A firewall policy verification method and device and a storage medium

Abstract

This application discloses a method, apparatus, and storage medium for verifying firewall policies. Relating to the field of cloud computing, the method includes: upon detecting a verification request for a firewall policy, determining firewall policy information, wherein the firewall policy information includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; responding to the policy verification instruction by configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance; generating a container configuration list in a control center according to the policy verification instruction; and performing verification on the firewall policy based on the temporary static route, the target container instance, and a verification script to obtain a verification result. This application solves the problem in related technologies where verifying firewall policies by initiating access from the source address machine fails when the user lacks permission to remotely log in to the source address machine.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a method, apparatus, and storage medium for verifying firewall policies. Background Technology

[0002] In the field of information network security, firewall policy verification is a crucial step in ensuring network communication security and business continuity. As the first line of defense for the network, the accuracy of firewall policy settings directly affects the effectiveness of resisting external attacks, preventing the leakage of sensitive data, and guaranteeing legitimate access to internal network resources. Therefore, timely and effective verification of firewall policies is essential for maintaining network security.

[0003] Traditional firewall policy verification methods primarily rely on initiating network access requests directly from the source machine to test whether the firewall can allow or block data flows according to the expected policy. This method is effective when the source machine is in a controllable environment; network administrators can log in to the source machine, manually or via script, execute access commands, and then observe the response at the destination address to determine whether the firewall policy is being implemented correctly. However, in scenarios such as bank-enterprise interconnection and interbank interconnection, a significant problem arises: the source machine is often not under the management of the financial institution but is controlled by a partner or third party. For example, the other end of an enterprise-grade leased line or internet VPN may be a server or network device belonging to a partner company or regulatory authority. In this case, network administrators do not have permission to remotely log in to the partner's source machine and therefore cannot directly initiate verification requests from the source address. This permission restriction not only increases the difficulty of firewall policy verification but also makes the verification process difficult to automate, reducing verification efficiency and coverage.

[0004] There is currently no effective solution to the problem that when firewall policies are verified by initiating access from the source address machine, verification fails if the user does not have permission to remotely log in to the source address machine. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, and storage medium for verifying firewall policies, in order to solve the problem in related technologies where verification of firewall policies is impossible when the user does not have permission to remotely log in to the source address machine.

[0006] To achieve the above objectives, according to one aspect of this application, a method for verifying a firewall policy is provided. The method includes: upon detecting a verification request for a firewall policy, determining firewall policy information, wherein the firewall policy information includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; responding to the policy verification instruction by configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and a target container instance, and the address of the target container instance is the source machine address; generating a container configuration list in a control center according to the policy verification instruction, wherein the container configuration list includes information configuring the target container instance and a verification script; and performing verification on the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result.

[0007] Furthermore, generating policy verification instructions based on the source machine address and destination machine address includes: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and destination machine address to obtain the direction verification result; if the direction verification result is a forward access relationship, then generating a first policy verification instruction, wherein the forward access relationship is the transmission direction of the data flow from the firewall's internal zone to the firewall's external zone; if the direction verification result is a reverse access relationship, then generating a second policy verification instruction, wherein the reverse access relationship is the transmission direction of the data flow from the firewall's external zone to the firewall's internal zone.

[0008] Furthermore, upon generating the first policy verification command, responding to the policy verification command and configuring a temporary static route includes: responding to the first policy verification command and constructing an internal detection zone within the firewall's internal zone, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine within the firewall's internal zone; remotely logging into the internal core router through the control center and configuring a first temporary static route, wherein the first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address within the firewall's internal zone.

[0009] Furthermore, after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of a first container configuration list, the first container configuration list including information on configuring a first container instance and a first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance; the first verification script is executed through the first container instance to obtain a first verification result; the first verification result is sent to the first container instance through the first temporary static route; after receiving the first verification result through the first container instance, the first verification result is sent to the control center.

[0010] Furthermore, upon generating the second policy verification command, responding to the policy verification command and configuring a temporary static route includes: responding to the second policy verification command to construct an external detection zone in the firewall's external zone, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine in the firewall's external zone; remotely logging into the external core router through the control center and configuring the second temporary static route, wherein the second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address in the firewall's external zone.

[0011] Furthermore, after remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of a second container configuration list, the second container configuration list including information on configuring a second container instance and a second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; the second verification script is executed through the second container instance to obtain a second verification result; the second verification result is sent to the second container instance through the second temporary static route; after receiving the second verification result through the second container instance, the second verification result is sent to the control center.

[0012] Furthermore, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: if the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine, then the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracing passes through the firewall, then the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracing does not pass through the firewall, then the firewall policy is determined to be invalid.

[0013] Furthermore, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method also includes: deleting the temporary static route through the control center; sending a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to shut down the target container instance; and shutting down the target container instance after the container cloud platform receives the shutdown request.

[0014] To achieve the above objectives, according to another aspect of this application, a firewall policy verification apparatus is provided. The apparatus includes: a first determining unit, configured to determine firewall policy information upon detecting a verification request for the firewall policy, wherein the firewall policy information includes at least a source machine address and a destination machine address; a first generating unit, configured to generate a policy verification instruction based on the source machine address and the destination machine address; a responding unit, configured to respond to the policy verification instruction and configure a temporary static route, wherein the temporary static route connects the destination machine and a target container instance, and the address of the target container instance is the source machine address; a second generating unit, configured to generate a container configuration list in a control center according to the policy verification instruction, wherein the container configuration list includes information configuring the target container instance and a verification script; and a verification unit, configured to perform verification on the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtain a verification result.

[0015] Furthermore, the first generation unit includes: a verification module, used to perform direction verification on the transmission direction of the data flow in the firewall policy based on the source machine address and the destination machine address, and obtain a direction verification result; a first generation module, used to generate a first policy verification instruction if the direction verification result is a forward access relationship, wherein the forward access relationship is the transmission direction of the data flow from the firewall's internal area to the firewall's external area; and a second generation module, used to generate a second policy verification instruction if the direction verification result is a reverse access relationship, wherein the reverse access relationship is the transmission direction of the data flow from the firewall's external area to the firewall's internal area.

[0016] Furthermore, the response unit includes: a first response module, used to respond to the first policy verification instruction when the first policy verification instruction is generated, and to build an internal detection zone in the firewall's internal zone, wherein the internal detection zone is used to build a first container instance, and the first container instance is used to simulate the source machine of the firewall's internal zone; and a first configuration module, used to remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address of the firewall's internal zone.

