On-off judgment method and device for access control strategy

Abstract

The invention discloses an access control strategy on-off judgment method and device. The method comprises the steps of obtaining quintuple information input by a user according to a target access control strategy and a pre-constructed strategy data model; preprocessing the quintuple information to obtain a path object; according to the path object and the strategy data model, judging whether the path of the target access control strategy meets a communication requirement or not; if the path of the target access control strategy meets the communication requirement, determining that the communication result of the path is through, and outputting the ID identifiers of the in-out direction rule and the out-out direction rule; and if the path of the target access control policy does not meet the communication requirement, determining that the communication result of the path is blocked, and feeding back information of communication failure. Therefore, the connectivity judgment of any communication path is supported through the constructed strategy data model, the problem that on-off verification is difficult to carry out on any quintuple is effectively solved, and the problem that manual on-off judgment is low in efficiency is avoided.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for determining on / off status of an access control policy. Background Art

[0002] With the prevalence of cloud computing, many enterprises are migrating their businesses to cloud platforms. In cloud environments, access control policies (ACLs) have become a crucial tool for network security. However, as business systems scale, the number and complexity of ACL policies continue to increase, making it difficult for administrators to intuitively determine whether a policy is configured correctly or to promptly identify security risks within a policy (such as unreasonable network-wide access). Therefore, a method for identifying access control policy paths in cloud platforms is urgently needed to help administrators identify configuration flaws and improve system security and operational efficiency.

[0003] In existing technologies, service communication paths often involve a combination of multiple policy groups and inbound and outbound policies. Existing cloud platforms cannot provide communication connectivity verification for any five-tuple (protocol, source address, source port, destination address, and destination port). Administrators often need to manually check multiple policies to determine whether the path allows communication. This results in inefficient and error-prone verification. Summary of the Invention

[0004] Based on the above-mentioned deficiencies of the prior art, the present application provides a method and device for determining the on / off status of an access control policy, so as to solve the problem of low efficiency in determining the on / off status of a path brought about by the prior art.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] The first aspect of the present application provides a method for determining whether an access control policy is on or off, including:

[0007] Obtain the five-tuple information input by the user according to the target access control policy and the pre-built policy data model;

[0008] Preprocessing the five-tuple information to obtain a path object;

[0009] Determining whether the path of the target access control policy meets communication requirements based on the path object and the policy data model;

[0010] If the path of the target access control policy meets the communication requirements, the communication result of the path is determined to be pass, and the ID identification of the input direction rule and the output direction rule is output;

[0011] If the path of the target access control policy does not meet the communication requirement, the communication result of the path is determined to be unavailable, and information about the communication failure is fed back.

[0012] Optionally, in the above-mentioned access control policy on-off determination method, the preprocessing of the quintuple information to obtain the path object includes:

[0013] Extracting the protocol, source address, source port, destination address, and destination port from the five-tuple information;

[0014] Performing a validity check on the protocol, the source address, and the destination address;

[0015] If the protocol, the source address, and the destination address pass the validity check, then normalizing the protocol, the source address, and the destination address;

[0016] Converting the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port;

[0017] A path object is generated based on the normalized protocol, source address, destination address, the standard source port, and the standard destination port.

[0018] Optionally, in the above-mentioned access control policy on-off determination method, the method for constructing the policy data model includes:

[0019] Obtaining all policy groups, policy information, and policy rules of the access control policy through the cloud platform interface; wherein the policy group includes at least the ID of the corresponding access control policy, the ID identifier of the inbound rule, and the ID identifier of the outbound rule; the policy information includes at least the ID of the corresponding access control policy; the policy rules include at least the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules;

[0020] For each of the access control policies, according to the ID of the access control policy, the policy group, policy information and policy rules of the access control policy are combined using a three-layer nested data structure to obtain a data model;

[0021] Build a strategic data model based on all data models.

[0022] Optionally, in the above-mentioned access control policy on-off determination method, judging whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model includes:

[0023] According to the target access control policy, obtaining the outbound policy rule set of the source zone and the inbound policy rule set of the target zone from the policy data model;

[0024] Determine whether the path object satisfies all rule conditions in the outbound policy rule set;

[0025] If the path object satisfies all the rule conditions in the outbound policy rule set, determining whether the path object satisfies all the rule conditions in the inbound policy rule set;

[0026] If the path object satisfies all rule conditions in the inbound policy rule set, determining that the path of the target access control policy meets the communication requirements;

[0027] If the path object does not satisfy any one rule condition in the outbound policy rule set, or if the path object does not satisfy any one rule condition in the inbound policy rule set, it is determined that the path of the target access control policy does not meet the communication requirement.

[0028] Optionally, in the above-mentioned access control policy on-off determination method, the determining whether the path object satisfies all rule conditions in the outbound policy rule set includes:

[0029] Extracting the protocol, source address, standard source port, and action from the path object;

[0030] Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty;

[0031] If the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, determining whether the source address is included in the source address in the outbound policy rule set;

[0032] If the source address is included in the source address in the outbound policy rule set, determining whether the value corresponding to the standard source port conforms to a preset port range;

[0033] If the value corresponding to the standard source port is within the preset port range, determining whether the value corresponding to the action is a preset value;

[0034] If the value corresponding to the action is the preset value, it is determined that the path object meets all rule conditions in the outbound policy rule set.

[0035] Optionally, in the above-mentioned access control policy on-off determination method, the determining whether the path object satisfies all rule conditions in the inbound policy rule set includes:

[0036] Extracting the protocol, destination address, standard destination source port, and action from the path object;

[0037] Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty;

[0038] If the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, determining whether the target address is included in the target address in the inbound policy rule set;

[0039] If the destination address is included in the destination address in the outbound policy rule set, determining whether the value corresponding to the standard destination source port conforms to a preset port range;

[0040] If the value corresponding to the standard target source port is within the preset port range, determining whether the value corresponding to the action is a preset value;

[0041] If the value corresponding to the action is the preset value, it is determined that the path object meets all rule conditions in the inbound policy rule set.

