ACL automatic creation methods, devices, electronic equipment and storage media

Abstract

This application provides an automatic ACL creation method, apparatus, electronic device, and storage medium. The method includes: responding to an ACL creation request and receiving five-tuple information and switch attribute information; obtaining the switch's configuration file and routing table based on the attribute information; parsing the configuration file and routing table, and establishing a routing table model and ACL model based on the parsing results; determining the switch's ingress interface in a first network interface based on the source IP address and subnet; determining a first target ACL with an ingress binding direction from multiple ACLs based on the ingress interface; detecting whether a first target rule that intersects with the five-tuple information exists in the first target rule list that matches the first target ACL; and, if the existence of a first target rule is detected and the processing action of the first target rule is rejection, adding the first target ACL and its ID to a preset positive pending ACL list. This application enables automatic ACL creation, improving the operational efficiency of network maintenance personnel.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an automatic ACL creation method, apparatus, electronic device and storage medium. Background Technology

[0002] ACLs (Access Control Lists) in network switches are rule-based traffic filtering mechanisms used to control the forwarding or dropping of data packets. Their core principle is to match each packet passing through the switch against predefined matching conditions (such as source / destination IP, MAC address, port number, protocol type, etc.) and execute a permit or deny action. In switches, ACLs can be divided into standard ACLs (matching only the source IP) and extended ACLs (supporting multi-field matching), typically deployed on the inbound or outbound directions of interfaces. Typical applications include isolating inter-departmental communication, blocking malicious traffic, and ensuring bandwidth for critical services. ACL rules are executed in priority order; incorrect configuration can lead to policy conflicts or service interruptions.

[0003] In related technologies, ACL rules often have too many entries, requiring network operations personnel to check each rule individually when creating ACLs, resulting in low creation efficiency and consequently low operational efficiency for network operations personnel. Summary of the Invention

[0004] In view of this, this application provides an automatic ACL creation method, apparatus, electronic device and storage medium, which can realize the automatic creation of ACLs and improve the operation and maintenance efficiency of network operation and maintenance personnel.

[0005] A first aspect of this application provides an automatic ACL creation method, comprising: responding to an ACL creation request, receiving five-tuple information and switch attribute information, wherein the five-tuple information includes a source IP address; obtaining the switch's configuration file and routing table according to the attribute information; parsing the configuration file and the routing table, and establishing a routing table model and an ACL model based on the parsing result, wherein the routing table model includes multiple routing tables of different types, and a first network interface and subnet matching each routing table, and the ACL model includes multiple ACLs, and a second network interface, rule list, rule ID, and binding direction of the ACL to the second network interface matching each ACL; determining the ingress interface of the switch in the first network interface according to the source IP address and the subnet; determining a first target ACL with the binding direction as ingress in the multiple ACLs according to the ingress interface; detecting whether there is a first target rule in the first target rule list that matches the first target ACL and intersects with the five-tuple information; and, if the existence of the first target rule is detected and the processing action of the first target rule is rejection, placing the first target ACL and the first target rule ID corresponding to the first target rule into a preset positive pending ACL list.

[0006] In one possible implementation, the first target rule list includes multiple first rules, each of which includes a corresponding first rule ID; detecting whether there is a first target rule in the first target rule list that intersects with the 5-tuple information includes: matching the 5-tuple information sequentially with multiple first rules in the first target rule list according to the priority of the preset first rule ID; if the matching result shows that the 5-tuple information intersects with the first target rule among the multiple first rules, splitting the 5-tuple information into an intersecting part and a non-intersecting part, wherein the rule ID of the first target rule is the first target rule ID; matching the non-intersecting part with the rules in the first target rule list that have a priority greater than the first target rule ID, until all the first rules in the first target rule list have been matched.

[0007] In one possible implementation, matching the quintuple information with multiple first rules in the first target rule list according to the preset priority of the first rule ID includes: arranging the first rule IDs in ascending order of priority, and matching the quintuple information with multiple first rules in the order of priority; the method further includes: responding to a rule ID generation request, determining a comparison rule ID preceding the first target rule ID according to the priority order; calculating the difference between the first target rule ID and the comparison rule ID; if the difference is greater than 1, setting the newly generated rule ID as the average of the first target rule ID and the comparison rule ID; if the difference is equal to 1, setting the newly generated rule ID as the opposite of the first target rule ID.