[0017] Furthermore, the device also includes: a first sending unit, configured to send a first configuration generation request to an internal container cloud platform via the control center after remotely logging into the internal core router through the control center and configuring a first temporary static route, wherein the first configuration generation request carries information of a first container configuration list, the first container configuration list including information on configuring a first container instance and a first verification script; a third generation unit, configured to generate a first container instance and start the first container instance after receiving the first configuration generation request through the internal container cloud platform; a first execution unit, configured to execute the first verification script through the first container instance to obtain a first verification result; a second sending unit, configured to send the first verification result to the first container instance through the first temporary static route; and a third sending unit, configured to send the first verification result to the control center after receiving the first verification result through the first container instance.

[0018] Furthermore, the response unit includes: a second response module, used to respond to the second policy verification instruction when the second policy verification instruction is generated, and to build an external detection zone in the firewall's external zone, wherein the external detection zone is used to build a second container instance, and the second container instance is used to simulate the source machine in the firewall's external zone; and a second configuration module, used to remotely log in to the external core router through the control center and configure a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the firewall's external zone.

[0019] Furthermore, the device also includes: a fourth sending unit, used to send a second configuration generation request to an external container cloud platform through the control center after remotely logging into the external core router through the control center and configuring the second temporary static route, wherein the second configuration generation request carries information of a second container configuration list, the second container configuration list including information on configuring a second container instance and a second verification script; a fourth generation unit, used to generate a second container instance and start the second container instance after receiving the second configuration generation request through the external container cloud platform; a second execution unit, used to execute the second verification script through the second container instance to obtain a second verification result; a fifth sending unit, used to send the second verification result to the second container instance through the second temporary static route; and a sixth sending unit, used to send the second verification result to the control center after receiving the second verification result through the second container instance.

[0020] Furthermore, the device also includes: a second determining unit, configured to determine that the firewall policy is valid if, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine; a third determining unit, configured to determine that the firewall policy is valid but the destination machine is not started if, after the verification result indicates that the access verification fails but the hop tracing passes through the firewall; and a fourth determining unit, configured to determine that the firewall policy is invalid if, after the verification result indicates that the access verification fails and the hop tracing does not pass through the firewall.

[0021] Furthermore, the device also includes: a deletion unit, used to delete the temporary static route through the control center after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script and obtaining the verification result; a seventh sending unit, used to send a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to shut down the target container instance; and a shutdown unit, used to shut down the target container instance after the container cloud platform receives the shutdown request.

[0022] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is running, a verification method for controlling the device where the computer-readable storage medium is located to execute any firewall policy is provided.

[0023] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include an authentication method for executing any firewall policy.

[0024] According to another aspect of this application, a computer program product is provided, including computer instructions, wherein when the computer instructions are executed by a processor, the steps of a verification method for a firewall policy of any one of the above are implemented.

[0025] In this embodiment, after detecting a verification request for a firewall policy, the firewall policy information is determined, including at least the source machine address and the destination machine address. A policy verification command is generated based on the source and destination machine addresses. In response to the policy verification command, a temporary static route is configured, connecting the destination machine and the target container instance, where the target container instance's address is the source machine address. According to the policy verification command, the control center generates a container configuration list, including information about configuring the target container instance and the verification script. The firewall policy is then verified based on the temporary static route, the target container instance, and the verification script to obtain a verification result. This solves the technical problem in the prior art where verifying firewall policies by initiating access from the source address machine fails when there is no permission to remotely log in to the source address machine. In this application, after detecting a verification request for a firewall policy, the firewall policy information is determined. A policy verification command is generated using the source and destination machine addresses in the firewall policy information. A temporary static route is configured and a container configuration list is generated based on the generated policy verification command, thereby enabling the verification of the firewall policy and obtaining a verification result. This achieves the technical effect of improving the verification efficiency of firewall policies. Attached Figure Description

[0026] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0027] Figure 1 A hardware block diagram of a computer terminal for implementing a firewall policy verification method is shown.

[0028] Figure 2 This is a flowchart of a firewall policy verification method provided in an embodiment of this application;

[0029] Figure 3 This is a flowchart of executing the first strategy verification instruction according to an embodiment of this application;

[0030] Figure 4 This is a flowchart of executing the second strategy verification instruction according to an embodiment of this application;

[0031] Figure 5 This is a structural diagram of entities and logical network regions in the firewall policy verification method provided according to the embodiments of this application;

[0032] Figure 6 This is a schematic diagram of a firewall policy verification method provided according to an embodiment of this application;

[0033] Figure 7This is a flowchart of the execution strategy verification end instruction provided in the embodiments of this application;

[0034] Figure 8 This is a schematic diagram of a firewall policy verification device provided according to an embodiment of this application;

[0035] Figure 9 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0036] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0037] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] Example 1

[0039] According to an embodiment of this application, a method embodiment for verifying firewall policies is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a firewall policy authentication method is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the firewall policy verification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned firewall policy verification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0044] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0045] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for verifying the firewall policy shown. Figure 2 This is a flowchart of a firewall policy verification method according to Embodiment 1 of this application.

[0046] Step S201: After detecting a verification request for the firewall policy, determine the information of the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address.

[0047] Optionally, the firewall policy described above can be a series of rules and operations defined in the network firewall to control the flow of data packets entering and leaving the network. Based on preset security rules and business requirements, the firewall policy determines whether data packets are allowed to pass through the firewall and enter or leave the protected network. The firewall policy is one of the core functions of a firewall and is crucial for network security protection. The information in the firewall policy may include network parameters such as source machine address, destination machine address, destination machine service port, protocol type, access type (allow or deny), and connection time.

[0048] For example, a financial institution needs to verify a newly configured firewall policy that allows Transmission Control Protocol (TCP) connections from a partner company A's server (source machine address 192.168.1.100) to the firewall policy's internal server (destination machine address 10.0.0.100). In the firewall policy's network architecture, the firewall resides between the internal and external detection zones, while the container cloud platform is deployed between the internal and external detection zones to create container instances. Upon detecting a verification request for this firewall policy, the front-end service collects and determines the firewall policy information, including the source machine address (192.168.1.100), destination machine address (10.0.0.100), destination machine service port (e.g., 80), and protocol type (e.g., Transmission Control Protocol).

[0049] Step S202: Generate policy verification instructions based on the source machine address and the destination machine address.

[0050] Optionally, the above policy verification instructions are used to guide the container cloud platform to perform specific actions to verify the validity of firewall policies. Policy verification instructions can be divided into two types: a first policy verification instruction and a second policy verification instruction. The first policy verification instruction is used to verify firewall policies where the data flow transmission direction is from the firewall's internal zone to the firewall's external zone, and the second policy verification instruction is used to verify firewall policies where the data flow transmission direction is from the firewall's external zone to the firewall's internal zone.

[0051] Step S203: Respond to the policy verification command and configure a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the address of the source machine.

[0052] For example, the control center remotely logs into the financial institution's internal core router and configures a temporary static route with the source machine address 192.168.1.100 as the destination and the next hop pointing to the internal inspection zone. This temporary static route ensures that response packets from the destination machine are sent to the container instance in the internal inspection zone, rather than entering the financial institution's internal business area or returning directly to the source machine.