[0042] Optionally, the access control policy on / off determination method further includes:

[0043] Get all policy rules;

[0044] For each of the policy rules, determining whether a value corresponding to a network segment field in the policy rule is less than a preset threshold;

[0045] If the value corresponding to the network segment field in the policy rule is not less than the preset threshold, the network segment result is output, and it is determined whether there is an abnormal value in the port range in the policy rule;

[0046] If an abnormal value appears in the port range in the policy rule, output the port abnormality result and detect whether the protocol field in the policy rule is missing;

[0047] If the protocol field in the policy rule is missing, output the protocol field missing result and detect whether there is a high-risk combination in the policy rule;

[0048] If there is a high-risk combination in the policy rule, the high-risk combination result is output, and a compliance report is generated based on the network segment result, the port abnormality result, the protocol field missing result and the high-risk combination result.

[0049] A second aspect of the present application provides an access control policy on-off determination device, comprising:

[0050] An acquisition unit, used to acquire the five-tuple information input by the user according to the target access control policy and a pre-built policy data model;

[0051] A preprocessing unit, configured to preprocess the quintuple information to obtain a path object;

[0052] a communication determination unit, configured to determine whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model;

[0053] A first determining unit is configured to determine that a communication result of the path is pass if the path of the target access control policy meets the communication requirement, and output an ID identifier of an input direction rule and an output direction rule;

[0054] The second determining unit is configured to determine that the communication result of the path is unavailable if the path of the target access control policy does not meet the communication requirement, and to feed back information of communication failure.

[0055] Optionally, in the above-mentioned access control policy on-off determination device, the pre-processing unit includes:

[0056] A first extraction unit is used to extract the protocol, source address, source port, destination address and destination port from the quintuple information;

[0057] A legality checking unit, configured to perform a legality check on the protocol, the source address, and the destination address;

[0058] a standard processing unit, configured to perform standardization processing on the protocol, the source address, and the destination address if the protocol, the source address, and the destination address pass the legality check;

[0059] a conversion unit, configured to convert the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port;

[0060] The object generation unit is used to generate a path object based on the normalized protocol, source address, destination address, the standard source port and the standard destination port.

[0061] Optionally, the access control policy on-off determination device further includes:

[0062] An information acquisition unit is configured to acquire, through the interface of the cloud platform, the policy groups, policy information, and policy rules of all access control policies; wherein the policy group includes at least the ID of the corresponding access control policy, the ID identifier of the inbound rule, and the ID identifier of the outbound rule; the policy information includes at least the ID of the corresponding access control policy; and the policy rules include at least the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules;

[0063] a combining unit for combining the policy group, policy information, and policy rules of each access control policy according to the ID of the access control policy using a three-layer nested data structure to obtain a data model;

[0064] A construction unit is used to construct a policy data model based on all data models.

[0065] Optionally, in the above-mentioned access control policy on-off determination device, the communication determination unit includes:

[0066] A set acquisition unit, configured to acquire, from the policy data model, an outbound policy rule set of a source zone and an inbound policy rule set of a target zone according to a target access control policy;

[0067] A first judging unit, configured to judge whether the path object satisfies all rule conditions in the outbound policy rule set;

[0068] a second judging unit, configured to judge whether the path object satisfies all the rule conditions in the inbound policy rule set if the path object satisfies all the rule conditions in the outbound policy rule set;

[0069] a third determining unit, configured to determine that the path of the target access control policy meets the communication requirements if the path object meets all rule conditions in the inbound policy rule set;

[0070] The fourth determining unit is configured to determine that the path of the target access control policy does not meet the communication requirements if the path object does not meet any rule condition in the outbound policy rule set, or if the path object does not meet any rule condition in the inbound policy rule set.

[0071] Optionally, in the above-mentioned access control policy on / off determination device, the first determination unit includes:

[0072] a second extraction unit, configured to extract a protocol, a source address, a standard source port, and an action from the path object;

[0073] A third judgment unit is used to judge whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty;

[0074] a fourth determining unit, configured to determine whether the source address is included in the source address in the outbound policy rule set if the protocol matches a preset protocol or the value corresponding to the protocol is not empty;

[0075] a fifth determining unit, configured to determine whether a value corresponding to the standard source port conforms to a preset port range if the source address is included in the source address in the outbound policy rule set;

[0076] an action judging unit, configured to judge whether the value corresponding to the action is a preset value if the value corresponding to the standard source port is within a preset port range;

[0077] The fifth determining unit is configured to determine, if the value corresponding to the action is the preset value, whether the path object satisfies all rule conditions in the outbound policy rule set.

[0078] Optionally, in the above-mentioned access control policy on / off determination device, the second determination unit includes:

[0079] a third extraction unit, configured to extract a protocol, a destination address, a standard destination source port, and an action from the path object;

[0080] a sixth judgment unit, configured to judge whether the protocol matches a preset protocol, or whether a value corresponding to the protocol is empty;

[0081] a seventh determining unit, configured to determine whether the target address is included in the target address in the inbound policy rule set if the protocol matches a preset protocol or the value corresponding to the protocol is not empty;

[0082] a port determination unit, configured to determine whether a value corresponding to the standard target source port conforms to a preset port range if the target address is included in the target address in the outbound policy rule set;

[0083] an eighth judgment unit, configured to judge whether the value corresponding to the action is a preset value if the value corresponding to the standard target source port is within a preset port range;

[0084] The sixth determining unit is configured to determine, if the value corresponding to the action is the preset value, whether the path object satisfies all rule conditions in the inbound policy rule set.

[0085] Optionally, the access control policy on-off determination device further includes:

[0086] A rule acquisition unit, used to acquire all policy rules;

[0087] a network segment determination unit, configured to determine, for each of the policy rules, whether a value corresponding to a network segment field in the policy rule is less than a preset threshold;

[0088] an abnormality judgment unit, configured to output a network segment result if the value corresponding to the network segment field in the policy rule is not less than a preset threshold, and to judge whether an abnormal value appears in the port range in the policy rule;

[0089] a first detection unit, configured to output a port abnormality result if an abnormal value appears in the port range in the policy rule, and to detect whether a protocol field in the policy rule is missing;

[0090] a second detection unit, configured to output a protocol field missing result if the protocol field in the policy rule is missing, and detect whether there is a high-risk combination in the policy rule;

[0091] A report generating unit is used to output a high-risk combination result if there is a high-risk combination in the policy rule, and generate a compliance report based on the network segment result, the port abnormality result, the protocol field missing result and the high-risk combination result.