[0008] In one possible implementation, the five-tuple information further includes a destination IP address; the method further includes: determining the outgoing interface of the switch in the first network interface based on the destination IP address and the subnet; determining a second target ACL with the binding direction being outgoing from among multiple ACLs based on the outgoing interface; detecting whether there is a second target rule in the second target rule list that matches the second target ACL and intersects with the five-tuple information; if the existence of the second target rule is detected and the processing action of the second target rule is rejection, adding the second target ACL and the second target rule ID corresponding to the second target rule to the positive pending ACL list.

[0009] In one possible implementation, the five-tuple information further includes protocol information and a destination port; if the protocol information is TCP, the method further includes: exchanging the source IP address and the destination IP address to obtain a new source IP address and a new destination IP address, and setting the destination port to a preset number of ports; determining a third target ACL with an inbound binding direction from among multiple ACLs based on the outbound interface; detecting whether there is a third target rule in the list of third target rules matching the third target ACL that intersects with the five-tuple information, wherein the port of the third target rule is the preset number of ports; if the existence of the third target rule is detected and the processing action of the third target rule is rejection, adding the third target ACL and the third target rule ID corresponding to the third target rule to a preset reverse pending ACL list.

[0010] In one possible implementation, the method further includes: determining a fourth target ACL with the binding direction being outbound from among a plurality of ACLs based on the inbound interface; detecting whether there exists a fourth target rule in the list of fourth target rules matching the fourth target ACL that intersects with the five-tuple information, wherein the port of the fourth target rule is the preset port number; and if the existence of the fourth target rule is detected and the processing action of the fourth target rule is rejection, adding the fourth target ACL and the fourth target rule ID corresponding to the fourth target rule to the reverse pending ACL list.

[0011] In one possible implementation, the attribute information includes the switch manufacturer and model; obtaining the switch's configuration file and routing table based on the attribute information includes: determining the switch's configuration command based on the switch manufacturer and model; connecting to the switch via a Secure Enclosure protocol, controlling the switch to execute the configuration command, and obtaining the configuration file and the routing table.

[0012] Secondly, embodiments of this application also provide an automatic ACL creation device, comprising: a receiving module, an acquisition module, a parsing module, a first determining module, a second determining module, a detection module, and a creation module; the receiving module is used to respond to an ACL creation request, receiving five-tuple information and switch attribute information, wherein the five-tuple information includes a source IP address; the acquisition module is used to acquire the switch's configuration file and routing table according to the attribute information; the parsing module is used to parse the configuration file and the routing table, and establish a routing table model and an ACL model based on the parsing results, wherein the routing table model includes multiple routing tables of different types, and a first network interface and subnet matching each routing table, and the ACL model includes multiple ACLs, and a matching interface and subnet matching each ACL. The second network interface, rule list, rule ID, and binding direction of the ACL to the second network interface; the first determining module is used to determine the ingress interface of the switch in the first network interface according to the source IP address and the subnet; the second determining module is used to determine the first target ACL with the binding direction as ingress among multiple ACLs according to the ingress interface; the detection module is used to detect whether there is a first target rule in the first target rule list that matches the first target ACL and has an intersection with the five-tuple information; the creation module is used to put the first target ACL and the first target rule ID corresponding to the first target rule into a preset positive pending ACL list when the existence of the first target rule is detected and the processing action of the first target rule is rejection.

[0013] Thirdly, embodiments of this application also provide an electronic device, the electronic device including a processor and a memory, the memory being used to store instructions, and the processor being used to call the instructions in the memory, causing the electronic device to execute the ACL automatic creation method as described in the first aspect.

[0014] Fourthly, embodiments of this application also provide a storage medium that stores computer instructions that, when executed on an electronic device, cause the electronic device to perform the ACL automatic creation method as described in the first aspect.

[0015] Compared with related technologies, the embodiments of this application have at least the following advantages: By responding to the ACL creation request and receiving the five-tuple information and the attribute information of the switch, the configuration file and routing table of the switch can be obtained according to the attribute information, thereby parsing the configuration file and routing table to obtain the routing table model and ACL model. Since the routing table model includes multiple routing tables of different types, as well as the first network interface and subnet matching each routing table, the ingress interface of the switch can be determined in the first network interface by the source IP address and subnet, thereby determining the first target ACL with the binding direction as ingress in multiple ACLs according to the ingress interface. By detecting the first target rule that has an intersection with the five-tuple information and the first target rule list, since the intersection of the five-tuple information and the first target rule list indicates that the user wants the five-tuple information of the intersection part to pass, when the existence of the first target rule is detected and the processing action of the first target rule is denial, the first target ACL and the first target rule ID corresponding to the first target rule are put into the positive pending ACL list, realizing the automatic creation of ACLs that meet the user's needs, thereby improving the operation and maintenance efficiency of network operation and maintenance personnel.