[0053] Step S204: According to the policy verification instruction, the control center generates a container configuration list, which includes information on the target container instance and the verification script.

[0054] For example, the control center automatically generates a container configuration manifest, which details the configuration information of the target container instance, including setting the network interface IP address to 192.168.1.100 (simulating the source machine address). After the container starts, a verification script is executed immediately, which contains a series of commands to test whether the Transmission Control Protocol connection is successful.

[0055] Step S205: Verify the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain the verification result.

[0056] For example, the internal container cloud platform generates and starts a target container instance based on the container configuration manifest. After the target container instance starts, it automatically executes a verification script and initiates a Transmission Control Protocol (TCP) connection request to the destination machine address 10.0.0.100. Due to the existence of temporary static routes, the response information from the destination machine will be returned to the target container instance. The target container instance analyzes the response information, determines whether the firewall policy is effective, and finally returns the verification result to the control center, which then analyzes it and feeds it back to the front-end service.

[0057] The above technical solution automates firewall policy verification, eliminating the need for manual login to the source machine to perform tests. This reduces the complexity and error rate of manual operations, significantly improving verification efficiency. Therefore, financial institutions can not only efficiently and accurately verify the effectiveness of firewall policies but also reduce labor costs and improve the efficiency and flexibility of network management.

[0058] In summary, the firewall policy verification method provided in this application, after detecting a verification request for the firewall policy, determines the firewall policy information, which includes at least the source machine address and the destination machine address; generates a policy verification command based on the source machine address and the destination machine address; responds to the policy verification command by configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification command, the control center generates a container configuration list, which includes information on configuring the target container instance and the verification script; and performs verification on the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain a verification result. This solves the technical problem in the prior art where verifying firewall policies by initiating access from the source address machine fails when there is no permission to remotely log in to the source address machine. In this application, after detecting a verification request for the firewall policy, the firewall policy information is determined, a policy verification command is generated using the source machine address and the destination machine address in the firewall policy information, a temporary static route is configured and a container configuration list is generated according to the generated policy verification command, and thus the firewall policy can be verified to obtain a verification result, thereby achieving the technical effect of improving the verification efficiency of firewall policies.

[0059] In one optional embodiment, generating a policy verification instruction based on the source machine address and the destination machine address includes the following steps:

[0060] Step 1: Verify the transmission direction of the data flow in the firewall policy based on the source machine address and the destination machine address, and obtain the direction verification result.

[0061] Optionally, the control center can determine the data flow direction in the firewall policy based on the source and destination machine addresses in the firewall policy information. If the source machine address is located in the internal zone of the firewall and the destination machine address is located in the external zone of the firewall, the data flow direction is from the internal zone to the external zone, which is called a forward access relationship; conversely, if the source machine address is located in the external zone of the firewall and the destination machine address is located in the internal zone of the firewall, the data flow direction is from the external zone to the internal zone of the firewall, which is called a reverse access relationship.

[0062] Step 2: If the direction verification result is a forward access relationship, then generate the first policy verification instruction. Here, a forward access relationship means that the data flow transmission direction is from the inner zone of the firewall to the outer zone of the firewall.

[0063] Optionally, when the data flow transmission direction is determined to be a forward access relationship, the control center can generate a first policy verification instruction. The first policy verification instruction can contain the necessary information to create a container instance on the container cloud platform in the internal detection zone, simulate the network behavior of the source machine, and configure temporary static routes to ensure that verification request packets initiated from the internal detection zone to the external firewall zone can be correctly routed to the destination machine. At the same time, the response packets from the destination machine will also be correctly routed back to the container instance in the internal detection zone.

[0064] Step 3: If the direction verification result is a reverse access relationship, then generate a second policy verification instruction. The reverse access relationship means that the data flow transmission direction is from the outer zone of the firewall to the inner zone of the firewall.

[0065] Optionally, when the data flow is a reverse access relationship, the control center can generate a second policy verification instruction. The second policy verification instruction is used to create a container instance on the container cloud platform in the external detection zone and configure a temporary static route to ensure that verification request packets initiated from the external detection zone to the internal zone can be correctly routed to the destination machine. At the same time, the response packets from the destination machine will also be correctly routed back to the container instance in the external detection zone.

[0066] For example, a financial institution needs to verify a firewall policy that allows a server from partner company D (source machine address 203.0.113.50, located in the outer zone of the firewall) to access a server inside the financial institution (destination machine address 10.0.1.100, located in the inner zone of the firewall), and the allowed communication protocol is HTTP (port 80). The control center first verifies that this is an access request from the outer zone to the inner zone of the firewall, i.e., a reverse access relationship. Then, because it is a reverse access relationship, the control center generates a second policy verification instruction, which includes the source machine address 203.0.113.50, the destination machine address 10.0.1.100, and other relevant parameters, such as the destination port 80 and the protocol HTTP.

[0067] In summary, the above technical solution improves the flexibility and response speed of verification by automatically identifying the transmission direction of data streams and generating corresponding policy verification instructions, thus facilitating subsequent policy adjustments.

[0068] In an optional embodiment, upon generating a first policy verification instruction, configuring a temporary static route in response to the policy verification instruction may include the following steps:

[0069] The first step is to respond to the first policy verification command and build an internal detection zone within the firewall's internal zone. The internal detection zone is used to build the first container instance, which is used to simulate the source machine within the firewall's internal zone.

[0070] Optionally, an internal inspection zone can be built within the firewall's internal zone. A dedicated area can be designated by the network administrator for this purpose. This zone is created to securely verify firewall policies without impacting the actual business network. Within this internal inspection zone, the control center can generate and start a first container instance. The configuration and behavior of this first container instance will simulate the source machine within the firewall's internal zone, initiating access requests to verify the effectiveness of the policies.

[0071] The second step is to remotely log in to the internal core router through the control center and configure the first temporary static route. The first temporary static route is the highest priority static route, and the destination address of the first temporary static route is the source machine address of the firewall's internal zone.

[0072] Optionally, to ensure that data packets during the authentication process are correctly routed to the first container instance in the internal detection zone, rather than being sent directly to the actual external destination address, the control center can remotely log in to the internal core router and configure a first temporary static route. This first temporary static route has the highest priority, with the destination address set to the source machine address within the firewall's internal zone (i.e., the address of the first container instance), and the next hop pointing to the internal detection zone. In this way, all authentication requests originating from the source machine address, and responses from the destination address, will be directed to the internal detection zone via this temporary route, where they will be received and processed by the first container instance.

