User access request processing method and device and electronic equipment

Abstract

The invention discloses a user access request processing method and device and electronic equipment, the method is applied to the field of network security, and the method comprises the following steps: receiving log data of a preset service system through a message bus; analyzing the log data to obtain configuration change information; updating the user configuration information corresponding to the security policy of the firewall according to the configuration change information, and sending the updated user configuration information to the firewall; and processing the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall. Through application of the method and the device, the problem that in a process of controlling the firewall through the security policy in the related technology, the IP information of the user is changed, and the configuration information of the security policy needs to be frequently changed, so that the performance of a service system is relatively poor is solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method, device, and electronic device for processing user access requests. Background Art

[0002] Security policies are an essential component of firewalls, and their most important function is access control. Security policies define the network resources a user or device is allowed to access, as well as the conditions for access. Existing technologies can obtain the correspondence between users and IP addresses, sort and group user IP addresses, generate an address book, and then generate security policies. When a user's IP address changes, it's necessary to regularly obtain the full set of username-IP address correspondences to find the corresponding address book for updates. An incremental algorithm is then used to calculate the set of changed IP addresses. For each IP address, the corresponding address book is searched and replaced. Simultaneously, the configuration changes are synchronized to the firewall for effect.

[0003] However, due to the discontinuity of user IP addresses, address books can only be configured for a single IP address in the existing technology. This results in multiple address books being required to implement the same service policy's source user. Furthermore, the same user can access multiple service systems, meaning their IP address is assigned to multiple address books. In this case, when a user's IP address changes, all associated address books must be queried and updated in batches. This results in complex operations, consumes a large amount of system resources, reduces system performance, and easily leads to data inconsistencies.

[0004] In the process of controlling firewalls through security policies in related technologies, due to changes in user IP information, the configuration information of security policies needs to be frequently changed, resulting in poor business system performance. No effective solution has been proposed so far. Summary of the Invention

[0005] The main purpose of this application is to provide a method, device and electronic device for processing user access requests to solve the problem in the related art that in the process of controlling the firewall through security policy, the configuration information of the security policy needs to be frequently changed due to changes in the user's IP information, resulting in poor business system performance.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for processing user access requests is provided, the method comprising: receiving log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; parsing the log data to obtain configuration change information; updating user configuration information corresponding to the firewall's security policy based on the configuration change information, and sending the updated user configuration information to the firewall; processing the received user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0007] Furthermore, before receiving the log data of the preset business system through the message bus, it includes: obtaining user authority data, wherein the user authority data at least includes the user's user information, the business system name and the business system IP information; grouping the users according to the business system name to obtain user group information; generating user configuration information of the firewall's security policy based on the user group information, the business system, and the business system IP information; and deploying the firewall based on the user configuration information and the firewall's security policy.

[0008] Furthermore, before updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, it includes: obtaining network IP information from a first business system, wherein the first business system is used to assign IP addresses to network devices, and the network devices at least include user devices; determining the correspondence between the user and IP information based on the network IP information; and sending the correspondence between the user and IP information to the firewall.

[0009] Furthermore, after sending the correspondence between the user and the IP information to the firewall, the method also includes: receiving the user's IP update information through a preset interface; updating the correspondence between the user and the IP information in the firewall based on the user's IP update information to obtain an updated correspondence; updating the user configuration information of the firewall's security policy based on the updated correspondence to obtain updated user configuration information; and processing the user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0010] Furthermore, after updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, the method also includes: obtaining first configuration information of the preset business system every preset time period; comparing the first configuration information with the user configuration information of the current security policy of the firewall to obtain a comparison result; when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent, updating the user configuration information of the security policy of the firewall based on the first configuration information.

[0011] Furthermore, the received user access request is processed through the firewall based on the updated user configuration information and the security policy of the firewall, including: determining the user configuration information corresponding to the source IP information based on the source IP information of the user access request; searching for the first security policy corresponding to the user access request based on the user configuration information corresponding to the source IP information; if the first security policy is found, processing the user access request based on the first security policy; if the first security policy is not found, processing the user access request based on the preset security policy.

[0012] Furthermore, the log data includes: permission change information. After receiving the log data of the preset business system through the message bus, the method also includes: determining the changed user, permission operation and business system change information based on the permission change information; updating the user configuration information corresponding to the security policy of the firewall based on the changed user, permission operation and business system change information to obtain the updated user configuration information; processing the user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0013] Furthermore, the log data includes: new business information. After receiving the log data of the preset business system through the message bus, the method also includes: determining the newly added target business based on the new business information, and determining the user information involved in the target business; constructing a first user group based on the user information involved in the target business, and updating the user configuration information corresponding to the security policy of the firewall based on the first user group to obtain the updated user configuration information; constructing a second security policy based on the first user group and the new business information, and updating the security policy of the firewall based on the second security policy to obtain the updated security policy; processing the user access request through the firewall based on the updated user configuration information and the updated security policy.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a device for processing user access requests is provided, which includes: a first receiving unit, used to receive log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; a parsing unit, used to parse the log data to obtain configuration change information; a first updating unit, used to update user configuration information corresponding to the security policy of the firewall according to the configuration change information, and send the updated user configuration information to the firewall; a first processing unit, used to process the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0015] Furthermore, the device also includes: a first acquisition unit, used to obtain user authority data before receiving log data of a preset business system through a message bus, wherein the user authority data at least includes the user's user information, business system name and business system IP information; a grouping unit, used to group the users according to the business system name to obtain user group information; a generation unit, used to generate user configuration information of the firewall's security policy based on the user group information, the business system, and the business system IP information; a deployment unit, used to deploy the firewall based on the user configuration information and the firewall's security policy.