[0016] The technical effects achieved by the second, third, and fourth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect, and will not be repeated here. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating one step of an automatic ACL creation method provided in an embodiment of this application.

[0018] Figure 2 This is a schematic diagram illustrating an application scenario for creating an ACL form according to an embodiment of this application.

[0019] Figure 3 This is a schematic diagram illustrating an application scenario of the routing table model provided in one embodiment of this application.

[0020] Figure 4 This is a schematic diagram illustrating an application scenario of the ACL model provided in an embodiment of this application.

[0021] Figure 5 This is a flowchart illustrating another step of the automatic ACL creation method provided in an embodiment of this application.

[0022] Figure 6 This is a flowchart illustrating another step of the automatic ACL creation method provided in an embodiment of this application.

[0023] Figure 7 This is a functional block diagram of an ACL automatic creation device provided in an embodiment of this application.

[0024] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] To better understand the above-mentioned objectives, features, and advantages of this application, the application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0026] The following description sets forth many specific details to provide a full understanding of this application. The described embodiments are only some, not all, of the embodiments of this application.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein in the specification of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application.

[0028] It should be further noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0029] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and drawings of this application are used to distinguish similar objects, not to describe a specific order or sequence.

[0030] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0031] For ease of understanding, some concepts related to the embodiments of this application are illustrated and explained by way of example for reference.

[0032] ACL: Access Control List, is used by network devices to perform fine-grained filtering and management of data packets. Its core functions include allowing or denying data packets based on conditions such as source / destination IP, port number, and protocol type.

[0033] The quintuple is a core concept in network communication used to uniquely identify inter-process communication connections. It consists of the following five elements: transport layer protocol, source IP address and source port, destination IP address and destination port.

[0034] Configuration file: Includes basic network parameters, protocol and state control, and advanced configuration. Basic network parameters include interface IP address, subnet mask substitution parameters, and default gateway address; protocol and state control includes protocol type and interface startup status; advanced configuration includes explicitly specifying the target network, next hop, and outgoing interface in the router configuration.

[0035] Routing table: The core basis for routers to make packet forwarding decisions, and its parameter configuration directly affects network communication efficiency. Routing table parameters include network interface, VPN instance, subnet, and next-hop address.

[0036] Secure Shell (SSH) is a protocol used for secure remote login and other secure network services over insecure networks. SSH was developed by the IETF's Network Working Group; it is a security protocol built on the application layer.

[0037] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating the steps of an embodiment of the ACL automatic creation method of this application. Depending on different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0038] It should be noted that the ACL automatic creation method in this application embodiment can be applied to user access scenarios, and its execution entity can be an ACL automatic creation device. For example, in user access scenarios, the automatic creation of ACLs can be achieved through an ACL automatic creation device. Of course, the ACL automatic creation method can also be applied to other scenarios that require automatic ACL creation, such as scenarios where operations and maintenance personnel maintain a website; this application does not specifically limit this application.

[0039] The specific process of this embodiment is as follows: Figure 1 As shown, it includes the following steps:

[0040] S101 responds to the ACL creation request by receiving the 5-tuple information and the switch's attribute information, including the source IP address.

[0041] In some embodiments, the 5-tuple information includes the source IP address, destination IP address, transport layer protocol, destination port, and destination IP address.

[0042] In some embodiments, the attribute information includes the switch manufacturer and model, switch IP address, switch username, and switch password.

[0043] To facilitate understanding, the following will be combined with... Figure 2 This application provides a detailed explanation of how it receives 5-tuple information and switch attribute information:

[0044] Please refer to Figure 2 This is a schematic diagram illustrating an application scenario for creating an ACL form according to an embodiment of this application.

[0045] The electronic device responds to the user's ACL creation request and displays... Figure 2 The ACL work order shown is where the user enters relevant information. That is, the electronic device receives the five-tuple information and attribute information entered by the user. After the user clicks submit, the electronic device automatically generates a list of ACLs to be activated.

[0046] In some embodiments, electronic devices include, but are not limited to, terminal devices such as laptops, tablets, and mobile phones. This embodiment does not specifically limit the type of electronic device.