[0073] For example, a financial institution needs to verify the validity of a firewall policy that allows an internal server (source machine address 192.168.10.50, located in the firewall's internal zone) to access the Hypertext Transfer Protocol (HTTP) service of an external website (e.g., destination machine address 8.8.8.8, in the external zone). In the financial institution's internal network architecture, the firewall is located between the internal and external detection zones. The control center constructs an internal detection zone within the firewall's internal zone. Here, a first container instance is created, with its IP address set to 192.168.10.50, to simulate the access behavior of the internal server. This container instance will run a simple script to initiate HTTP connection requests. The control center remotely logs into the internal core router and configures a first temporary static route with a destination address of 192.168.10.50 and a next hop pointing to the internal detection zone. This route ensures that all access requests originating from 192.168.10.50 are redirected to the first container instance in the internal inspection zone, instead of being sent directly to the external destination address 8.8.8.8.

[0074] In summary, by constructing an internal detection zone and configuring a first temporary static route through the above technical solutions, it is ensured that data during the verification process will not be leaked to the external network, thereby protecting the security of the internal network.

[0075] In one alternative embodiment, such as Figure 3 As shown, after remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes:

[0076] Step S301: Send a first configuration generation request to the internal container cloud platform through the control center. The first configuration generation request carries information about a first container configuration list, which includes information about configuring a first container instance and a first verification script.

[0077] Optionally, the aforementioned first container configuration manifest may include all the configuration information required to start the first container instance, such as network parameters, IP address (simulating the address of the internal source machine), and the first verification script. The aforementioned first configuration generation request is initiated by the control center to generate and start the first container instance to simulate the behavior of the source machine, thereby verifying the effectiveness of the firewall policy. The first configuration generation request carries information from the first container configuration manifest, ensuring that the container instance can accurately simulate specific network environments and access behaviors.

[0078] In step S302, after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates the first container instance and starts the first container instance.

[0079] Optionally, after receiving the first configuration generation request, the internal container cloud platform can create a first container instance based on the first container configuration manifest and start the first container instance immediately. Configuring a first container instance with the same address as the internal source machine can simulate the source machine on the internal network.

[0080] Step S303: Execute the first verification script through the first container instance to obtain the first verification result.

[0081] Optionally, the first verification script mentioned above may include commands to test the effectiveness of firewall policies, in order to confirm whether data can pass through the firewall smoothly in accordance with the firewall policies.

[0082] Step S304: Send the first verification result to the first container instance via the first temporary static route.

[0083] Optionally, after the first verification script completes execution, the first container instance generates a first verification result. This result may include information such as whether the firewall policy allows access, and details of the firewall's behavior during the access process. The first verification result can be sent back to the first container instance via a first temporary static route. This step ensures a closed loop for the test data and avoids impacting the external network.

[0084] Step S305: After receiving the first verification result through the first container instance, the first verification result is sent to the control center.

[0085] Optionally, after the first verification result is sent to the control center, the control center can analyze the result, determine the effectiveness of the firewall policy, and feed back the result to the front-end service or network administrator.

[0086] In summary, by employing the above technical solutions, the first container instance simulates the network environment and access behavior of the internal source machine, accurately testing the effectiveness of firewall policies and ensuring the reliability of the verification results. Secondly, the isolation of the first container instance from the real business environment reduces the impact of the testing process on the production system and avoids the security risks that may arise from directly operating the external source machine.

[0087] In an optional embodiment, upon generating a second policy verification instruction, configuring a temporary static route in response to the policy verification instruction may include the following steps:

[0088] The first step is to respond to the second policy verification command and build an external detection zone in the firewall's external zone. The external detection zone is used to build a second container instance, which is used to simulate the source machine in the firewall's external zone.

[0089] Optionally, an external detection zone can be built outside the firewall zone for testing. This external detection zone is specifically used to generate and manage second container instances for firewall policy verification. By operating within the external detection zone, direct access to the actual external source machine can be avoided, reducing security risks and making the testing process more flexible and controllable.

[0090] The second step is to remotely log in to the external core router through the control center and configure the second temporary static route. The second temporary static route is the highest priority static route, and the destination address of the second temporary static route is the source machine address in the firewall's external zone.

[0091] Optionally, configuring a second temporary static route with the highest priority can ensure that verification request packets originating from the source machine address are sent to the second container instance in the external detection zone, rather than being sent directly to the internal business zone.

[0092] For example, a financial institution needs to verify whether its firewall correctly allows HTTPS (port 443) access from an external partner company E (source machine address 123.123.123.123) to its internal server (destination machine address 10.0.0.10). First, an external detection zone is designated outside the firewall, isolated from the actual partner company's network environment, for generating and managing a second container instance. Next, the control center remotely logs into the external core router and configures a second temporary static route with a destination address of 123.123.123.123 and a next hop pointing to the external detection zone. This route ensures that all HTTPS access requests originating from 123.123.123.123 are redirected to the second container instance in the external detection zone, rather than directly reaching the financial institution's internal server via a dedicated communication line.

[0093] In summary, by taking the above steps and building container instances in the external detection area, the uncontrollable risks associated with directly operating external source machines are avoided. At the same time, it is ensured that the verification process will not affect the internal business area, thereby improving the overall network security.

[0094] In one alternative embodiment, such as Figure 4 As shown, after remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes:

[0095] Step S401: Send a second configuration generation request to an external container cloud platform through the control center. The second configuration generation request carries information about a second container configuration list, which includes information about configuring a second container instance and a second verification script.

[0096] Optionally, the control center generates a second container configuration manifest, which may include network parameters, IP addresses, and a second verification script for reverse access verification. Subsequently, the control center sends a second configuration generation request to an external container cloud platform, requesting the generation and startup of the second container instance.

[0097] In step S402, after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance.

[0098] Optionally, after receiving the second configuration generation request, the external container cloud platform constructs a second container instance based on the information in the second container configuration manifest and immediately starts the second container instance. The address of the second container instance is set to the source machine address specified in the firewall policy to simulate the behavior of the external source machine.

[0099] Step S403: Execute the second verification script through the second container instance to obtain the second verification result.

[0100] Optionally, the second verification script can attempt to establish a connection with the destination machine inside the firewall and record whether the connection is successful and any network obstacles encountered along the way, such as firewall blocking. The second verification script may include using standard network testing tools to check the availability of the HTTPS service.

[0101] Step S404: Send the second verification result to the second container instance via the second temporary static route.

[0102] Optionally, the second verification result can be sent back to the second container instance via the second temporary static route. This is because the second temporary static route has pointed the next hop of the destination machine address to the second container instance in the external detection zone, thus ensuring that all response packets enter the pre-set test environment.

[0103] Step S405: After receiving the second verification result through the second container instance, send the second verification result to the control center.

[0104] Optionally, after receiving the second authentication result, the second container instance can forward the second authentication result to the control center. The control center can analyze these results to determine whether the firewall policy has allowed or blocked access from the external source machine to the internal destination machine as expected.