[0092] This application provides a method for determining the connectivity of an access control policy. This method obtains quintuple information input by the user based on the target access control policy and a pre-constructed policy data model. The quintuple information is then pre-processed to obtain a path object. Finally, based on the path object and the policy data model, the method determines whether the path of the target access control policy meets the communication requirements. If the path of the target access control policy meets the communication requirements, the communication result of the path is determined to be connectivity, and the IDs of the inbound and outbound rules are output. If the path of the target access control policy does not meet the communication requirements, the communication result of the path is determined to be connectivity, and a communication failure message is fed back. This constructed policy data model thus supports the connectivity determination of any communication path, effectively resolving the difficulty of verifying the connectivity of any quintuple and avoiding the inefficiency of manual connectivity determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0094] Figure 1A flowchart of a method for determining the on / off status of an access control policy provided in an embodiment of the present application;

[0095] Figure 2 A flowchart of a method for constructing a policy data model provided in another embodiment of the present application;

[0096] Figure 3 A schematic flow chart of a method for generating a path object provided in another embodiment of the present application;

[0097] Figure 4 A flowchart of a method for determining a communication requirement provided in another embodiment of the present application;

[0098] Figure 5 A flowchart of a method for identifying a path object provided in another embodiment of the present application;

[0099] Figure 6 A flowchart of another method for determining a path object provided in another embodiment of the present application;

[0100] Figure 7 A flowchart of a policy rule checking method provided in another embodiment of the present application;

[0101] Figure 8 A schematic structural diagram of an access control policy on-off determination device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0102] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0103] In this application, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0104] The embodiment of the present application provides a method for determining whether an access control policy is on or off. Figure 1 As shown, the specific steps include:

[0105] S101: Acquire quintuple information input by a user according to a target access control policy and a pre-built policy data model.

[0106] It is understandable that when a user wants to access device B from device A, the user can first obtain the target access control policy for device A to access device B from the cloud platform. This policy is used to limit the access rule set of network traffic, which usually includes elements such as "access direction, source address, destination address, protocol, port", etc., and is used to control the communication behavior between resources in the cloud platform. At this time, the user needs to enter the five-tuple information on the front end according to the target access control policy. The five-tuple information refers to the five core elements of the network communication flow: protocol, source IP, source port, destination IP, and destination port. It is the standard basis for judging whether the network access control matches. Therefore, the five-tuple information entered by the user may include protocol, source IP (source address), source port, destination IP (destination address), and destination port.

[0107] In addition, the system also obtains all relevant raw data of the Access Control Policy (ACL) from the cloud platform to establish a unified data model structure, namely the policy data model, which is used to structure the raw data scattered in the interface and lay the foundation for subsequent communication path on-off judgment.

[0108] Optionally, the present application embodiment provides a method for constructing a policy data model, such as Figure 2 As shown, the following steps are included:

[0109] S201. Obtain the policy groups, policy information, and policy rules of all access control policies through the interface of the cloud platform.

[0110] The policy group may include the ID of the corresponding access control policy, the ID of the inbound rule, and the ID of the outbound rule. The policy information may include the ID of the corresponding access control policy. The policy rules may include the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules.

[0111] Specifically, a policy group is a logical aggregation unit of access control policies, usually consisting of an egress policy and an ingress policy, and is bound to a specific network interface (such as a virtual network card).

[0112] The policy information indicates the outbound policy and the inbound policy.

[0113] An ACL rule (or Firewall rule) represents a specific access control rule that describes the five-tuple conditions for permitting or denying a certain type of traffic, including the protocol, source address, source port, destination address, destination port, and action (accept / reject).

[0114] It should be noted that the policy group, policy information, and policy rules in the same access control policy are bound according to the same ID name.

[0115] S202 : For each access control policy, according to the ID of the access control policy, the policy group, policy information, and policy rules of the access control policy are combined using a three-layer nested data structure to obtain a data model.

[0116] Specifically, the three-layer nested data structure is represented as: policy group → policy information (inbound / outbound) → multiple policy rules. Through the design of the three-layer nested data structure, the combination of policy group, policy information and policy rules for each access control policy can be realized, and a clear and easy-to-operate data model is obtained. Different access control policies, policy groups and rules can be updated, added or deleted separately without affecting the overall structure.

[0117] For example, create a data model with the following field structure:

[0118] FirewallGroup

[0119] id

[0120] name

[0121] ingress_policy_id

[0122] egress_policy_id

[0123] }

[0124] FirewallPolicy

[0125] id

[0126] name

[0127] rule_id_list[]

[0128] }

[0129] FirewallRule

[0130] id

[0131] action / / accept / reject

[0132] protocol / / TCP / UDP / null

[0133] source_ip(s) / / single IP or multiple network segments

[0134] destination_ip(s)

[0135] source_port(s) / / single port or port range, such as "80" or "100:200"

[0136] destination_port(s)

[0137] }.

[0138] S203: Build a policy data model based on all data models.

[0139] Specifically, all data models are integrated into a unified policy data model so that the policy data model can be flexibly called to collaboratively complete the communication path connection and disconnection judgment.

[0140] S102: Preprocess the quintuple information to obtain a path object.

[0141] It can be understood that formatting the five-tuple (protocol, source address, source port, destination address, destination port) input by the user into a structured object can improve the efficiency, accuracy and flexibility of data processing.

[0142] Optionally, in another embodiment of the present application, a specific implementation of step S102 is as follows: Figure 3 As shown, the specific steps include:

[0143] S301. Extract the protocol, source address, source port, destination address, and destination port from the five-tuple information.

