy verification instruction is generated based on the source machine address and the destination machine address; in response to the policy verification instruction, a temporary static route is configured, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; based on the temporary static route, the target container instance and the verification script, the firewall policy is verified to obtain a verification result, thereby solving the technical problem in the prior art that the firewall policy is verified by initiating access through the source address machine, and verification cannot be performed when there is no authority to perform the operation of remotely logging into the source address machine. In the present application, after detecting a verification request for a firewall policy, the information of the firewall policy is determined, and a policy verification instruction is generated through the source machine address and the destination machine address in the firewall policy information. A temporary static route is configured and a container configuration list is generated according to the generated policy verification instruction, and then the firewall policy can be verified to obtain a verification result, thereby achieving the technical effect of improving the verification efficiency of the firewall policy.

[0172] It can be understood by those skilled in the art that Fig. 9 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Fig. 9 The structure of the electronic device is not limited. Fig. 9 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Fig. 9 Different configurations shown.

[0173] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0174] Example 4

[0175] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the firewall policy verification method provided in the first embodiment.

[0176] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0177] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: after detecting a verification request for a firewall policy, determining information about the firewall policy, wherein the information about the firewall policy includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; in response to the policy verification instruction, configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and a verification script; and performing verification on the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result.

[0178] Optionally, the storage medium is also configured to store program code for executing the following steps: generating a policy verification instruction based on the source machine address and the destination machine address includes: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; if the direction verification result is a forward access relationship, generating a first policy verification instruction, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; if the direction verification result is a reverse access relationship, generating a second policy verification instruction, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

[0179] Optionally, the storage medium is also configured to store program code for executing the following steps: when a first policy verification instruction is generated, responding to the policy verification instruction, configuring a temporary static route includes: responding to the first policy verification instruction, constructing an internal detection zone in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate a source machine in the internal zone of the firewall; remotely logging into the internal core router through the control center, and configuring a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address in the internal zone of the firewall.

[0180] Optionally, the storage medium is also configured to store program codes for executing the following steps: after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method also includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of the first container configuration list, and the first container configuration list includes information for configuring the first container instance and the first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance; executes the first verification script through the first container instance to obtain a first verification result; sends the first verification result to the first container instance through the first temporary static route; after receiving the first verification result through the first container instance, sends the first verification result to the control center.

[0181] Optionally, the storage medium is also configured to store program code for executing the following steps: when a second policy verification instruction is generated, responding to the policy verification instruction, configuring a temporary static route includes: responding to the second policy verification instruction, constructing an external detection zone in the external area of ​​the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate a source machine in the external area of ​​the firewall; remotely logging into an external core router through a control center, and configuring a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the external area of ​​the firewall.

[0182] Optionally, the storage medium is also configured to store program codes for executing the following steps: after remotely logging into the external core router through the control center and configuring a second temporary static route, the method also includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of a second container configuration list, and the second container configuration list includes information for configuring a second container instance and a second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; executes the second verification script through the second container instance to obtain a second verification result; sends the second verification result to the second container instance through the second temporary static route; after receiving the second verification result through the second container instance, sends the second verification result to the control center.

[0183] Optionally, the storage medium is also configured to store program code for executing the following steps: after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain the verification result, the method also includes: if the verification result indicates that the access verification passes and the hop tracking reaches the destination machine, the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracking passes the firewall, the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracking does not pass the firewall, the firewall policy is determined to be invalid.

[0184] Optionally, the storage medium is also configured to store program codes for executing the following steps: after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script and obtaining the verification result, the method also includes: deleting the temporary static route through the control center; and sending a shutdown request to the container cloud platform through the control center.

[0185] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program of the verification method steps of the firewall policy.