[0016] Furthermore, the device also includes: a second acquisition unit, used to obtain network IP information from a first business system before updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, wherein the first business system is used to allocate IP addresses to network devices, and the network devices at least include user devices; a first determination unit, used to determine the correspondence between the user and the IP information based on the network IP information; and a sending unit, used to send the correspondence between the user and the IP information to the firewall.

[0017] Furthermore, the device also includes: a second receiving unit, used to receive the user's IP update information through a preset interface after sending the correspondence between the user and the IP information to the firewall; a second updating unit, used to update the correspondence between the user and the IP information in the firewall based on the user's IP update information to obtain an updated correspondence; a third updating unit, used to update the user configuration information of the security policy of the firewall based on the updated correspondence to obtain updated user configuration information; a second processing unit, used to process the user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0018] Furthermore, the device also includes: a third acquisition unit, used to obtain the first configuration information of the preset business system every preset time period after the user configuration information corresponding to the security policy of the firewall is updated according to the configuration change information; a comparison unit, used to compare the first configuration information with the user configuration information of the current security policy of the firewall to obtain a comparison result; and a fourth update unit, used to update the user configuration information of the security policy of the firewall according to the first configuration information when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent.

[0019] Furthermore, the first processing unit includes: a determination subunit, used to determine the user configuration information corresponding to the source IP information of the user access request based on the source IP information of the user access request; a search subunit, used to search for the first security policy corresponding to the user access request based on the user configuration information corresponding to the source IP information; a first processing subunit, used to process the user access request according to the first security policy when the first security policy is found; and a second processing subunit, used to process the user access request according to a preset security policy when the first security policy is not found.

[0020] Furthermore, the log data includes: permission change information, and the device also includes: a second determination unit, which is used to determine the changed user, permission operation and business system change information based on the permission change information after receiving the log data of the preset business system through the message bus; a fifth update unit, which is used to update the user configuration information corresponding to the security policy of the firewall based on the changed user, permission operation and business system change information to obtain the updated user configuration information; and a third processing unit, which is used to process the user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0021] Furthermore, the log data includes: new business information, and the device also includes: a third determination unit, which is used to determine the newly added target business and the user information involved in the target business based on the new business information after receiving the log data of the preset business system through the message bus; a sixth update unit, which is used to construct a first user group based on the user information involved in the target business, and update the user configuration information corresponding to the security policy of the firewall based on the first user group to obtain the updated user configuration information; a seventh update unit, which is used to construct a second security policy based on the first user group and the new business information, and update the security policy of the firewall based on the second security policy to obtain the updated security policy; a fourth processing unit, which is used to process the user access request through the firewall based on the updated user configuration information and the updated security policy.

[0022] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the method for processing user access requests described in any of the above-mentioned items, and which, when executed by a processor, implements the steps of the method for processing user access requests described in each embodiment of the present application.

[0023] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned methods for processing user access requests is implemented.

[0024] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned methods for processing user access requests.

[0025] This application receives log data from the preset business system through the message bus and captures the user's IP change information. The centralized management system can parse these logs in real time and extract the details required for configuration changes. Based on the parsed configuration change information, it can dynamically adjust the user configuration information on the firewall, reducing the delay and errors caused by manual modification of the traditional address book, and improving the real-time and accuracy of access control. At the same time, by combining the updated user configuration information with the security policy of the firewall, the firewall can accurately process each user access request based on the latest user IP and permission status, thereby effectively ensuring the security of the network and the continuity of business. It is particularly suitable for scenarios where the terminal user's IP changes frequently, reducing the complexity of network management, enhancing the adaptability and flexibility of the system, and achieving the effect of improving the performance of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0027] Figure 1 is a flowchart of a method for processing a user access request provided in Example 1 of the present application;

[0028] Figure 2 This is a schematic diagram of optional information required for matching security policies provided in Example 1 of the present application;

[0029] Figure 3 This is a schematic diagram of an optional process from business system information change to firewall configuration provided in accordance with the first embodiment of the present application;

[0030] Figure 4 is a schematic diagram of a device for processing user access requests provided in accordance with the second embodiment of the present application;

[0031] Figure 5 This is a schematic diagram of an electronic device for processing user access requests provided in Example 5 of the present application. DETAILED DESCRIPTION

[0032] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0034] It should be noted that this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0035] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Example 1

[0038] The present invention will be described below in conjunction with preferred implementation steps. Figure 1 Flowchart of the method for processing user access request provided in Example 1 of the present application. Figure 1 As shown, the method includes the following steps:

[0039] Step S101: receiving log data of a preset business system via a message bus, wherein the log data at least includes: IP change information.

[0040] The execution entity of the method for processing user access requests provided in Example 1 of the present application can be a centralized management system. This system is responsible for coordinating and controlling the entire access control process. Its main functions include: initializing and updating the user IP mapping relationship of the firewall in real time, generating and adjusting security policies based on business permissions, and monitoring real-time logs on the message bus, processing information such as user IP changes, permission changes, and new business launches, ensuring the accuracy and real-time performance of network access control while minimizing interference with the existing network.

[0041] In the first embodiment, a centralized communication mechanism may be used to receive log data of a preset business system through a message bus, so as to capture and respond to dynamic changes in the business system in real time.