[0144] S302: Check the validity of the protocol, source address, and destination address.

[0145] It is understandable that in order to ensure that the protocol and address entered by the user are correct and to facilitate subsequent path determination, it is necessary to check the legitimacy of the protocol, source address and destination address, that is, check whether the input format of the source address and destination address is correct and whether the address meets the requirements of the IP address, and whether the input protocol complies with the protocol legitimacy.

[0146] S303: Determine whether the protocol, source address, and destination address pass the validity check.

[0147] Specifically, if the protocol, source address, and destination address pass the validity check, step S304 is executed.

[0148] Optionally, if the protocol, source address, and destination address do not pass the validity check, an error message is fed back to the front end so that the user can re-enter the quintuple information.

[0149] S304: Standardize the protocol, source address, and destination address.

[0150] It can be understood that normalization processing includes: ensuring that there is a valid mask length after the address (0 to 32 for IPv4 and 0 to 128 for IPv6), and ensuring that the mask length meets the actual network requirements, so that the protocol, source address, and destination address can be normalized into CIDR form, which is helpful for network management, monitoring, and analysis.

[0151] S305: Convert the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port.

[0152] It is understandable that the port format is required to support formats such as "88", "100-200", and "100:200". Therefore, the formats of the source port and the destination port need to be uniformly converted into the formats of the start port and the end port.

[0153] S306: Generate a path object based on the normalized protocol, source address, destination address, standard source port, and standard destination port.

[0154] Specifically, the structured expression of the path object is:

[0155] UserRequest{

[0156] protocol: TCP

[0157] source_ip: CIDR object

[0158] source_port: (start, end)

[0159] destination_ip: CIDR object

[0160] destination_port: (start, end)

[0161] }.

[0162] S103: Determine whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model.

[0163] It should be noted that in order to determine whether the path object input by the user satisfies the target access control policy and whether the path of the target access control policy allows communication, it is necessary to determine whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model. If the path of the target access control policy meets the communication requirements, it means that the path of the target access control policy allows communication, and thus step S104 is executed. If the path of the target access control policy does not meet the communication requirements, it means that the path of the target access control policy does not allow communication, and thus step S105 is executed.

[0164] Optionally, in another embodiment of the present application, a specific implementation of step S103 is as follows: Figure 4 As shown, the specific steps include:

[0165] S401 : According to a target access control policy, obtain an outbound policy rule set of a source zone and an inbound policy rule set of a target zone from a policy data model.

[0166] Specifically, the policy rules corresponding to the ID of the target access control policy are obtained from the policy data model, and then the outbound policy rule set of the source area and the inbound policy rule set of the target area are obtained from the policy rules, so as to automatically retrieve and judge the policy matching situation based on the source address, target address, protocol and port information entered by the user.

[0167] S402: Determine whether the path object meets all rule conditions in the outbound policy rule set.

[0168] It is understood that all rule conditions in the outbound policy rule set are first traversed, and then the source address, destination address, protocol, and port information in the path object are determined one by one using the rule conditions. If they match, indicating that the path object meets all rule conditions in the outbound policy rule set, step S403 is executed. If not, step S405 is executed.

[0169] Optionally, in another embodiment of the present application, a specific implementation of step S402 is as follows: Figure 5 As shown, the specific steps include:

[0170] S501: Extract the protocol, source address, standard source port, and action from the path object.

[0171] S502: Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty.

[0172] Specifically, when traversing all rule conditions in the outgoing policy rule set, the protocol can be matched first, that is, whether the protocol is any one of TCP / UDP, or whether the protocol is empty. If the protocol is any one of TCP / UDP, or the protocol is not empty, execute step S503.

[0173] S503: Determine whether the source address is included in the source address in the outbound policy rule set.

[0174] It can be understood that when the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, the source address can be checked, that is, whether the source address is included in the source address (or CIDR) in the outbound policy rule set. If the source address is included in the source address (or CIDR) in the outbound policy rule set, it means that the source address can match the rule, so continue to execute step S504.

[0175] Optionally, if the source address is not included in the source address (or CIDR) in the outbound policy rule set, step S405 is executed.

[0176] S504: Determine whether the value corresponding to the standard source port conforms to the preset port range.

[0177] Specifically, when the source address is included in the source address of the outbound policy rule set, the source port is then determined to determine whether the standard source port falls within the port range specified in the outbound policy rule set. If the standard source port falls within the port range specified in the outbound policy rule set, it indicates that the value corresponding to the standard source port is within the preset port range, and step S505 is executed.

[0178] Optionally, if the standard source port does not fall within the port range specified in the outbound policy rule set, it means that the value corresponding to the standard source port does not conform to the preset port range, and therefore step S405 is executed.

[0179] S505: Determine whether the value corresponding to the action is a preset value.

[0180] It should be noted that only when the value corresponding to the action is accept can it be determined that the action matches the rule in the outbound policy rule set. Therefore, it is necessary to judge whether the value corresponding to the action is a preset value, which is accep. If the value corresponding to the action is the preset value, execute step S506.

[0181] Optionally, if the value corresponding to the action is not a preset value, step S405 is executed.

[0182] S506: Determine whether the path object meets all rule conditions in the outbound policy rule set.

[0183] Specifically, when the value corresponding to the action is a preset value, it indicates that the path object has satisfied all rule conditions in the outbound policy rule set, and therefore step S104 may be executed next.

[0184] In addition, steps S502 to S506 may refer to the following pseudo code:

[0185] Initialize outbound matching status = False;

[0186] Traverse the outbound rule list of the source group:

[0187] If the current rule:

[0188] -Protocol matches or the current rule protocol is empty,

[0189] - the source IP is included by the source address (or CIDR) in the rule,

[0190] -The source port falls within the rule port range,

[0191] -The action is accept.

[0192] S403: Determine whether the path object meets all rule conditions in the inbound policy rule set.