[0186] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0187] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0188] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0189] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0190] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0191] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0192] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for verifying a firewall policy, characterized in that: include: After detecting a verification request for a firewall policy, determining information of the firewall policy, wherein the information of the firewall policy includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; In response to the policy verification instruction, a temporary static route is configured, wherein the temporary static route is used to connect a destination machine and a target container instance, and the address of the target container instance is the address of the source machine; According to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information for configuring the target container instance and the verification script; Verification is performed on the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result.

2. The method according to claim 1, characterized in that: Generating a policy verification instruction based on the source machine address and the destination machine address includes: Performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address to obtain a direction verification result; If the direction verification result is a forward access relationship, a first policy verification instruction is generated, wherein the forward access relationship is that the transmission direction of the data flow is from the internal area of ​​the firewall to the external area of ​​the firewall; If the direction verification result is a reverse access relationship, a second policy verification instruction is generated, wherein the reverse access relationship is that the transmission direction of the data flow is from the external area of ​​the firewall to the internal area of ​​the firewall.

3. The method according to claim 2, characterized in that In the case where the first policy verification instruction is generated, in response to the policy verification instruction, configuring a temporary static route includes: In response to the first policy verification instruction, construct an internal detection zone in the internal zone of the firewall, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate a source machine in the internal zone of the firewall; Remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address of the internal zone of the firewall.

4. The method according to claim 3, characterized in that After remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes: Sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of a first container configuration list, and the first container configuration list includes information for configuring a first container instance and a first verification script; After receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates the first container instance and starts the first container instance; Executing the first verification script through the first container instance to obtain a first verification result; Sending the first verification result to the first container instance through the first temporary static route; After receiving the first verification result through the first container instance, the first verification result is sent to the control center.

5. The method according to claim 2, characterized in that: In the case where the second policy verification instruction is generated, in response to the policy verification instruction, configuring a temporary static route includes: In response to the second policy verification instruction, construct an external detection zone in the external zone of the firewall, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate a source machine in the external zone of the firewall; Remotely log in to the external core router through the control center and configure a second temporary static route, wherein the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address of the firewall external zone.

6. The method according to claim 5, characterized in that After remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes: Sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of a second container configuration list, and the second container configuration list includes information for configuring a second container instance and a second verification script; After receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates the second container instance and starts the second container instance; Executing the second verification script through the second container instance to obtain a second verification result; Sending the second verification result to the second container instance through the second temporary static route; After receiving the second verification result through the second container instance, the second verification result is sent to the control center.

7. The method according to claim 1, characterized in that After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result, the method further includes: If the verification result indicates that the access verification is passed and the hop tracking reaches the destination machine, it is determined that the firewall policy is valid; If the verification result indicates that the access verification fails but the hop tracking passes the firewall, it is determined that the firewall policy is valid but the destination machine is not started; If the verification result indicates that the access verification fails and the hop tracking does not pass the firewall, it is determined that the firewall policy is invalid.

8. The method according to claim 7, characterized in that After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result, the method further includes: Deleting the temporary static route by the control center; Sending a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to close the target container instance; After receiving the shutdown request, the container cloud platform closes the target container instance.

9. A firewall policy verification device, characterized in that: include: A first determining unit, configured to determine information of the firewall policy after detecting a verification request for the firewall policy, wherein the information of the firewall policy includes at least a source machine address and a destination machine address; A first generating unit, configured to generate a policy verification instruction based on the source machine address and the destination machine address; A response unit, configured to respond to the policy verification instruction and configure a temporary static route, wherein the temporary static route is used to connect a destination machine and a target container instance, and the address of the target container instance is the address of the source machine; A second generating unit, configured to generate a container configuration list by a control center according to the policy verification instruction, wherein the container configuration list includes information for configuring the target container instance and a verification script; A verification unit is used to verify the firewall policy based on the temporary static route, the target container instance and the verification script to obtain a verification result.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the firewall policy verification method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein the program executes the firewall policy verification method described in any one of claims 1 to 8 when running.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the firewall policy verification method described in any one of claims 1 to 8 are implemented.

Images