[0047] S102 retrieves the switch's configuration file and routing table based on the attribute information.

[0048] In some embodiments, since the attribute information includes the switch manufacturer model, the configuration command of the switch can be determined based on the switch manufacturer model; the switch is connected via a Secure Enclosure protocol, and the switch is controlled to execute the configuration command to obtain the configuration file and routing table.

[0049] S103 parses the configuration file and routing table, and builds the routing table model and ACL model based on the parsing results.

[0050] Specifically, the routing table model includes multiple routing tables of different types, as well as a first network interface and subnet that matches each routing table. The ACL model includes multiple ACLs, as well as a second network interface that matches each ACL, a list of rules, a rule ID, and the binding direction of the ACL to the second network interface.

[0051] To facilitate understanding, the following will be combined with... Figure 3 and Figure 4 This embodiment provides a detailed explanation of how to generate and establish the routing table model and ACL model:

[0052] Please refer to Figure 3 This diagram illustrates an application scenario of the routing table model provided in this embodiment. By parsing the configuration file and routing table, the binding relationship between the first network interface and the routing table, as well as which routing table forwarding entries are included in each routing table, are identified. The routing tables of different device models are converted into a unified routing table model according to the routing table, subnet, next hop, and first network interface. Figure 3 In the routing table model shown, the subnet is Figure 3 The IP address and subnet mask shown indicate that the first network interface is... Figure 3 The output interface is shown.

[0053] Please refer to Figure 4 This is a schematic diagram illustrating an application scenario of the ACL model provided in this application embodiment. By parsing the configuration file and routing table, the binding relationship between the ACL and the second network interface, the binding direction between the ACL and the second network interface, and the rule list contained in each ACL are identified. The routing tables of different device models are converted into a unified ACL model according to the ACL, the rule ID in the rule list, the source IP address, the destination IP address, the transport protocol, the source port, the destination port, and the action. Figure 4 In the ACL model shown, the source IP address is Figure 4 The source and destination IP addresses shown are Figure 4 The destination shown is the port. Figure 4 The services shown.

[0054] It's worth noting that by transforming the code into a unified routing table and ACL model, the code can be layered. The data parsing layer is responsible for processing configuration texts from different vendors into the same data model, allowing the business processing layer to use a single set of code. Otherwise, every time a new brand of switch is purchased, all the code would have to be rewritten, thus improving the efficiency and reliability of the automatic ACL creation method.

[0055] S104. Based on the source IP address and subnet, determine the ingress interface of the switch in the first network interface.

[0056] Understandable, Figure 3 The subnet shown includes the IP address corresponding to each router. By taking the intersection of the input source IP address and the IP addresses corresponding to all routers, if an intersection exists, the first network interface in the routing table model is obtained, which is the ingress interface of the switch.

[0057] In some embodiments, if there are multiple ingress interfaces, they are stored in a list, i.e., an ingress interface list.

[0058] In some embodiments, when saving the ingress interface, it is also necessary to include the binding relationship between each ingress interface and the router for use when finding the egress interface later.

[0059] S105, determine the first target ACL with the inbound direction among multiple ACLs based on the inbound interface.

[0060] In some embodiments, the inbound interface list is traversed to obtain the first target ACL with the binding direction being inbound.

[0061] S106, detect whether there is a first target rule in the first target rule list that matches the first target ACL and has an intersection with the five-tuple information; if a first target rule is detected and the processing action of the first target rule is rejection, put the first target ACL and the first target rule ID corresponding to the first target rule into the preset positive ACL list to be opened.

[0062] In some embodiments, the first target rule list includes multiple first rules, each of which includes a corresponding first rule ID; detecting whether there is a first target rule in the first target rule list that intersects with the 5-tuple information includes: matching the 5-tuple information with multiple first rules in the first target rule list sequentially according to the priority of the preset first rule ID; if the matching result shows that the 5-tuple information intersects with the first target rule among the multiple first rules, splitting the 5-tuple information into an intersecting part and a non-intersecting part, wherein the rule ID of the first target rule is the first target rule ID; matching the non-intersecting part with rules in the first target rule list that have a priority greater than the first target rule ID, until all first rules in the first target rule list have been matched.

[0063] In some embodiments, the quintuple information is matched sequentially with multiple first rules in the first target rule list according to the priority of the preset first rule ID, including: arranging the first rule IDs in ascending order of priority, and matching the quintuple information sequentially with multiple first rules according to the priority order.