[0193] Specifically, when the path object satisfies all the rule conditions in the outbound policy rule set, all the rule conditions in the inbound policy rule set need to be traversed. Only when the path object satisfies both the outbound policy rule set and the inbound policy rule set can the path of the target access control policy be determined to allow communication. Therefore, all the rule conditions in the inbound policy rule set are traversed, and then the rule conditions are used one by one to determine whether the source address, destination address, protocol, and port information in the path object match. If they match, it means that the path object meets all the rule conditions in the inbound policy rule set, and step S404 is executed. If not, step S405 is executed.

[0194] Optionally, in another embodiment of the present application, a specific implementation of step S403 is as follows: Figure 6 As shown, the specific steps include:

[0195] S601: Extract the protocol, target address, standard target source port, and action from the path object.

[0196] S602: Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty.

[0197] It should be noted that the specific implementation of step S602 may refer to step S502 in the above method embodiment, and will not be repeated here.

[0198] It should also be noted that if the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, step S603 is executed.

[0199] Optionally, if the protocol does not match the preset protocol, or the value corresponding to the protocol is empty, step S405 is executed.

[0200] S603: Determine whether the target address is included in the target address in the inbound policy rule set.

[0201] It should be noted that the specific implementation of step S603 may refer to step S503 in the above method embodiment, and will not be repeated here.

[0202] It should also be noted that, when the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, and if the target address is included in the target address in the inbound policy rule set, step S604 is executed.

[0203] Optionally, if the target address is not included in the target address in the inbound policy rule set, step S405 is executed.

[0204] S604: Determine whether the value corresponding to the standard target source port conforms to a preset port range.

[0205] It should be noted that the specific implementation of step S604 may refer to step S504 in the above method embodiment, and will not be repeated here.

[0206] It should also be noted that when the destination address is included in the destination address in the outbound policy rule set, and if the value corresponding to the standard destination source port conforms to the preset port range, step S605 is executed.

[0207] Optionally, if the value corresponding to the standard target source port does not conform to the preset port range, step S405 is executed.

[0208] S605: Determine whether the value corresponding to the action is a preset value.

[0209] It should be noted that the specific implementation of step S605 may refer to step S505 in the above method embodiment, and will not be repeated here.

[0210] It should also be noted that when the value corresponding to the standard target source port meets the preset port range, and if the value corresponding to the action is the preset value, step S606 is executed.

[0211] Optionally, if the value corresponding to the action is not a preset value, step S405 is executed.

[0212] S606: Determine whether the path object meets all the rule conditions in the inbound policy rule set.

[0213] It should be noted that the specific implementation of step S606 may refer to step S506 in the above method embodiment, and will not be repeated here.

[0214] S404: Determine whether the path of the target access control policy meets the communication requirements.

[0215] Specifically, when the path object satisfies all the rule conditions in the inbound policy rule set, it indicates that the path of the target access control policy allows communication, and therefore step S104 is executed at this time.

[0216] S405: Determine that the path of the target access control policy does not meet the communication requirements.

[0217] It should be noted that when the path object does not meet any rule condition in the outbound policy rule set, or the path object does not meet any rule condition in the inbound policy rule set, or the path object does not meet all rule conditions in the outbound policy rule set, or the path object does not meet all rule conditions in the inbound policy rule set, it can be determined that the path of the target access control policy does not allow communication, that is, the source area does not allow access to the target area, so step S105 is executed at this time.

[0218] S104: Determine that the communication result of the path is connected, and output the IDs of the input direction rule and the output direction rule.

[0219] It should be noted that when the path of the target access control policy meets the communication requirements, it means that the path of the target access control policy allows communication. At this time, the outbound matching state can be set to True and the inbound matching state can be set to True, and then the ID identifier of the inbound rule and the ID identifier of the outbound rule can be output so that subsequent communication can be carried out based on the ID identifier.

[0220] S105: Determine that the communication result of the path is unavailable, and feedback information of communication failure.

[0221] Specifically, when the path of the target access control policy does not meet the communication requirements, the communication result of the path is determined to be unavailable, which means that the path of the target access control policy does not allow communication. At this time, it is necessary to feedback communication failure information to the user, wherein the communication failure information is used to indicate the specific situation and reason why the path object does not match the rule.

[0222] It should be noted that whether the path of the target access control policy meets the communication requirements can be determined by the following pseudo code, namely: Determine whether the path is passable (input: UserRequest, policy data model):

[0223] enter:

[0224] - UserRequest: {

[0225] Protocol protocol,

[0226] Source address source_ip,

[0227] Source port source_port,

[0228] Destination address destination_ip,

[0229] Destination port destination_port,

[0230] };

[0231] -Strategy structure: {

[0232] List of outbound rules for the source group.

[0233] List of inbound rules for the target group.

[0234] };

[0235] step:

[0236] 1. Initialize the outbound matching state = False,

[0237] Initialize the inbound direction matching state = False,

[0238] 2. Traverse the outbound rule list of the source group:

[0239] If the current rule:

[0240] -Protocol matches or the current rule protocol is empty,

[0241] - the source IP is included by the source address (or CIDR) in the rule,

[0242] -The source port falls within the rule port range,

[0243] -The action is accept,

[0244] but:

[0245] Outbound matching status = True,

[0246] Record the rule ID.

[0247] 3. Traverse the target group's inbound rule list:

[0248] If the current rule:

[0249] -Protocol matches or the current rule protocol is empty,

[0250] -The target IP is included in the target address of the rule,

[0251] -The destination port falls within the rule port range,

[0252] -The action is accept,

[0253] but:

[0254] Incoming direction matching status = True,

[0255] Record the rule ID.

[0256] 4. If the outbound direction matches the status and the inbound direction matches the status:

[0257] Return "Pass" and output the matched outbound and inbound rule IDs.

[0258] otherwise:

[0259] Returns "Not Connected" and indicates the direction and reason for the mismatch.

[0260] Optionally, in order to prevent errors in policy rules, which may lead to inaccurate path object matching, a policy rule checking method is provided in another embodiment of the present application, such as Figure 7 As shown, the specific steps include:

[0261] S701. Obtain all policy rules.

[0262] Specifically, all policy rules can be obtained from the cloud platform.