[0042] The IP change information in the log data specifically refers to when a user device obtains a new IP address from the DHCP server that differs from the previous one, or when a user's permissions change, resulting in an update to the IP resources they can access, resulting in a corresponding event log generated by the business system. These logs are sent to the message bus, where they are subscribed to and processed by the centralized management system. This is used to promptly update the mapping between user IP addresses and permissions in the firewall, thereby dynamically adjusting the firewall's access control policy and ensuring the real-time and accuracy of security policies. This approach avoids the delays and errors associated with manual updates, improving system automation and reliability.

[0043] Step S102: parse the log data to obtain configuration change information.

[0044] In this first embodiment, the centralized management system reads real-time logs received from the message bus. These logs record events such as user IP address changes, permission changes, and new service launches. By parsing these logs, the management system can extract key configuration change information, such as which users' IP addresses have changed or which services have had their access permissions increased or decreased. Based on this information, the management system can determine firewall configuration adjustments, ensuring the real-time update and accuracy of network access control policies.

[0045] Step S103: updating the user configuration information corresponding to the security policy of the firewall according to the configuration change information, and sending the updated user configuration information to the firewall.

[0046] In the first embodiment of the present invention, after parsing the log data, the centralized management system automatically adjusts the user configuration information related to the security policy in the firewall based on the obtained information such as IP change, user authority change or new service launch (ie the above-mentioned configuration change information).

[0047] For example, when a user's IP address changes, the system updates the firewall's internal IP-to-user mapping table. When service permissions change, user groups are modified or created accordingly, and the user group configuration in the policy is updated. The updated user configuration information is then pushed to the firewall, ensuring its access control policy reflects the latest service and user status in real time, thereby maintaining network security and compliance.

[0048] By dynamically updating the user configuration information in the firewall according to the configuration change information when the user IP information changes, rather than directly modifying the security policy, the flexibility and efficiency of network access control can be significantly improved, avoiding the performance degradation and resource consumption caused by frequent adjustments to policy configurations. At the same time, it ensures the real-time and accuracy of security policies. Even in a dynamic IP environment, it can seamlessly adapt to changes in user permissions, thereby effectively protecting network security, reducing management and maintenance costs, and improving user experience and the overall stability of the system.

[0049] Step S104: Processing the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0050] In this first embodiment, based on updated user configuration information and the firewall's security policy, the firewall can intelligently process received user access requests. For example, by examining the IP address in the request, it quickly matches the corresponding username or user group. Then, based on the user group access rights set in the security policy, the firewall makes a real-time decision on whether to grant access. This eliminates the need for frequent policy changes in scenarios where end-user IP addresses change. Simply updating the user configuration information ensures accurate and timely network access control, effectively maintaining network security.

[0051] In summary, the method for processing user access requests provided in Example 1 of the present application receives log data of a preset business system through a message bus and captures user IP change information. The centralized management system can parse these logs in real time and extract the details required for configuration changes, thereby being able to dynamically adjust the user configuration information on the firewall based on the configuration change information obtained through the analysis, reducing the delays and errors caused by manual modification of traditional address books, and improving the real-time and accuracy of access control. At the same time, by combining the updated user configuration information with the security policy of the firewall, the firewall can accurately process each user access request based on the latest user IP and permission status, thereby effectively ensuring the security of the network and the continuity of the business. It is particularly suitable for scenarios where the terminal user IP changes frequently, reducing the complexity of network management, enhancing the adaptability and flexibility of the system, and achieving the effect of improving the performance of the business system.

[0052] Optionally, in the method for processing user access requests provided in Example 1 of the present application, before receiving log data of a preset business system through a message bus, the method includes: obtaining user authority data, wherein the user authority data includes at least the user's user information, the business system name, and the business system IP information; grouping users according to the business system name to obtain user group information; generating user configuration information of the firewall's security policy based on the user group information, the business system, and the business system IP information; and deploying the firewall based on the user configuration information and the firewall's security policy.

[0053] In this first embodiment, the process of obtaining user permission data involves collecting data including user information (such as username), business system name, and business system IP address information. This data is sourced from the enterprise's permission management system and is used to describe the user's access rights to different business systems. Subsequently, users are grouped according to the business system to form specific user group information. This step is intended to simplify firewall policy configuration, allowing users with the same business access requirements to be managed uniformly.

[0054] Next, use the generated user group information, business system name and business system IP information to create user configuration information for the firewall security policy, that is, define the business systems that the user group is allowed to access, as well as the behavioral rules for access (such as allow or deny).

[0055] Finally, this user configuration information is combined with the firewall's existing security policies and deployed to the firewall through a centralized management system, enabling precise control of user access requests. This allows for rapid updates to user configurations, even when user IP addresses frequently change, without having to modify each individual security policy. This improves the flexibility and real-time nature of network access control and ensures the effective execution of network security policies.

[0056] Through the above steps, the user configuration information of the firewall can be automatically adjusted according to the user permission data in a dynamic IP environment, ensuring that the security policy is synchronized with the actual user access rights, reducing the configuration burden of the network administrator and avoiding the problem of frequent modification of the firewall security policy, thereby achieving the effect of improving the performance of the business system and enhancing the system's adaptability and security.

[0057] Optionally, in the method for processing user access requests provided in Example 1 of the present application, before updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, it includes: obtaining network IP information from the first business system, wherein the first business system is used to assign IP addresses to network devices, and the network devices include at least the user's devices; determining the correspondence between the user and the IP information based on the network IP information; and sending the correspondence between the user and the IP information to the firewall.