[0064] In some embodiments, the method further includes: responding to a rule ID generation request, determining a comparison rule ID that precedes the first target rule ID according to priority order; calculating the difference between the first target rule ID and the comparison rule ID; if the difference is greater than 1, setting the newly generated rule ID as the average of the first target rule ID and the comparison rule ID; if the difference is equal to 1, setting the newly generated rule ID as the opposite of the first target rule ID. This method achieves automatic creation of ACL rule IDs, avoiding the situation in existing technologies where "manual allocation of rule IDs is prone to sorting errors, leading to a policy execution order that does not match expectations," and further improving the reliability of the automatic ACL creation method.

[0065] To facilitate understanding, the following is a detailed explanation of how this embodiment implements the creation of a forward ACL for the ingress interface:

[0066] 1. Define variables: the list of ACLs to be enabled in the positive direction.

[0067] 2. Traverse the list of inbound interfaces to obtain the first target ACL. The binding direction of the first target ACL is inbound.

[0068] 3. Following the order of priority from smallest to largest, use the 5-tuple information to find the intersection with the first rule in the first target rule list. It's understandable that the first rule configures a range of IP addresses and ports, so the 5-tuple information and the first rule do not have a complete containment or inclusion relationship.

[0069] 4. When the quintuple information intersects with the first target rule, the intersecting and disjoint parts are separated from the current quintuple information. Based on the processing action of the first target rule (allow or deny), the intersecting part is stored in the data stream or the rejection data stream. It can be understood that if the processing action of the first target rule is allow, the intersecting part is stored in the data stream; if the processing action of the first target rule is deny, the intersecting part is stored in the rejection data stream. Simultaneously, the ID of the first rule with which there is intersection and the processing action is deny is recorded and defined as the conflict rule ID, which is also the first target rule ID in this embodiment.

[0070] 5. Using the non-overlapping parts, continue matching the first rules according to the priority order of the first rule IDs until all the first rules in the first target rule list have been matched.

[0071] 6. Check the rejected data stream. If it is not empty, add the first target ACL and the first target rule ID to the positive list of ACLs to be enabled. It's worth noting that if a rejected data stream exists, it means a first rule already exists that rejects user input data. The purpose of user input data is to allow it; therefore, if someone previously set a first rule to reject it, a new rule that allows it (with higher priority) needs to be set above this first rule to meet the user's needs. The method for generating the rule ID of the new rule has been described in detail in the preceding steps and will not be repeated here.

[0072] Compared with related technologies, the embodiments of this application have at least the following advantages: By responding to the ACL creation request and receiving the five-tuple information and the attribute information of the switch, the configuration file and routing table of the switch can be obtained according to the attribute information, thereby parsing the configuration file and routing table to obtain the routing table model and ACL model. Since the routing table model includes multiple routing tables of different types, as well as the first network interface and subnet matching each routing table, the ingress interface of the switch can be determined in the first network interface by the source IP address and subnet, thereby determining the first target ACL with the binding direction as ingress in multiple ACLs according to the ingress interface. By detecting the first target rule that has an intersection with the five-tuple information and the first target rule list, since the intersection of the five-tuple information and the first target rule list indicates that the user wants the five-tuple information of the intersection part to pass, when the existence of the first target rule is detected and the processing action of the first target rule is denial, the first target ACL and the first target rule ID corresponding to the first target rule are put into the positive pending ACL list, realizing the automatic creation of ACLs that meet the user's needs, thereby improving the operation and maintenance efficiency of network operation and maintenance personnel.

[0073] Please refer to Figure 5 , Figure 5 This is a flowchart illustrating the steps of an embodiment of the ACL automatic creation method of this application. Depending on different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. This ACL automatic creation method can be applied to the aforementioned ACL automatic creation device, but is not limited thereto, and the embodiments of this application do not limit it in this regard.

[0074] This embodiment is a further improvement on the aforementioned embodiment. The main improvement is that, in this embodiment, a second target ACL with the outgoing direction is determined from multiple ACLs based on the outgoing interface, and the second target ACL and the second target rule ID corresponding to the second target rule are added to the forward ACL list to be enabled. This method enables the automatic creation of forward ACLs for outgoing interfaces, thereby further improving the operational efficiency of network maintenance personnel.