[0105] In summary, by constructing a second container instance in the external testing area through steps S401-S405, direct operation of the external source machine is avoided, reducing security risks. At the same time, the testing environment is isolated from the actual production network, ensuring the continuity and stability of the existing network operation.

[0106] In an optional embodiment, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes:

[0107] If the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine, then the firewall policy is determined to be effective.

[0108] Optionally, the aforementioned hop tracing is a network diagnostic tool used to determine the network path that a data packet takes from its source address to its destination address.

[0109] For example, a firewall policy aims to allow an internal server (IP address 10.0.0.10) to initiate HTTPS (port 443) requests to access an external website (IP address 8.8.8.8). A first container instance (simulating 10.0.0.10) attempts to establish an HTTPS connection to the external destination address 8.8.8.8. A hop trace is performed to confirm whether the packets passed through the firewall. The verification result shows that the HTTPS connection was successful, and the hop trace shows that the packets passed through the firewall and eventually reached 8.8.8.8. This indicates that the firewall policy allows the internal server to access the external website, and the firewall policy is effective.

[0110] If the verification result indicates that access verification failed but hop tracing passed the firewall, it is determined that the firewall policy is effective, but the destination machine is not running.

[0111] For example, a firewall policy allows an external partner enterprise E (IP address 130.123.123.123) to initiate SSH (port 22) requests to access an internal server (IP address 10.1.1.20). A second container instance (simulating 130.123.123.123) attempts to establish an SSH connection with the internal destination address 10.1.1.20 and performs hop tracing to confirm whether the packets passed through the firewall. The verification result is that the SSH connection failed, but the hop tracing shows that the packets did pass through the firewall, but failed to reach port 22 of 10.1.1.20. This indicates that the firewall policy allows external access, but it is possible that the SSH service on the internal server is not running or the internal server's firewall is blocking the connection; the policy itself is effective.

[0112] If the verification result indicates that access verification failed and hop tracing did not pass through the firewall, then the firewall policy is determined to be invalid.

[0113] For example, a firewall policy might be designed to allow an internal server (IP address 10.0.0.10) to initiate an SMTP mail service (port 25) request to access an external mail server (IP address 205.123.45.67). A first container instance (simulating 10.0.0.10) attempts to establish an SMTP connection to the external destination address 205.123.45.67 and performs a hop tracing to confirm whether the data packets passed through the firewall. The verification result is that the SMTP connection failed, and the hop tracing shows that the data packets failed to pass through the firewall and reached 205.123.45.67. This indicates that the firewall policy may not allow the internal server to access the external mail server, or that the policy configuration is incorrect and needs to be reviewed or adjusted.

[0114] In summary, by analyzing the above three scenarios and combining access verification and hop tracking, we can more accurately assess the effectiveness of firewall policies and quickly identify policy configuration problems or destination machine status issues.

[0115] For example, the firewall policy verification method based on this embodiment includes entities such as a container cloud platform, container instances, front-end services, and a control center, as well as logical network areas such as an external detection zone, an internal detection zone, an external interconnection zone, and an internal business zone. Figure 5 The diagram shows the structure of entities and logical network zones in the firewall policy verification method. Figure 6 The diagram illustrates a firewall policy verification method. The firewall policy can be verified through the following steps:

[0116] The first step is that when the front-end service detects a request for firewall policy verification, it first asks to complete and verify the firewall policy information, and then sends the firewall security policy information and policy verification instructions to the control center.

[0117] The second step is that after the control center receives the first policy verification command, it remotely logs into the internal core router and configures a temporary static route with the highest priority.

[0118] Third, the control center will automatically generate a container configuration list and request the internal container cloud platform to generate and start the required container instances. After the container instances start, they will immediately and automatically execute a verification script and return the results of the script execution to the control center.

[0119] Fourth, if the control center receives the second policy verification command, it remotely logs into the external core router and configures a temporary static route with the highest priority.

[0120] Fifth, the control center will automatically generate a container configuration list and request an external container cloud platform to generate and start the required container instances. After the container instances start, they will immediately and automatically execute a verification script and return the results of the script execution to the control center.

[0121] The sixth step is for the control center to analyze the results returned by the container instance and then hand them over to the front-end service for display.

[0122] By verifying the firewall policy through the above steps, container instances are generated in the internal and external detection zones. These instances can be used to simulate real source and destination machine environments and can also be isolated from the production environment. This avoids performing tests directly in the production network, reduces security risks, and prevents disruption to normal business processes.

[0123] In an optional embodiment, after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes:

[0124] The first step is to delete the temporary static route through the control center;

[0125] The second step is to send a shutdown request to the container cloud platform through the control center. The shutdown request is a request to shut down the target container instance.

[0126] The third step is to shut down the target container instance after the container cloud platform receives the shutdown request.

[0127] For example, a financial institution completed a firewall policy verification from an internal server (IP address 10.0.0.10) to an external partner company E (IP address 130.123.123.123). During the verification process, a container instance in the internal detection zone successfully simulated the behavior of the internal server and performed access verification via a temporary static route. The verification result showed that the firewall policy was effective. After the verification is complete, the following steps will be performed:

[0128] The control center remotely logs into the internal core router, deletes the previously configured temporary static routes, and ensures that all network traffic returning from 130.123.123.123 can be sent normally to 10.0.0.10, instead of being redirected to container instances in the internal detection zone;

[0129] The control center generates a shutdown request and sends it to the internal container cloud platform. The shutdown request includes the IP address (10.0.0.10) of the container instance to be shut down to ensure that the container instance in the internal detection area is shut down correctly;

[0130] After receiving the shutdown request, the internal container cloud platform locates and shuts down the container instance with IP address 10.0.0.10, releasing all related resources, including computing and network resources.

[0131] In summary, through the above steps, the technical solution of this embodiment not only improves efficiency and security during the firewall policy verification process, but also ensures the normal operation of the production environment after verification, realizes effective resource recovery and cost control, and significantly improves the overall efficiency and security of network operation and maintenance.

[0132] For example, such as Figure 7 As shown, when executing the policy verification completion command, the following steps can be performed:

[0133] The first step is that when the front-end service detects a request to end the firewall policy verification, it sends the firewall security policy information and the policy verification end command to the control center.

[0134] The second step is to remotely log in to the internal core router and delete the temporary static route after the control center receives the first policy verification end instruction.

[0135] The third step is for the control center to send the IP address of the container instance to the internal container cloud platform, requesting that the corresponding container instance be shut down and related resources be reclaimed.

[0136] Fourth step: After the control center receives the second policy verification end command, it remotely logs into the external core router and deletes the temporary static route;

[0137] Fifth, the control center will send the IP address of the container instance to the external container cloud platform, requesting that the corresponding container instance be shut down and related resources be reclaimed;

[0138] The sixth step is for the control center to check the running status of the container instance. If it finds that the container instance is still running, it requests the container cloud platform to forcibly destroy the corresponding container instance.