[0058] In the first embodiment of the present invention, the process of obtaining network IP information from a first business system (for example, a DHCP (Dynamic Host Configuration Protocol Server) server, i.e., a dynamic host configuration protocol server for automatically assigning IP addresses and other network configuration parameters (for example, subnet mask, default gateway, DNS server address, etc.)) involves reading the IP address data assigned by the system to network devices (including user terminal devices). The first business system plays a key role in the dynamic IP allocation scenario. It assigns IP addresses to users' devices based on network requirements. After obtaining these IP information, the centralized management system will analyze the data to determine the correspondence between the user and the assigned IP address, that is, establish an association between the user identity and the network IP address currently used by the user.

[0059] The constructed correspondence between user and IP information is then sent to the firewall's memory via a secure channel to update the firewall's user authentication database. This update enables the firewall to enforce security policies based on the latest user-IP correspondence, ensuring accurate user identification even when the end user's IP address changes frequently, and processing user-initiated network access requests according to pre-set access control rules.

[0060] By automatically synchronizing user IP information, the complexity and error-proneness of manual configuration are avoided, the real-time and accuracy of network access control are improved, and network security protection capabilities are enhanced. At the same time, the problem of frequent modification of firewall security policies is avoided, thereby achieving the effect of improving business system performance.

[0061] Optionally, in the method for processing user access requests provided in Example 1 of the present application, after sending the correspondence between the user and IP information to the firewall, the above method also includes: receiving the user's IP update information through a preset interface; updating the correspondence between the user and IP information in the firewall based on the user's IP update information to obtain an updated correspondence; updating the user configuration information of the firewall's security policy based on the updated correspondence to obtain updated user configuration information; and processing the user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0062] In this first embodiment, the centralized management system receives user IP update information pushed by staff or other external data sources through a preset interface. This information reflects the latest changes to user IP addresses. Based on the received IP update information, the centralized management system updates the correspondence between user and IP information stored in its memory in real time, ensuring that the correspondence remains consistent with the actual user IP allocation status on the network.

[0063] Subsequently, the firewall automatically adjusts the user configuration information of its security policy based on the updated correspondence, which means that the policy on the firewall will reference the latest user IP association to adapt to dynamic changes in the network.

[0064] Ultimately, based on the updated user configuration information, the firewall can accurately process the access requests initiated by the user according to the security policy it has set, and decide whether to allow the data packet to pass. In this way, even in an environment where the user IP frequently changes, the effectiveness and real-time nature of network access control can be maintained, thereby improving the level of network security management.

[0065] Optionally, in the method for processing user access requests provided in Example 1 of the present application, after updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, the above method also includes: obtaining first configuration information of a preset business system every preset time period; comparing the first configuration information with the user configuration information of the security policy of the current firewall to obtain a comparison result; when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent, updating the user configuration information of the security policy of the firewall based on the first configuration information.

[0066] In this embodiment 1, every preset time period (such as 12 hours, 1 day, 3 days, etc., which is not specifically limited in this embodiment 1), the centralized management system actively obtains the first configuration information from the preset business system (such as the authority control system). This information covers the user's latest authority settings, including the business systems that the user can access and their IP addresses, etc.

[0067] The system then carefully compares this first configuration information with the user configuration information in the firewall's current security policy to check for any discrepancies. If the comparison results indicate a discrepancy between the business system's configuration information and the firewall's user configuration information, this means that the user's permissions or associated IP address may have changed, but the information on the firewall has not yet been updated. At this point, the centralized management system automatically adjusts and updates the firewall's security policy based on the latest first configuration information in the business system, ensuring that its user configuration information remains synchronized with the business system's actual permission settings. This eliminates security policy inaccuracies caused by information delays or loss, and maintains the stability and accuracy of network access control.

[0068] Optionally, in the method for processing user access requests provided in Example 1 of the present application, the received user access request is processed through the firewall based on the updated user configuration information and the security policy of the firewall, including: determining the user configuration information corresponding to the source IP information based on the source IP information of the user access request; searching for the first security policy corresponding to the user access request based on the user configuration information corresponding to the source IP information; if the first security policy is found, processing the user access request based on the first security policy; if the first security policy is not found, processing the user access request based on the preset security policy.

[0069] In this first embodiment, when the firewall receives a user access request, it first parses the source IP address in the request. Using the correspondence between user and IP addresses stored in memory, it determines the user profile associated with the source IP address, including the user's username (user group information) and corresponding access permissions. The firewall then searches for a first security policy that matches the access request based on the determined user profile. This policy typically contains the network resources and access conditions that a specific user group can access.

[0070] If the firewall successfully finds the first security policy corresponding to the user access request, it will directly process the user access request according to the rules of the first security policy and decide whether to allow the request to pass, thereby achieving precise access control. However, if the first security policy is not found, indicating that the source IP information is not in the existing user configuration, the firewall will fall back to the preset security policy, such as the security policy implemented by the business system by default. This is usually a more general or conservative policy that performs basic security checks on access requests to prevent unauthorized access and ensure network security.

[0071] Through the above steps, the firewall can flexibly handle various user access requests, ensuring efficient access for authorized users and maintaining the security and stability of the network environment.

[0072] Optionally, in the method for processing user access requests provided in Example 1 of the present application, the log data includes: permission change information. After receiving the log data of the preset business system through the message bus, the above method also includes: determining the changed user, permission operation and business system change information based on the permission change information; updating the user configuration information corresponding to the security policy of the firewall based on the changed user, permission operation and business system change information to obtain the updated user configuration information; processing the user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0073] In this first embodiment, the log data may also include permission change information, which is generated in real time by the business system (such as the permission control system or business management system) and sent to the message bus when user permissions change. When the centralized management system receives permission change information from the preset business system via the message bus, it needs to immediately parse these logs to extract key change details, including the changed user (i.e., the specific user whose permissions were updated), permission operations (such as adding, deleting, or modifying access permissions), and business system change information (the specific business system involved and any possible business system IP changes).