[0075] The specific process of this embodiment is as follows: Figure 5 As shown, it includes the following steps:

[0076] S501 responds to ACL creation requests by receiving 5-tuple information and switch attribute information, including the source IP address.

[0077] S502 retrieves the switch's configuration file and routing table based on attribute information.

[0078] S503 parses the configuration file and routing table, and builds the routing table model and ACL model based on the parsing results.

[0079] S504 determines the ingress interface of the switch in the first network interface based on the source IP address and subnet.

[0080] S505 determines the first target ACL with the inbound direction among multiple ACLs based on the inbound interface.

[0081] S506, detect whether there is a first target rule in the first target rule list that matches the first target ACL and has an intersection with the five-tuple information; if a first target rule is detected and the processing action of the first target rule is rejection, put the first target ACL and the first target rule ID corresponding to the first target rule into the preset positive ACL list to be opened.

[0082] S501 to S506 in this embodiment are similar to S101 to S106 in the previous embodiment. To avoid repetition, they will not be described again here.

[0083] S507 determines the switch's outgoing interface in the first network interface based on the destination IP address and subnet.

[0084] S508 determines the second target ACL with the outgoing direction as the binding direction among multiple ACLs based on the outgoing interface.

[0085] S509, detect whether there is a second target rule in the list of second target rules that matches the second target ACL and has an intersection with the five-tuple information; if a second target rule is detected and the processing action of the second target rule is rejection, add the second target ACL and the second target rule ID corresponding to the second target rule to the positive pending ACL list.

[0086] To facilitate understanding, the following is a detailed explanation of how this embodiment implements the creation of a forward ACL for the outgoing interface:

[0087] 1. Traverse the list of outgoing interfaces to obtain the second target ACL. The binding direction of the second target ACL is outgoing.

[0088] 2. Following the order of priority of the second rule ID from smallest to largest, use the 5-tuple information to find the intersection of each rule with the second rule in the second target rule list. It can be understood that the second rule ID is the same as the ID of the second rule.

[0089] 3. When the quintuple information intersects with the second target rule, the intersecting and disjoint parts are separated from the current quintuple information. Based on the processing action of the second target rule (allow or deny), the intersecting part is stored in the data stream or the data stream is rejected. Simultaneously, the ID of the first second rule with which there is intersection and the processing action is deny is recorded and defined as the conflict rule ID, which is also the second target rule ID in this embodiment.

[0090] 4. Using the non-overlapping parts, continue matching the second rules according to the priority order of the second rule IDs until all the second rules in the second target rule list have been matched.

[0091] 5. Check the rejected data stream. If it is not empty, add the second target ACL and the second target rule ID to the positive pending ACL list.

[0092] Compared with related technologies, the embodiments of this application have at least the following advantages: By responding to the ACL creation request and receiving the five-tuple information and the attribute information of the switch, the configuration file and routing table of the switch can be obtained according to the attribute information, thereby parsing the configuration file and routing table to obtain the routing table model and ACL model. Since the routing table model includes multiple routing tables of different types, as well as the first network interface and subnet matching each routing table, the ingress interface of the switch can be determined in the first network interface by the source IP address and subnet, thereby determining the first target ACL with the binding direction as ingress in multiple ACLs according to the ingress interface. By detecting the first target rule that has an intersection with the five-tuple information and the first target rule list, since the intersection of the five-tuple information and the first target rule list indicates that the user wants the five-tuple information of the intersection part to pass, when the existence of the first target rule is detected and the processing action of the first target rule is denial, the first target ACL and the first target rule ID corresponding to the first target rule are put into the positive pending ACL list, realizing the automatic creation of ACLs that meet the user's needs, thereby improving the operation and maintenance efficiency of network operation and maintenance personnel.

[0093] Please refer to Figure 6 , Figure 6 This is a flowchart illustrating the steps of an embodiment of the ACL automatic creation method of this application. Depending on different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. This ACL automatic creation method can be applied to the aforementioned ACL automatic creation device, but is not limited thereto, and the embodiments of this application do not limit it in this regard.

[0094] This embodiment is a further improvement upon the aforementioned embodiment. The main improvement lies in the following: In this embodiment, when the protocol for the five-tuple information is TCP, reverse data stream matching is performed to achieve reverse ACL creation for both the ingress and egress interfaces. This method enables automatic creation of reverse ACLs for both ingress and egress interfaces, making the automatic ACL creation method applicable to more scenarios and further improving its reliability.