[0263] S702: For each policy rule, determine whether the value corresponding to the network segment field in the policy rule is less than a preset threshold.

[0264] It should be noted that in order to identify potentially high-risk configurations in policy rules that may affect the accuracy of path communication judgments in access control policies, it is first possible to determine whether the network segment field in the policy rule is too large. Specifically, it is determined whether the judgment mask in the policy rule is less than the minimum setting (e.g., / 26) or whether the mask is 0.0.0.0 / 0. If the judgment mask in the policy rule is not less than the minimum setting (e.g., / 26) or the mask is not 0.0.0.0 / 0, it indicates that the value corresponding to the network segment field in the policy rule is not less than a preset threshold, and therefore step S703 is executed.

[0265] Optionally, if the judgment mask in the policy rule is smaller than the minimum setting (such as / 26) or the mask is 0.0.0.0 / 0, it indicates that the value corresponding to the network segment field in the policy rule is smaller than the preset threshold, and the network segment field in the policy rule meets the network segment check item.

[0266] S703: Output the network segment result and determine whether there is an abnormal value in the port range in the policy rule.

[0267] Specifically, when the value corresponding to the network segment field in the policy rule is not less than the preset threshold, the network segment result of the policy rule will be output, and then the port range in the rule will be judged as an abnormal value, that is, whether the port in the policy rule is a full port (such as 1:65535) or whether the port range in the policy rule hits the range of the sensitive port area. If the port in the policy rule is a full port (such as 1:65535) or the port range in the policy rule hits the range of the sensitive port area, it means that an abnormal value appears in the port range in the policy rule, and step S704 is executed.

[0268] Optionally, if the port in the policy rule is not a full port (such as 1:65535) or the port range in the policy rule does not hit the range of the sensitive port area, it means that the port range in the policy rule does not have an abnormal value and the port range in the policy rule meets the port inspection items.

[0269] S704: Output the port abnormality result and detect whether the protocol field in the policy rule is missing.

[0270] It is understood that when an abnormal value appears in the port range of a policy rule, a port abnormality result needs to be generated and output based on the port range, and then the protocol field in the policy rule needs to be checked for absence, that is, whether the protocol field in the policy rule is empty. Therefore, if the protocol field in the policy rule is empty, it means that the protocol field in the policy rule is missing, and the protocol field is regarded as any protocol. Based on the policy situation, it can be determined whether to mark the policy rule, and then step S705 can be executed.

[0271] Optionally, if the protocol field in the detection policy rule is not empty, it indicates that the protocol field in the policy rule is not missing, and the protocol in the policy rule meets the protocol check item.

[0272] S705: Output the protocol field missing result and detect whether there is a high-risk combination in the policy rules.

[0273] Specifically, when the protocol field in the policy rule is missing, the protocol field can be marked, and then the missing protocol field result can be output. Finally, it is detected whether there is a high-risk combination in the policy rule, that is, whether there is a combination consisting of mask 0.0.0.0 / 0, port 1:65535 and action accept in the policy rule. If there is a combination consisting of mask 0.0.0.0 / 0, port 1:65535 and action accept in the policy rule, it means that there is a high-risk combination in the policy rule, so step S706 needs to be executed at this time.

[0274] Alternatively, if the policy rule does not contain the combination of mask 0.0.0.0 / 0, port 1:65535, and action "accept," the policy rule does not contain a high-risk combination, and the combination in the policy rule meets the high-risk combination check items. The resulting compliance report indicates that the policy rule meets the compliance check and does not contain any potentially high-risk configurations.

[0275] S706: Output high-risk combination results, and generate a compliance report based on the network segment results, port abnormality results, protocol field missing results, and high-risk combination results.

[0276] It is understood that when a high-risk combination exists in a policy rule, a high-risk combination result is generated based on the high-risk combination. Based on the network segment result, port anomaly result, protocol field missing result, and high-risk combination result, a compliance report is generated that includes the violation item, rule ID, policy ID, and policy group name. For details about the compliance report, see Table 1.

[0277] Table 1

[0278] Serial number Rule ID Strategy ID Policy group name Compliance item name Reasons for non-compliance action 1 rule-0001 policy-abc group-A The IP segment is too large Use 0.0.0.0 / 0 to allow access to the entire network segment accept 2 rule-0002 policy-def group-B Port range is too large Using port range 1:65535 is too broad accept 3 rule-0003 policy-def group-B High-risk port hit Hitting sensitive port 22 accept 4 rule-0004 policy-xyz group-C Protocol field missing If the protocol is not specified, the default is any protocol. accept 5 rule-0005 policy-xyz group-C High-risk combination rules The rule uses 0.0.0.0 / 0+1:65535+accept accept

[0279] The contents shown in Table 1 are only for illustration.

[0280] This application provides a method for determining the connectivity of an access control policy. This method obtains quintuple information input by the user based on the target access control policy and a pre-constructed policy data model. The quintuple information is then pre-processed to obtain a path object. Finally, based on the path object and the policy data model, the method determines whether the path of the target access control policy meets the communication requirements. If the path of the target access control policy meets the communication requirements, the communication result of the path is determined to be connectivity, and the IDs of the inbound and outbound rules are output. If the path of the target access control policy does not meet the communication requirements, the communication result of the path is determined to be connectivity, and a communication failure message is fed back. This constructed policy data model thus supports the connectivity determination of any communication path, effectively resolving the difficulty of verifying the connectivity of any quintuple and avoiding the inefficiency of manual connectivity determination.

[0281] Another embodiment of the present application provides an access control policy on-off determination device, such as Figure 8 As shown, it includes the following units:

[0282] The acquisition unit 801 is configured to acquire the five-tuple information input by the user according to the target access control policy and the pre-built policy data model.

[0283] The pre-processing unit 802 is used to pre-process the quintuple information to obtain a path object.

[0284] The communication determination unit 803 is configured to determine whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model.

[0285] The first determining unit 804 is configured to determine that the communication result of the path is pass if the path of the target access control policy meets the communication requirement, and output the IDs of the inbound direction rule and the outbound direction rule.