[0074] Then, the centralized management system updates the user configuration information corresponding to the security policy in the firewall memory based on the information of the changed user, ensuring that the members of the user group are consistent with their access rights. The update process may involve adding or deleting users from the user group, modifying the user name or the user group's corresponding behavior rules for different business systems (such as allow or deny), and modifying business system information (such as the name of the business system, IP information, user group information and the correspondence between business systems).

[0075] For example, in the parsed permission change information, if the permission change information involves the user's newly added access rights to the OA system, the centralized management system will add the user to the corresponding user group OA_UserGroup in the user configuration information corresponding to the firewall; conversely, if the user loses access rights to the FR system, it will remove the user from the user group FR_UserGroup to ensure that the user group members accurately match the user's actual access rights, thereby obtaining the updated user configuration information.

[0076] Finally, based on the firewall's security policies and updated user configuration information, the firewall can more accurately process user access requests. For example, when a user attempts to access a network resource, the firewall examines the source IP address in the request, determines the user's identity through an internal mapping mechanism, and determines whether access is permitted based on the latest security policy, thereby achieving dynamic, real-time, and precise access control. This mechanism ensures that even in scenarios where end-user IP addresses frequently change, network access control can effectively respond to permission changes, ensuring network security and compliance.

[0077] By parsing permission change information in real time and updating the firewall's user configuration information, changes in user access rights can be quickly reflected, avoiding the delays that may be caused by traditional configuration update mechanisms, and ensuring the real-time and accuracy of network access control. In addition, since there is no need to frequently change the address book objects on the firewall, this solution also reduces the impact of configuration updates on firewall performance, improving system stability and efficiency. Ultimately, user access behavior on the network can be strictly controlled in accordance with the latest permission settings, ensuring the security and compliance of the network environment, while simplifying the complexity of network management and avoiding the problem of frequent modifications to firewall security policies, thereby achieving the effect of improving business system performance.

[0078] Optionally, in the method for processing user access requests provided in Example 1 of the present application, the log data includes: new business information. After receiving the log data of the preset business system through the message bus, the above method also includes: determining the newly added target business based on the new business information, and determining the user information involved in the target business; constructing a first user group based on the user information involved in the target business, and updating the user configuration information corresponding to the security policy of the firewall based on the first user group to obtain the updated user configuration information; constructing a second security policy based on the first user group and the new business information, and updating the security policy of the firewall based on the second security policy to obtain the updated security policy; processing the user access request through the firewall based on the updated user configuration information and the updated security policy.

[0079] In the first embodiment of the present invention, the new business information contained in the log data refers to the real-time notification generated by the business system and sent to the message bus when the enterprise or staff starts a new business. After receiving the new business information, the centralized management system parses the received new business information to determine the newly added target business system and the user information that may be involved in the business system, including but not limited to user names, corresponding access rights, etc. Based on the user information involved in the identified target business system, the centralized management system creates a first user group for centralized management of all users directly related to the new business system.

[0080] The centralized management system then uses the constructed first user group to update the user configuration information corresponding to the firewall's security policy. For example, the first user group and the IP information corresponding to each username in the first user group are added to the user configuration information corresponding to the target business system to ensure that the firewall can identify and control these users' access to the new business.

[0081] At the same time, to specifically control network access for new services, the centralized management system constructs a second security policy based on the first user group and the newly added service information. This typically involves defining access rules, such as allowing a specific user group (such as the first user group mentioned above) to access the service port of the new service system, or allowing access within a specific time window, thereby achieving precise access control for the new service. Once the second security policy is constructed, the centralized management system pushes it to the firewall, updating the firewall's security policy library, thereby enabling dynamic adjustment of the firewall policy to accommodate the addition of the new service.

[0082] Finally, based on the updated user configuration information and security policies, the firewall can process the user's access request more accurately, decide whether to allow the data packet to pass, and ensure secure access to network resources.

[0083] Through the above steps, network management can dynamically adapt to the rapid launch of new services, avoiding the delays that may exist in traditional network configuration update mechanisms and ensuring that new services are protected by appropriate security policies at launch. Furthermore, by establishing a primary user group and a secondary security policy, it simplifies the work of network administrators, avoids the tediousness and errors of manual configuration, and improves the efficiency and accuracy of network management. This minimizes network transformation, ensures seamless service migration, and maintains a secure and stable network environment. It also avoids the problem of frequent firewall security policy modifications, thereby improving service system performance.

[0084] Optionally, in the first embodiment, the schematic diagram of the information required for matching the security policy in this solution can be as follows: Figure 2 shown. Figure 2 This section demonstrates how a firewall performs access control based on user access request information. A security policy contains basic attributes, including source IP address, destination IP address, protocol, port number, behavior, and user. The user column is used to match the visitor's identity, which is the user configuration information mentioned above. User configuration information includes the mapping between IP addresses and user identities. For example, 192.168.1.2 corresponds to user zhangsan.

[0085] Figure 2The user-pointing security policy table's mapping between IP addresses and users means that when the firewall receives a packet, it first resolves the source IP address and then searches the IP / user table for the corresponding username. Once the user's identity is determined, the firewall returns to the security policy table and matches the appropriate access control rule based on the information in the user column, deciding whether to allow or block the packet. This mechanism ensures that even if the user's IP address changes frequently, the firewall, through user identity binding, can still accurately enforce access control policies in real time, safeguarding network security.

[0086] also, Figure 2 The figure also shows how an external data source can modify the correspondence between IP addresses and users. The external data source can be a business system administrator or the administrator of the centralized management system mentioned above.