[0139] In summary, by following the steps outlined above, deleting temporary static routes ensured that network traffic returned to the normal path of the production environment, preventing network anomalies caused by routes configured during testing, and guaranteeing the continuity and stability of the business system. Shutting down container instances and reclaiming resources avoided redundant resource usage, reduced costs, and also mitigated potential security risks, such as unnecessary network exposure.

[0140] Example 2

[0141] This application also provides a firewall policy verification device. It should be noted that the firewall policy verification device of this application can be used to execute the firewall policy verification method provided in this application. The firewall policy verification device provided in this application is described below.

[0142] According to an embodiment of this application, an apparatus for implementing the verification method of the above-described firewall policy is also provided, such as... Figure 8 As shown, the device includes: a first determining unit 801, a first generating unit 802, a response unit 803, a second generating unit 804, and a verification unit 805.

[0143] The first determining unit 801 is used to determine the information of the firewall policy after detecting a verification request for the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address.

[0144] The first generation unit 802 is used to generate policy verification instructions based on the source machine address and the destination machine address;

[0145] Response unit 803 is used to respond to policy verification instructions and configure temporary static routes, wherein the temporary static routes are used to connect the destination machine and the target container instance, and the address of the target container instance is the address of the source machine.

[0146] The second generation unit 804 is used to generate a container configuration list for the control center according to the policy verification instruction. The container configuration list includes information about the target container instance and the verification script.

[0147] Verification unit 805 is used to perform verification on firewall policies based on temporary static routes, target container instances, and verification scripts, and obtain verification results.

[0148] The firewall policy verification device provided in this application embodiment, through a first determining unit 801, determines the firewall policy information after detecting a verification request for the firewall policy. The firewall policy information includes at least the source machine address and the destination machine address. A first generating unit 802 generates a policy verification instruction based on the source machine address and the destination machine address. A response unit 803 responds to the policy verification instruction and configures a temporary static route, wherein the temporary static route connects the destination machine and the target container instance, and the address of the target container instance is the source machine address. A second generating unit 804 generates a container configuration list according to the policy verification instruction, wherein the container configuration list includes information on configuring the target container instance and the verification script. A verification unit 805 performs verification on the firewall policy based on the temporary static route, the target container instance, and the verification script, obtaining a verification result. This solves the problem in related technologies where verifying firewall policies by initiating access from the source address machine fails when there is no permission to remotely log in to the source address machine, thus improving the technical efficiency of firewall policy verification.

[0149] Optionally, in the firewall policy verification device provided in this application embodiment, the first generation unit 802 includes: a verification module, configured to perform direction verification on the transmission direction of the data flow in the firewall policy based on the source machine address and the destination machine address, and obtain a direction verification result; a first generation module, configured to generate a first policy verification instruction if the direction verification result is a forward access relationship, wherein the forward access relationship is the transmission direction of the data flow from the firewall's internal area to the firewall's external area; and a second generation module, configured to generate a second policy verification instruction if the direction verification result is a reverse access relationship, wherein the reverse access relationship is the transmission direction of the data flow from the firewall's external area to the firewall's internal area.

[0150] Optionally, in the firewall policy verification device provided in this application embodiment, the response unit 803 includes: a first response module, configured to respond to the first policy verification instruction when a first policy verification instruction is generated, and construct an internal detection zone in the firewall internal zone, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine of the firewall internal zone; and a first configuration module, configured to remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address of the firewall internal zone.

[0151] Optionally, in the firewall policy verification device provided in this application embodiment, the device further includes: a first sending unit, configured to send a first configuration generation request to an internal container cloud platform through the control center after remotely logging into the internal core router through the control center and configuring a first temporary static route, wherein the first configuration generation request carries information of a first container configuration list, the first container configuration list including information of configuring a first container instance and a first verification script; a third generation unit, configured to generate a first container instance and start the first container instance after receiving the first configuration generation request through the internal container cloud platform; a first execution unit, configured to execute the first verification script through the first container instance to obtain a first verification result; a second sending unit, configured to send the first verification result to the first container instance through the first temporary static route; and a third sending unit, configured to send the first verification result to the control center after receiving the first verification result through the first container instance.

[0152] Furthermore, the response unit 803 includes: a second response module, used to respond to the second policy verification instruction when the second policy verification instruction is generated, and to build an external detection zone in the firewall external zone, wherein the external detection zone is used to build a second container instance, and the second container instance is used to simulate the source machine in the firewall external zone; and a second configuration module, used to remotely log in to the external core router through the control center and configure a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the firewall external zone.

[0153] Optionally, in the firewall policy verification device provided in this application embodiment, the device further includes: a fourth sending unit, used to send a second configuration generation request to an external container cloud platform through the control center after remotely logging into the external core router through the control center and configuring a second temporary static route, wherein the second configuration generation request carries information of a second container configuration list, the second container configuration list including information of configuring a second container instance and a second verification script; a fourth generation unit, used to generate a second container instance and start the second container instance after receiving the second configuration generation request through the external container cloud platform; a second execution unit, used to execute the second verification script through the second container instance to obtain a second verification result; a fifth sending unit, used to send the second verification result to the second container instance through the second temporary static route; and a sixth sending unit, used to send the second verification result to the control center after receiving the second verification result through the second container instance.

[0154] Optionally, in the firewall policy verification device provided in the embodiments of this application, the device further includes: a second determining unit, configured to, after performing verification on the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, determine that the firewall policy is valid if the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine; a third determining unit, configured to, if the verification result indicates that the access verification fails but the hop tracing passes through the firewall, determine that the firewall policy is valid but the destination machine is not started; and a fourth determining unit, configured to, if the verification result indicates that the access verification fails and the hop tracing does not pass through the firewall, determine that the firewall policy is invalid.

[0155] Optionally, in the firewall policy verification device provided in this application embodiment, the device further includes: a deletion unit, used to delete the temporary static route through the control center after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script and obtaining the verification result; a seventh sending unit, used to send a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to shut down the target container instance; and a shutdown unit, used to shut down the target container instance after the container cloud platform receives the shutdown request.

[0156] It should be noted that the first determining unit 801, the first generating unit 802, the response unit 803, the second generating unit 804, and the verification unit 805 mentioned above correspond to steps S201 to S205 in Embodiment 1. The five units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0157] Example 3

[0158] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0159] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0160] In this embodiment, the computer terminal described above can execute the following steps of the firewall policy verification method: after detecting a verification request for the firewall policy, determining the firewall policy information, wherein the firewall policy information includes at least the source machine address and the destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; responding to the policy verification instruction, configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information on configuring the target container instance and the verification script; performing verification on the firewall policy based on the temporary static route, the target container instance, and the verification script to obtain the verification result.