[0286] The second determining unit 805 is configured to determine that the communication result of the path is unavailable if the path of the target access control policy does not meet the communication requirement, and to feed back information of communication failure.

[0287] It should be noted that the specific working process of the above modules in the embodiment of the present application can refer to steps S101 to S105 in the above method embodiment, and will not be repeated here.

[0288] Optionally, in another embodiment of the present application, in a device for determining access control policy on / off, the pre-processing unit 802 includes:

[0289] The first extraction unit is used to extract the protocol, source address, source port, destination address and destination port from the five-tuple information.

[0290] The legality checking unit is used to check the legality of the protocol, source address and destination address.

[0291] The standard processing unit is used to standardize the protocol, source address and destination address if they pass the legality check.

[0292] The conversion unit is used to convert the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port.

[0293] The object generation unit is used to generate a path object based on the normalized protocol, source address, destination address, standard source port and standard destination port.

[0294] Optionally, another embodiment of the present application provides an access control policy on-off determination device, further comprising:

[0295] An information acquisition unit is configured to acquire policy groups, policy information, and policy rules for all access control policies through the cloud platform interface. A policy group includes at least the ID of the corresponding access control policy, the ID of the inbound rule, and the ID of the outbound rule. Policy information includes at least the ID of the corresponding access control policy. Policy rules include at least the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules.

[0296] The combining unit is used to combine the policy group, policy information and policy rules of each access control policy according to the ID of the access control policy using a three-layer nested data structure to obtain a data model.

[0297] A construction unit is used to construct a policy data model based on all data models.

[0298] Optionally, in another embodiment of the present application, in a device for determining on / off access control policy, the communication determination unit 803 includes:

[0299] The set acquisition unit is used to acquire the outbound policy rule set of the source zone and the inbound policy rule set of the target zone from the policy data model according to the target access control policy.

[0300] The first judgment unit is configured to judge whether the path object satisfies all rule conditions in the outbound policy rule set.

[0301] The second judgment unit is configured to judge whether the path object satisfies all the rule conditions in the inbound policy rule set if the path object satisfies all the rule conditions in the outbound policy rule set.

[0302] The third determining unit is configured to determine that the path of the target access control policy meets the communication requirement if the path object meets all rule conditions in the inbound policy rule set.

[0303] The fourth determining unit is configured to determine that the path of the target access control policy does not meet the communication requirement if the path object does not meet any rule condition in the outbound policy rule set, or if the path object does not meet any rule condition in the inbound policy rule set.

[0304] Optionally, in another embodiment of the present application, in a device for determining whether an access control policy is on or off, the first determination unit includes:

[0305] The second extraction unit is used to extract the protocol, source address, standard source port and action from the path object.

[0306] The third judgment unit is used to judge whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty.

[0307] The fourth judgment unit is configured to judge whether the source address is included in the source address in the outbound policy rule set if the protocol matches the preset protocol or the value corresponding to the protocol is not empty.

[0308] The fifth judgment unit is configured to judge whether a value corresponding to the standard source port complies with a preset port range if the source address is included in the source address in the outbound policy rule set.

[0309] The action judgment unit is used to judge whether the value corresponding to the action is a preset value if the value corresponding to the standard source port meets the preset port range.

[0310] The fifth determining unit is configured to determine, if the value corresponding to the action is a preset value, whether the path object satisfies all rule conditions in the outbound policy rule set.

[0311] Optionally, in another embodiment of the present application, in a device for determining the on / off status of an access control policy, the second determination unit includes:

[0312] The third extraction unit is configured to extract the protocol, the destination address, the standard destination source port, and the action from the path object.

[0313] The sixth judgment unit is used to judge whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty.

[0314] The seventh judgment unit is configured to judge whether the target address is included in the target address in the inbound policy rule set if the protocol matches the preset protocol or the value corresponding to the protocol is not empty.

[0315] The port judgment unit is configured to judge whether the value corresponding to the standard target source port conforms to a preset port range if the target address is included in the target address in the outbound policy rule set.

[0316] The eighth judgment unit is configured to judge whether the value corresponding to the action is a preset value if the value corresponding to the standard target source port meets the preset port range.

[0317] The sixth determining unit is configured to determine, if the value corresponding to the action is a preset value, whether the path object satisfies all rule conditions in the inbound policy rule set.

[0318] Optionally, another embodiment of the present application provides an access control policy on-off determination device, further comprising:

[0319] The rule acquisition unit is used to obtain all policy rules.

[0320] The network segment determination unit is used to determine, for each policy rule, whether a value corresponding to a network segment field in the policy rule is less than a preset threshold.

[0321] The abnormality judgment unit is used to output the network segment result if the value corresponding to the network segment field in the policy rule is not less than the preset threshold, and to judge whether there is an abnormal value in the port range in the policy rule.

[0322] The first detection unit is configured to output a port abnormality result if an abnormal value appears in the port range in the policy rule, and to detect whether a protocol field in the policy rule is missing.

[0323] The second detection unit is configured to output a protocol field missing result if the protocol field in the policy rule is missing, and detect whether there is a high-risk combination in the policy rule.

[0324] The report generation unit is used to output the high-risk combination results if there are high-risk combinations in the policy rules, and generate a compliance report based on the network segment results, port abnormality results, protocol field missing results and high-risk combination results.

[0325] It should be noted that the specific working processes of the various modules provided in the above embodiments of the present application can refer to the corresponding steps in the above method embodiments, and will not be repeated here.

[0326] It should also be noted that the access control policy on-off determination device provided in the embodiment of the present application has the technical effects of any of the above embodiments, and the embodiment of the present application will not be described in detail here.

[0327] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0328] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for determining the on / off status of an access control policy, characterized in that: include: Obtain the five-tuple information input by the user according to the target access control policy and the pre-built policy data model; Preprocessing the five-tuple information to obtain a path object; Determining whether the path of the target access control policy meets communication requirements based on the path object and the policy data model; If the path of the target access control policy meets the communication requirements, the communication result of the path is determined to be pass, and the ID identification of the input direction rule and the output direction rule is output; If the path of the target access control policy does not meet the communication requirement, the communication result of the path is determined to be unavailable, and information about the communication failure is fed back.