[0087] Optionally, in this embodiment 1, the flow chart from business system information change to firewall configuration in this solution can be as follows: Figure 3 As shown, this ensures timely response to business changes and their conversion into firewall configurations, safeguarding system security. Real-time logs are sent to the DHCP system, business authorization system, and business management system when changes occur. These logs are sent to the message bus. The message bus receives the real-time logs from these three systems. The centralized management system monitors the real-time logs on the message bus. The centralized management system analyzes the message content, calculates the business change information, and converts it into the corresponding firewall configuration, resulting in the changed firewall configuration. The centralized management system pushes the changed firewall configuration to the firewall. The firewall receives the configuration and executes the corresponding security policy.

[0088] For example, if a user's IP address change is read from the message bus, the mapping between the IP address and the user is updated in the firewall's memory. If a user's permissions change is read from the message bus, the corresponding user group is found, the user group configuration is modified, and the user group configuration is pushed to the firewall. If a new service launch is read, a new policy is created based on the permissions control information of the service system to which the new service belongs, new user group information is created, and the newly added user group information is pushed to the firewall.

[0089] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0090] Example 2

[0091] The second embodiment of the present application further provides a device for processing user access requests. It should be noted that the device for processing user access requests in the second embodiment of the present application can be used to execute the method for processing user access requests provided in the first embodiment of the present application. The device for processing user access requests provided in the second embodiment of the present application is introduced below.

[0092] Figure 4 Schematic diagram of a device for processing user access requests according to the second embodiment of the present application. Figure 4 As shown, the device includes: a first receiving unit 401, a parsing unit 402, a first updating unit 403 and a first processing unit 404.

[0093] Specifically, the first receiving unit 401 is configured to receive log data of a preset business system through a message bus, wherein the log data at least includes IP change information.

[0094] The parsing unit 402 is used to parse the log data to obtain configuration change information.

[0095] The first updating unit 403 is configured to update the user configuration information corresponding to the security policy of the firewall according to the configuration change information, and send the updated user configuration information to the firewall.

[0096] The first processing unit 404 is configured to process the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0097] The user access request processing device provided in Example 2 of the present application receives log data of a preset business system through a message bus and captures user IP change information. The centralized management system can parse these logs in real time and extract the details required for configuration changes, so that the user configuration information on the firewall can be dynamically adjusted based on the configuration change information obtained by parsing, reducing the delays and errors caused by manual modification of traditional address books, and improving the real-time and accuracy of access control. At the same time, by combining the updated user configuration information with the security policy of the firewall, the firewall can accurately process each user access request based on the latest user IP and permission status, thereby effectively ensuring the security of the network and the continuity of the business. It is particularly suitable for scenarios where the terminal user IP changes frequently, reducing the complexity of network management, enhancing the adaptability and flexibility of the system, and achieving the effect of improving the performance of the business system.

[0098] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned device also includes: a first acquisition unit, used to obtain user authority data before receiving the log data of the preset business system through the message bus, wherein the user authority data at least includes the user's user information, business system name and business system IP information; a grouping unit, used to group users according to the business system name to obtain user group information; a generation unit, used to generate user configuration information of the firewall security policy based on the user group information, business system, and business system IP information; a deployment unit, used to deploy the firewall based on the user configuration information and the firewall security policy.

[0099] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned device also includes: a second acquisition unit, used to obtain network IP information from the first business system before updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, wherein the first business system is used to allocate IP addresses to network devices, and the network devices include at least the user's equipment; a first determination unit, used to determine the correspondence between the user and the IP information based on the network IP information; and a sending unit, used to send the correspondence between the user and the IP information to the firewall.

[0100] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned device also includes: a second receiving unit, used to receive the user's IP update information through a preset interface after sending the correspondence between the user and IP information to the firewall; a second updating unit, used to update the correspondence between the user and IP information in the firewall based on the user's IP update information, and obtain an updated correspondence; a third updating unit, used to update the user configuration information of the firewall's security policy based on the updated correspondence, and obtain updated user configuration information; a second processing unit, used to process the user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0101] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned device also includes: a third acquisition unit, used to obtain the first configuration information of the preset business system every preset time period after the user configuration information corresponding to the security policy of the firewall is updated according to the configuration change information; a comparison unit, used to compare the first configuration information with the user configuration information of the security policy of the current firewall to obtain a comparison result; and a fourth update unit, used to update the user configuration information of the security policy of the firewall according to the first configuration information when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent.

[0102] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned first processing unit 404 includes: a determination subunit, used to determine the user configuration information corresponding to the source IP information based on the source IP information of the user access request; a search subunit, used to search for the first security policy corresponding to the user access request based on the user configuration information corresponding to the source IP information; a first processing subunit, used to process the user access request according to the first security policy when the first security policy is found; and a second processing subunit, used to process the user access request according to the preset security policy when the first security policy is not found.

[0103] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned log data includes: permission change information, and the above-mentioned device also includes: a second determination unit, which is used to determine the changed user, permission operation and business system change information based on the permission change information after receiving the log data of the preset business system through the message bus; a fifth update unit, which is used to update the user configuration information corresponding to the security policy of the firewall based on the changed user, permission operation and business system change information to obtain the updated user configuration information; and a third processing unit, which is used to process the user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0104] Optionally, in the user access request processing device provided in Example 2 of the present application, the above-mentioned log data includes: new business information, and the above-mentioned device also includes: a third determination unit, which is used to determine the newly added target business and the user information involved in the target business based on the new business information after receiving the log data of the preset business system through the message bus; a sixth update unit, which is used to construct a first user group based on the user information involved in the target business, and update the user configuration information corresponding to the security policy of the firewall based on the first user group to obtain the updated user configuration information; a seventh update unit, which is used to construct a second security policy based on the first user group and the new business information, and update the security policy of the firewall based on the second security policy to obtain the updated security policy; and a fourth processing unit, which is used to process the user access request through the firewall based on the updated user configuration information and the updated security policy.