[0095] The specific process of this embodiment is as follows: Figure 6 As shown, it includes the following steps:

[0096] S601 responds to the ACL creation request by receiving the 5-tuple information and the switch's attribute information. The 5-tuple information includes the source IP address, destination IP address, protocol information, and destination port.

[0097] S602 retrieves the switch's configuration file and routing table based on attribute information.

[0098] S603 parses the configuration file and routing table, and builds the routing table model and ACL model based on the parsing results.

[0099] S604 determines the ingress interface of the switch in the first network interface based on the source IP address and subnet.

[0100] S605 determines the switch's outgoing interface in the first network interface based on the destination IP address and subnet.

[0101] S606 swaps the source IP address with the destination IP address to obtain a new source IP address and a new destination IP address, and sets the destination port to the preset port number.

[0102] In some embodiments, the preset number of ports is any (0-65536). Since the source port is randomly generated when a TCP session is established and cannot be controlled by the user, the source port becomes the destination port after reversal. The algorithm cannot know which specific port it is and can only assume that all ports are possible.

[0103] S607 determines the third target ACL with the inbound direction among multiple ACLs based on the outbound interface.

[0104] S608, detect whether there is a third target rule in the list of third target rules that matches the third target ACL that intersects with the five-tuple information; if a third target rule is detected and the processing action of the third target rule is rejection, add the third target ACL and the third target rule ID corresponding to the third target rule to the preset reverse ACL list to be opened.

[0105] Specifically, the port number for the third target rule is the preset number of ports.

[0106] S609 determines the fourth target ACL with the outgoing direction among multiple ACLs based on the ingress interface.

[0107] S610, detect whether there is a fourth target rule in the list of fourth target rules that matches the fourth target ACL that intersects with the five-tuple information; if a fourth target rule is detected and the processing action of the fourth target rule is rejection, add the fourth target ACL and the fourth target rule ID corresponding to the fourth target rule to the reverse pending ACL list.

[0108] Specifically, the port number for the fourth target rule is the preset number of ports.

[0109] To facilitate understanding, the following provides a detailed explanation of how this embodiment implements the creation of reverse ACLs for the ingress and egress interfaces:

[0110] 1. Define variables: the reverse ACL list to be enabled.

[0111] 2. Traverse the list of outgoing interfaces to obtain the third target ACL. The binding direction of the third target ACL is inbound.

[0112] 3. Read the model data corresponding to the third target ACL and obtain the third target rule list corresponding to the third target ACL.

[0113] 4. Following the order of priority of the third rule ID from smallest to largest, use the 5-tuple information to find the intersection with the third rules in the third target rule list, but skip the third rules whose port is not any (0-65536). It can be understood that the third rule ID is the same as the ID of the third rule.

[0114] 5. When the quintuple information intersects with the third target rule, the intersecting and disjoint parts are separated from the current quintuple information. Based on the third target rule's processing action (allow or deny), the intersecting part is stored in the data stream or the data stream is rejected. Simultaneously, the ID of the first third rule with an intersecting element and a processing action of deny is recorded and defined as the conflict rule ID, which is also the third target rule ID in this embodiment.

[0115] 6. Using the non-overlapping parts, continue matching the third rules according to the priority order of the third rule IDs until all third rules in the third target rule list have been matched.

[0116] 7. Check the rejected data stream. If it is not empty, add the third target ACL and the third target rule ID to the reverse pending ACL list.

[0117] 8. Traverse the list of inbound interfaces to obtain the fourth target ACL. The binding direction of the fourth target ACL is inbound.

[0118] 9. Following the order of priority of the fourth rule ID from smallest to largest, use the quintuple information to find the intersection with the fourth rules in the fourth target rule list, but skip the fourth rules whose ports are not any (0-65536). It can be understood that the fourth rule ID is the same as the ID of the fourth rule.

[0119] 10. When the quintuple information intersects with the fourth objective rule, the intersecting and disjoint parts are separated from the current quintuple information. Based on the processing action of the fourth objective rule (allow or deny), the intersecting part is stored in the data stream or the data stream is rejected. At the same time, the ID of the first fourth rule that intersects with the fourth rule and whose processing action is deny is recorded and defined as the conflict rule ID, which is also the fourth objective rule ID in this embodiment.

[0120] 11. Using the non-overlapping parts, continue matching the fourth rules according to the priority order of the fourth rule IDs until all fourth rules in the fourth target rule list have been matched.