[0161] Optionally, the computer terminal described above can execute the program code for the following steps in the firewall policy verification method: generating a policy verification instruction based on the source machine address and the destination machine address includes: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address, and obtaining the direction verification result; if the direction verification result is a forward access relationship, then generating a first policy verification instruction, wherein the forward access relationship is that the transmission direction of the data flow is from the firewall's internal zone to the firewall's external zone; if the direction verification result is a reverse access relationship, then generating a second policy verification instruction, wherein the reverse access relationship is that the transmission direction of the data flow is from the firewall's external zone to the firewall's internal zone.

[0162] Optionally, the computer terminal described above can execute the program code for the following steps in the firewall policy verification method: Upon generating a first policy verification command, responding to the policy verification command and configuring a temporary static route includes: responding to the first policy verification command, constructing an internal detection zone within the firewall's internal zone, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine within the firewall's internal zone; remotely logging into the internal core router through the control center and configuring a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address within the firewall's internal zone.

[0163] Optionally, the computer terminal can execute the following steps of the firewall policy verification method: After remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of a first container configuration list, the first container configuration list including information on configuring a first container instance and a first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates a first container instance and starts the first container instance; the first verification script is executed through the first container instance to obtain a first verification result; the first verification result is sent to the first container instance through the first temporary static route; after receiving the first verification result through the first container instance, the first verification result is sent to the control center.

[0164] Optionally, the computer terminal described above can execute the program code for the following steps in the firewall policy verification method: Upon generating a second policy verification command, responding to the policy verification command and configuring a temporary static route includes: responding to the second policy verification command, constructing an external detection zone in the firewall's external zone, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine in the firewall's external zone; remotely logging into the external core router through the control center and configuring a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the firewall's external zone.

[0165] Optionally, the computer terminal can execute the following steps of the firewall policy verification method: After remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of a second container configuration list, the second container configuration list including information on configuring the second container instance and the second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; the second verification script is executed through the second container instance to obtain a second verification result; the second verification result is sent to the second container instance through the second temporary static route; after receiving the second verification result through the second container instance, the second verification result is sent to the control center.

[0166] Optionally, the computer terminal described above can execute the following steps of the firewall policy verification method: After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: if the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine, then the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracing passes through the firewall, then the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracing does not pass through the firewall, then the firewall policy is determined to be invalid.

[0167] Optionally, the computer terminal can execute the following steps of the firewall policy verification method: after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: deleting the temporary static route through the control center; sending a shutdown request to the container cloud platform through the control center, wherein the shutdown request is a request to shut down the target container instance; and shutting down the target container instance after the container cloud platform receives the shutdown request.

[0168] Optionally, Figure 9 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 9 As shown, the electronic device may include: one or more ( Figure 9 Only one of the following is shown: processor 902, memory 904, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0169] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the firewall policy verification method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned firewall policy verification method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0170] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the verification method of the aforementioned firewall policy.

[0171] This application provides a scheme for verifying firewall policies. Upon detecting a verification request for a firewall policy, the following steps are taken: First, the firewall policy information is determined, including at least the source machine address and the destination machine address. Then, a policy verification command is generated based on the source and destination machine addresses. In response to the verification command, a temporary static route is configured, connecting the destination machine and the target container instance, where the target container instance's address is the source machine address. Based on the verification command, a container configuration list is generated by the control center, including information about configuring the target container instance and the verification script. Finally, the firewall policy is verified based on the temporary static route, the target container instance, and the verification script to obtain the verification result. This solves the technical problem in existing technologies where verifying firewall policies by initiating access from the source address machine fails when there is no permission to remotely log in to the source address machine. In this application, after detecting a verification request for a firewall policy, the firewall policy information is determined, and a policy verification instruction is generated using the source machine address and destination machine address in the firewall policy information. Based on the generated policy verification instruction, a temporary static route is configured and a container configuration list is generated, thereby verifying the firewall policy and obtaining the verification result. This achieves the technical effect of improving the verification efficiency of firewall policies.

[0172] Those skilled in the art will understand that Figure 9 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 9 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 9 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 9 The different configurations shown.

[0173] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0174] Example 4

[0175] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the firewall policy verification method provided in Embodiment 1.

[0176] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0177] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: after detecting a verification request for a firewall policy, determining information about the firewall policy, wherein the information about the firewall policy includes at least a source machine address and a destination machine address; generating a policy verification instruction based on the source machine address and the destination machine address; responding to the policy verification instruction, configuring a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the source machine address; according to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information on configuring the target container instance and the verification script; performing verification on the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining a verification result.

[0178] Optionally, the storage medium is also configured to store program code for performing the following steps: generating policy verification instructions based on the source machine address and the destination machine address, including: performing direction verification on the transmission direction of the data flow in the firewall policy according to the source machine address and the destination machine address, and obtaining the direction verification result; if the direction verification result is a forward access relationship, then generating a first policy verification instruction, wherein the forward access relationship is that the transmission direction of the data flow is from the firewall's internal zone to the firewall's external zone; if the direction verification result is a reverse access relationship, then generating a second policy verification instruction, wherein the reverse access relationship is that the transmission direction of the data flow is from the firewall's external zone to the firewall's internal zone.

[0179] Optionally, the storage medium is also configured to store program code for performing the following steps: upon generating a first policy verification instruction, responding to the policy verification instruction and configuring a temporary static route includes: responding to the first policy verification instruction to construct an internal detection zone within the firewall's internal zone, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine of the firewall's internal zone; remotely logging into the internal core router through the control center and configuring a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address of the firewall's internal zone.

[0180] Optionally, the storage medium is also configured to store program code for performing the following steps: After remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes: sending a first configuration generation request to the internal container cloud platform through the control center, wherein the first configuration generation request carries information of a first container configuration list, the first container configuration list including information on configuring a first container instance and a first verification script; after receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates the first container instance and starts the first container instance; executes the first verification script through the first container instance to obtain a first verification result; sends the first verification result to the first container instance through the first temporary static route; and after receiving the first verification result through the first container instance, sends the first verification result to the control center.

[0181] Optionally, the storage medium is also configured to store program code for performing the following steps: In the case of generating a second policy verification instruction, responding to the policy verification instruction and configuring a temporary static route includes: responding to the second policy verification instruction to build an external detection zone in the firewall's external zone, wherein the external detection zone is used to build a second container instance, and the second container instance is used to simulate the source machine in the firewall's external zone; remotely logging into the external core router through the control center and configuring a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address in the firewall's external zone.