2. The method according to claim 1, characterized in that The preprocessing of the quintuple information to obtain a path object includes: Extracting the protocol, source address, source port, destination address, and destination port from the five-tuple information; Performing a validity check on the protocol, the source address, and the destination address; If the protocol, the source address, and the destination address pass the validity check, then normalizing the protocol, the source address, and the destination address; Converting the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port; A path object is generated based on the normalized protocol, source address, destination address, the standard source port, and the standard destination port.

3. The method according to claim 1, characterized in that The method for constructing the policy data model includes: Obtaining all policy groups, policy information, and policy rules of the access control policy through the cloud platform interface; wherein the policy group includes at least the ID of the corresponding access control policy, the ID identifier of the inbound rule, and the ID identifier of the outbound rule; the policy information includes at least the ID of the corresponding access control policy; the policy rules include at least the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules; For each of the access control policies, according to the ID of the access control policy, the policy group, policy information and policy rules of the access control policy are combined using a three-layer nested data structure to obtain a data model; Build a strategic data model based on all data models.

4. The method according to claim 1, wherein The determining, based on the path object and the policy data model, whether the path of the target access control policy meets the communication requirements includes: According to the target access control policy, obtaining the outbound policy rule set of the source zone and the inbound policy rule set of the target zone from the policy data model; Determine whether the path object satisfies all rule conditions in the outbound policy rule set; If the path object satisfies all the rule conditions in the outbound policy rule set, determining whether the path object satisfies all the rule conditions in the inbound policy rule set; If the path object satisfies all rule conditions in the inbound policy rule set, determining that the path of the target access control policy meets the communication requirements; If the path object does not satisfy any rule condition in the outbound policy rule set, or if the path object does not satisfy any rule condition in the inbound policy rule set, it is determined that the path of the target access control policy does not meet the communication requirement.

5. The method according to claim 4, characterized in that The determining whether the path object satisfies all rule conditions in the outbound policy rule set includes: Extracting the protocol, source address, standard source port, and action from the path object; Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty; If the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, determining whether the source address is included in the source address in the outbound policy rule set; If the source address is included in the source address in the outbound policy rule set, determining whether the value corresponding to the standard source port conforms to a preset port range; If the value corresponding to the standard source port is within the preset port range, determining whether the value corresponding to the action is a preset value; If the value corresponding to the action is the preset value, it is determined that the path object meets all rule conditions in the outbound policy rule set.

6. The method according to claim 4, characterized in that The determining whether the path object satisfies all rule conditions in the inbound policy rule set includes: Extracting the protocol, destination address, standard destination source port, and action from the path object; Determine whether the protocol matches the preset protocol, or whether the value corresponding to the protocol is empty; If the protocol matches the preset protocol, or the value corresponding to the protocol is not empty, determining whether the target address is included in the target address in the inbound policy rule set; If the destination address is included in the destination address in the outbound policy rule set, determining whether the value corresponding to the standard destination source port conforms to a preset port range; If the value corresponding to the standard target source port is within the preset port range, determining whether the value corresponding to the action is a preset value; If the value corresponding to the action is the preset value, it is determined that the path object meets all rule conditions in the inbound policy rule set.

7. The method according to claim 1, characterized in that Also includes: Get all policy rules; For each of the policy rules, determining whether a value corresponding to a network segment field in the policy rule is less than a preset threshold; If the value corresponding to the network segment field in the policy rule is not less than the preset threshold, the network segment result is output, and it is determined whether there is an abnormal value in the port range in the policy rule; If an abnormal value appears in the port range in the policy rule, output the port abnormality result and detect whether the protocol field in the policy rule is missing; If the protocol field in the policy rule is missing, output the protocol field missing result and detect whether there is a high-risk combination in the policy rule; If there is a high-risk combination in the policy rule, the high-risk combination result is output, and a compliance report is generated based on the network segment result, the port abnormality result, the protocol field missing result and the high-risk combination result.

8. A device for determining the on / off status of an access control policy, characterized in that: include: An acquisition unit, used to acquire the five-tuple information input by the user according to the target access control policy and a pre-built policy data model; A preprocessing unit, configured to preprocess the quintuple information to obtain a path object; a communication determination unit, configured to determine whether the path of the target access control policy meets the communication requirements based on the path object and the policy data model; A first determining unit is configured to determine that a communication result of the path is pass if the path of the target access control policy meets the communication requirement, and output an ID identifier of an input direction rule and an output direction rule; The second determining unit is configured to determine that the communication result of the path is unavailable if the path of the target access control policy does not meet the communication requirement, and to feed back information of communication failure.

9. The device according to claim 8, characterized in that The pre-processing unit comprises: A first extraction unit is used to extract the protocol, source address, source port, destination address and destination port from the quintuple information; A legality checking unit, configured to perform a legality check on the protocol, the source address, and the destination address; a standard processing unit, configured to perform standardization processing on the protocol, the source address, and the destination address if the protocol, the source address, and the destination address pass the legality check; a conversion unit, configured to convert the formats of the source port and the target port into a preset format to obtain a standard source port and a standard target port; The object generation unit is used to generate a path object based on the normalized protocol, source address, destination address, the standard source port and the standard destination port.

10. The device according to claim 8, characterized in that Also includes: An information acquisition unit is configured to acquire, through the interface of the cloud platform, the policy groups, policy information, and policy rules of all access control policies; wherein the policy group includes at least the ID of the corresponding access control policy, the ID identifier of the inbound rule, and the ID identifier of the outbound rule; the policy information includes at least the ID of the corresponding access control policy; and the policy rules include at least the ID of the corresponding access control policy, multiple outbound policy rules, and multiple inbound policy rules; a combining unit for combining the policy group, policy information, and policy rules of each access control policy according to the ID of the access control policy using a three-layer nested data structure to obtain a data model; A construction unit is used to construct a policy data model based on all data models.

Images