[0105] The processing device for user access requests includes a processor and a memory. The above-mentioned first receiving unit 401, parsing unit 402, first updating unit 403 and first processing unit 404 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0106] The processor contains a kernel, which retrieves the corresponding program unit from the memory. You can set one or more kernels, and improve business system performance by adjusting kernel parameters.

[0107] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0108] A third embodiment of the present invention provides a computer-readable storage medium storing a program, which implements a method for processing a user access request when the program is executed by a processor.

[0109] A fourth embodiment of the present invention provides a processor, which is used to run a program, wherein the method for processing a user access request is executed when the program is running.

[0110] like Figure 5 As shown, embodiment 5 of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and capable of running on the processor. When the processor executes the program, the following steps are implemented: receiving log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; parsing the log data to obtain configuration change information; updating user configuration information corresponding to the security policy of the firewall according to the configuration change information, and sending the updated user configuration information to the firewall; processing the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

[0111] When the processor executes the program, the following steps are also implemented: before receiving log data of a preset business system through a message bus, the above method includes: obtaining user authority data, wherein the user authority data includes at least user information, business system name and business system IP information of the user; grouping users according to the business system name to obtain user group information; generating user configuration information of the firewall security policy based on the user group information, business system and business system IP information; and deploying the firewall based on the user configuration information and the firewall security policy.

[0112] When the processor executes the program, it also implements the following steps: before updating the user configuration information corresponding to the security policy of the firewall based on the configuration change information, it includes: obtaining network IP information from the first business system, wherein the first business system is used to assign IP addresses to network devices, and the network devices at least include user devices; determining the correspondence between the user and the IP information based on the network IP information; and sending the correspondence between the user and the IP information to the firewall.

[0113] When the processor executes the program, the following steps are also implemented: after the correspondence between the user and the IP information is sent to the firewall, the above method also includes: receiving the user's IP update information through a preset interface; updating the correspondence between the user and the IP information in the firewall according to the user's IP update information to obtain an updated correspondence; updating the user configuration information of the firewall's security policy according to the updated correspondence to obtain updated user configuration information; and processing the user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0114] When the processor executes the program, the following steps are also implemented: after updating the user configuration information corresponding to the firewall's security policy based on the configuration change information, the above method further includes: obtaining first configuration information of a preset business system every preset time period; comparing the first configuration information with the user configuration information of the current firewall's security policy to obtain a comparison result; and when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent, updating the user configuration information of the firewall's security policy based on the first configuration information.

[0115] When the processor executes the program, the following steps are also implemented: based on the updated user configuration information and the security policy of the firewall, the received user access request is processed through the firewall, including: determining the user configuration information corresponding to the source IP information of the user access request according to the source IP information of the user access request; searching for the first security policy corresponding to the user access request according to the user configuration information corresponding to the source IP information; if the first security policy is found, processing the user access request according to the first security policy; if the first security policy is not found, processing the user access request according to the preset security policy.

[0116] When the processor executes the program, the following steps are also implemented: the log data includes: permission change information. After receiving the log data of the preset business system through the message bus, the above method also includes: determining the changed user, permission operation and business system change information based on the permission change information; updating the user configuration information corresponding to the firewall security policy based on the changed user, permission operation and business system change information to obtain the updated user configuration information; processing the user access request through the firewall based on the updated user configuration information and the firewall security policy.

[0117] When the processor executes the program, the following steps are also implemented: the log data includes: new business information. After receiving the log data of the preset business system through the message bus, the above method also includes: determining the newly added target business based on the new business information, and determining the user information involved in the target business; constructing a first user group based on the user information involved in the target business, and updating the user configuration information corresponding to the firewall security policy based on the first user group to obtain updated user configuration information; constructing a second security policy based on the first user group and the new business information, and updating the firewall security policy based on the second security policy to obtain an updated security policy; processing the user access request through the firewall based on the updated user configuration information and the updated security policy.

[0118] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0119] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: receiving log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; parsing the log data to obtain configuration change information; updating user configuration information corresponding to the firewall's security policy based on the configuration change information, and sending the updated user configuration information to the firewall; and processing the received user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0120] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: before receiving log data of a preset business system through a message bus, the above method includes: obtaining user authority data, wherein the user authority data at least includes the user's user information, business system name and business system IP information; grouping users according to the business system name to obtain user group information; generating user configuration information of the firewall security policy based on the user group information, business system, and business system IP information; and deploying the firewall based on the user configuration information and the firewall security policy.

[0121] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: before updating the user configuration information corresponding to the firewall's security policy based on the configuration change information, it includes: obtaining network IP information from a first business system, wherein the first business system is used to assign IP addresses to network devices, and the network devices at least include the user's devices; determining the correspondence between the user and the IP information based on the network IP information; and sending the correspondence between the user and the IP information to the firewall.

[0122] When executed on a data processing device, the method is also suitable for executing an initialization program having the following method steps: after sending the correspondence between the user and the IP information to the firewall, the method further includes: receiving the user's IP update information through a preset interface; updating the correspondence between the user and the IP information in the firewall based on the user's IP update information to obtain an updated correspondence; updating the user configuration information of the firewall's security policy based on the updated correspondence to obtain updated user configuration information; and processing the user access request through the firewall based on the updated user configuration information and the firewall's security policy.