[0182] Optionally, the storage medium is also configured to store program code for performing the following steps: After remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes: sending a second configuration generation request to the external container cloud platform through the control center, wherein the second configuration generation request carries information of a second container configuration list, the second container configuration list including information on configuring a second container instance and a second verification script; after receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates a second container instance and starts the second container instance; executes the second verification script through the second container instance to obtain a second verification result; sends the second verification result to the second container instance through the second temporary static route; and after receiving the second verification result through the second container instance, sends the second verification result to the control center.

[0183] Optionally, the storage medium is also configured to store program code for performing the following steps: After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: if the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine, then the firewall policy is determined to be valid; if the verification result indicates that the access verification fails but the hop tracing passes through the firewall, then the firewall policy is determined to be valid, but the destination machine is not started; if the verification result indicates that the access verification fails and the hop tracing does not pass through the firewall, then the firewall policy is determined to be invalid.

[0184] Optionally, the storage medium is also configured to store program code for performing the following steps: after verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: deleting the temporary static route through the control center; and sending a shutdown request to the container cloud platform through the control center.

[0185] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing verification method steps of a firewall policy.

[0186] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0187] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0188] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0189] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0190] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0191] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0192] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for verifying firewall policies, characterized in that, include: Upon detecting a verification request for a firewall policy, the information of the firewall policy is determined, wherein the information of the firewall policy includes at least the source machine address and the destination machine address. Generate a policy verification instruction based on the source machine address and the destination machine address; In response to the policy verification command, a temporary static route is configured, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the address of the source machine; According to the policy verification instruction, the control center generates a container configuration list, wherein the container configuration list includes information on configuring the target container instance and the verification script; The firewall policy is verified based on the temporary static route, the target container instance, and the verification script to obtain the verification result. The policy verification instruction generated based on the source machine address and the destination machine address includes: The transmission direction of the data flow in the firewall policy is verified based on the source machine address and the destination machine address to obtain the direction verification result. If the direction verification result is a positive access relationship, then a first policy verification instruction is generated, wherein the positive access relationship is that the transmission direction of the data flow is from the inner area of ​​the firewall to the outer area of ​​the firewall. If the direction verification result is a reverse access relationship, a second policy verification instruction is generated, wherein the reverse access relationship is that the data flow transmission direction is from the outer area of ​​the firewall to the inner area of ​​the firewall; In response to the first policy verification command, an internal detection zone is constructed in the firewall's internal zone, wherein the internal detection zone is used to construct a first container instance, and the first container instance is used to simulate the source machine of the firewall's internal zone; The system remotely logs into the internal core router through the control center and configures a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address of the firewall's internal zone.

2. The method according to claim 1, characterized in that, After remotely logging into the internal core router through the control center and configuring the first temporary static route, the method further includes: The control center sends a first configuration generation request to the internal container cloud platform, wherein the first configuration generation request carries information about a first container configuration list, and the first container configuration list includes information about configuring a first container instance and a first verification script. After receiving the first configuration generation request through the internal container cloud platform, the internal container cloud platform generates the first container instance and starts the first container instance; The first verification result is obtained by executing the first verification script through the first container instance; The first verification result is sent to the first container instance via the first temporary static route; After receiving the first verification result through the first container instance, the first verification result is sent to the control center.

3. The method according to claim 1, characterized in that, In the event of generating a second policy verification instruction, configuring a temporary static route in response to the policy verification instruction includes: In response to the second policy verification command, an external detection zone is constructed in the firewall external zone, wherein the external detection zone is used to construct a second container instance, and the second container instance is used to simulate the source machine of the firewall external zone; The control center remotely logs into the external core router and configures a second temporary static route, wherein the second temporary static route is a static route with the highest priority, and the destination address of the second temporary static route is the source machine address of the firewall's external zone.

4. The method according to claim 3, characterized in that, After remotely logging into the external core router through the control center and configuring the second temporary static route, the method further includes: The control center sends a second configuration generation request to an external container cloud platform. The second configuration generation request carries information about a second container configuration list, which includes information about configuring a second container instance and a second verification script. After receiving the second configuration generation request through the external container cloud platform, the external container cloud platform generates the second container instance and starts the second container instance; The second verification result is obtained by executing the second verification script through the second container instance; The second verification result is sent to the second container instance via the second temporary static route; After receiving the second verification result through the second container instance, the second verification result is sent to the control center.

5. The method according to claim 1, characterized in that, After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: If the verification result indicates that the access verification is successful and the hop tracing reaches the destination machine, then the firewall policy is determined to be effective. If the verification result indicates that the access verification failed but the hop tracing passed the firewall, then the firewall policy is determined to be effective, but the target machine is not running. If the verification result indicates that access verification failed and hop tracking did not pass through the firewall, then the firewall policy is determined to be invalid.

6. The method according to claim 5, characterized in that, After verifying the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtaining the verification result, the method further includes: The temporary static route is deleted through the control center; The control center sends a shutdown request to the container cloud platform, wherein the shutdown request is a request to shut down the target container instance; After receiving the shutdown request, the container cloud platform shuts down the target container instance.

7. A firewall policy verification device, characterized in that, include: The first determining unit is configured to determine the information of the firewall policy after detecting a verification request for the firewall policy, wherein the information of the firewall policy includes at least the source machine address and the destination machine address. The first generation unit is used to generate a policy verification instruction based on the source machine address and the destination machine address; A response unit is configured to respond to the policy verification command and configure a temporary static route, wherein the temporary static route is used to connect the destination machine and the target container instance, and the address of the target container instance is the address of the source machine. The second generation unit is used to generate a container configuration list for the control center according to the policy verification instruction, wherein the container configuration list includes information on configuring the target container instance and the verification script; The verification unit is used to perform verification on the firewall policy based on the temporary static route, the target container instance, and the verification script, and obtain the verification result. The first generation unit includes: a verification module, used to perform direction verification on the transmission direction of data flow in the firewall policy based on the source machine address and the destination machine address, and obtain the direction verification result; a first generation module, used to generate a first policy verification instruction if the direction verification result is a forward access relationship, wherein the forward access relationship is the transmission direction of the data flow from the firewall's internal area to the firewall's external area; and a second generation module, used to generate a second policy verification instruction if the direction verification result is a reverse access relationship, wherein the reverse access relationship is the transmission direction of the data flow from the firewall's external area to the firewall's internal area. The response unit includes: a first response module, used to respond to the first policy verification instruction when the first policy verification instruction is generated, and to build an internal detection zone in the firewall's internal zone, wherein the internal detection zone is used to build a first container instance, and the first container instance is used to simulate the source machine of the firewall's internal zone; and a first configuration module, used to remotely log in to the internal core router through the control center and configure a first temporary static route, wherein the first temporary static route is a static route with the highest priority, and the destination address of the first temporary static route is the source machine address of the firewall's internal zone.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the verification method of the firewall policy according to any one of claims 1 to 6.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the verification method of the firewall policy according to any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the verification method for the firewall policy according to any one of claims 1 to 6.

Images