[0123] When executed on a data processing device, the method is also suitable for executing an initialization program having the following method steps: after updating the user configuration information corresponding to the firewall's security policy based on the configuration change information, the method further includes: obtaining first configuration information of a preset business system every preset time period; comparing the first configuration information with the user configuration information of the current firewall's security policy to obtain a comparison result; and when the comparison result indicates that the first configuration information and the current user configuration information are inconsistent, updating the user configuration information of the firewall's security policy based on the first configuration information.

[0124] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: processing a received user access request through a firewall based on updated user configuration information and the security policy of the firewall, including: determining the user configuration information corresponding to the source IP information of the user access request based on the source IP information of the user access request; searching for a first security policy corresponding to the user access request based on the user configuration information corresponding to the source IP information; if the first security policy is found, processing the user access request based on the first security policy; if the first security policy is not found, processing the user access request based on a preset security policy.

[0125] When executed on a data processing device, the method is also suitable for executing an initialization program having the following method steps: log data includes: new business information. After receiving the log data of a preset business system through a message bus, the above method also includes: determining a new target business based on the new business information, and determining the user information involved in the target business; constructing a first user group based on the user information involved in the target business, and updating the user configuration information corresponding to the firewall security policy based on the first user group to obtain updated user configuration information; constructing a second security policy based on the first user group and the new business information, and updating the firewall security policy based on the second security policy to obtain an updated security policy; and processing user access requests through the firewall based on the updated user configuration information and the updated security policy.

[0126] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0127] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0130] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0131] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0132] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0133] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0134] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0135] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for processing a user access request, characterized in that: include: Receive log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; Parsing the log data to obtain configuration change information; updating the user configuration information corresponding to the security policy of the firewall according to the configuration change information, and sending the updated user configuration information to the firewall; The received user access request is processed through the firewall based on the updated user configuration information and the security policy of the firewall.

2. The method according to claim 1, characterized in that Before receiving the log data of the preset business system through the message bus, it includes: Obtaining user authority data, wherein the user authority data at least includes user information, business system name and business system IP information of the user; Grouping the users according to the business system names to obtain user group information; Generate user configuration information of the security policy of the firewall according to the user group information, the business system, and the business system IP information; The firewall is deployed according to the user configuration information and the security policy of the firewall.

3. The method according to claim 1, characterized in that Before updating the user configuration information corresponding to the security policy of the firewall according to the configuration change information, the method includes: Acquire network IP information from a first service system, wherein the first service system is used to allocate IP addresses to network devices, and the network devices include at least user devices; Determining the corresponding relationship between the user and the IP information according to the network IP information; The corresponding relationship between the user and the IP information is sent to the firewall.

4. The method according to claim 3, characterized in that After sending the corresponding relationship between the user and the IP information to the firewall, the method further includes: Receiving IP update information of the user through a preset interface; updating the correspondence between the user and the IP information in the firewall according to the IP update information of the user to obtain an updated correspondence; Updating the user configuration information of the security policy of the firewall according to the updated corresponding relationship to obtain updated user configuration information; The user access request is processed through the firewall based on the updated user configuration information and the security policy of the firewall.

5. The method according to claim 1, characterized in that After updating the user configuration information corresponding to the security policy of the firewall according to the configuration change information, the method further includes: Obtaining first configuration information of the preset business system every preset time period; Comparing the first configuration information with the user configuration information of the current security policy of the firewall to obtain a comparison result; When the comparison result indicates that the first configuration information is inconsistent with the current user configuration information, the user configuration information of the security policy of the firewall is updated according to the first configuration information.

6. The method according to claim 1, characterized in that Processing the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall, including: Determine the user configuration information corresponding to the source IP information according to the source IP information of the user access request; Searching for a first security policy corresponding to the user access request according to the user configuration information corresponding to the source IP information; When the first security policy is found, the user access request is processed according to the first security policy; If the first security policy is not found, the user access request is processed according to a preset security policy.

7. The method according to any one of claims 1 to 6, characterized in that: The log data includes: permission change information. After receiving the log data of the preset business system through the message bus, the method further includes: Determine the changed user, permission operation and business system change information based on the permission change information; Update the user configuration information corresponding to the security policy of the firewall according to the changed user, permission operation and business system change information to obtain the updated user configuration information; The user access request is processed through the firewall based on the updated user configuration information and the security policy of the firewall.

8. The method according to any one of claims 1 to 6, characterized in that: The log data includes: new business information. After receiving the log data of the preset business system through the message bus, the method further includes: Determining a newly added target service based on the newly added service information, and determining user information involved in the target service; Constructing a first user group according to user information involved in the target service, and updating user configuration information corresponding to the security policy of the firewall according to the first user group to obtain the updated user configuration information; Constructing a second security policy according to the first user group and the newly added service information, and updating the security policy of the firewall according to the second security policy to obtain an updated security policy; The user access request is processed through the firewall based on the updated user configuration information and the updated security policy.

9. A device for processing user access requests, characterized in that: include: A first receiving unit is used to receive log data of a preset business system through a message bus, wherein the log data at least includes: IP change information; A parsing unit, used to parse the log data to obtain configuration change information; A first updating unit, configured to update user configuration information corresponding to the security policy of the firewall according to the configuration change information, and send the updated user configuration information to the firewall; The first processing unit is used to process the received user access request through the firewall based on the updated user configuration information and the security policy of the firewall.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for processing user access requests as described in any one of claims 1 to 8.

Images