[0121] 12. Check the rejected data stream. If it is not empty, add the fourth target ACL and the fourth target rule ID to the reverse pending ACL list.

[0122] Compared with related technologies, the embodiments of this application have at least the following advantages: By responding to the ACL creation request and receiving the five-tuple information and the attribute information of the switch, the configuration file and routing table of the switch can be obtained according to the attribute information, thereby parsing the configuration file and routing table to obtain the routing table model and ACL model. Since the routing table model includes multiple routing tables of different types, as well as the first network interface and subnet matching each routing table, the ingress interface of the switch can be determined in the first network interface by the source IP address and subnet, thereby determining the first target ACL with the binding direction as ingress in multiple ACLs according to the ingress interface. By detecting the first target rule that has an intersection with the five-tuple information and the first target rule list, since the intersection of the five-tuple information and the first target rule list indicates that the user wants the five-tuple information of the intersection part to pass, when the existence of the first target rule is detected and the processing action of the first target rule is denial, the first target ACL and the first target rule ID corresponding to the first target rule are put into the positive pending ACL list, realizing the automatic creation of ACLs that meet the user's needs, thereby improving the operation and maintenance efficiency of network operation and maintenance personnel.

[0123] Based on the same idea as the ACL automatic creation method in the above embodiments, this application also provides an ACL automatic creation device, which can be used to execute the above ACL automatic creation method. For ease of explanation, the structural diagram of the ACL automatic creation device embodiment only shows the parts related to the embodiments of this application. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0124] like Figure 7As shown, the ACL automatic creation device 70 includes a receiving module 701, an acquisition module 702, a parsing module 703, a first determining module 704, a second determining module 705, a detection module 706, and a creation module 707. In some embodiments, the above modules can be programmable software instructions stored in memory and executable by a processor. It is understood that in other embodiments, the above modules can also be program instructions or firmware embedded in the processor.

[0125] The receiving module 701 is used to respond to the ACL creation request and receive the five-tuple information and the attribute information of the switch, wherein the five-tuple information includes the source IP address;

[0126] The acquisition module 702 is used to acquire the configuration file and routing table of the switch based on the attribute information;

[0127] The parsing module 703 is used to parse the configuration file and the routing table, and establish a routing table model and an ACL model based on the parsing results. The routing table model includes multiple routing tables of different types, as well as a first network interface and subnet matching each routing table. The ACL model includes multiple ACLs, as well as a second network interface matching each ACL, a rule list, a rule ID, and the binding direction of the ACL to the second network interface.

[0128] The first determining module 704 is used to determine the ingress interface of the switch in the first network interface based on the source IP address and the subnet;

[0129] The second determining module 705 is used to determine, based on the ingress interface, a first target ACL whose binding direction is ingress from among a plurality of ACLs;

[0130] Detection module 706 is used to detect whether there is a first target rule in the first target rule list that matches the first target ACL that intersects with the five-tuple information;

[0131] The creation module 707 is used to add the first target ACL and the first target rule ID corresponding to the first target rule to a preset positive ACL list when the existence of the first target rule is detected and the processing action of the first target rule is rejection.

[0132] The ACL automatic creation device 70 provided in the above embodiments can implement the technical solutions described in the above ACL automatic creation method embodiments. The specific implementation principles of each module or unit can be found in the corresponding content in the above ACL automatic creation method embodiments, and will not be repeated here.

[0133] Please refer to point 8. Figure 8 This is a schematic diagram of an embodiment of the electronic device of this application.

[0134] In some embodiments, processor 801 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 802 or process data, such as the ACL automatic creation method of the present invention.

[0135] In some embodiments, processor 801 may be a single server or a group of servers. The server group may be centralized or distributed. In some embodiments, processor 801 may be local or remote. In some embodiments, processor 801 may be implemented on a cloud platform. In one embodiment, the cloud platform may include a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, intranet, multi-cloud, etc., or any combination thereof.

[0136] In some embodiments, memory 802 may be an internal storage unit of electronic device 800, such as a hard disk or memory of electronic device 800. In other embodiments, memory 802 may also be an external storage device of electronic device 800, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 800.

[0137] Furthermore, the memory 802 may include both internal storage units of the electronic device 800 and external storage devices. The memory 802 is used to store application software and various types of data installed on the electronic device 800.

[0138] In some embodiments, display 803 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. Display 803 is used to display information from electronic device 800 and to display a visual user interface. Components 801-803 of electronic device 800 communicate with each other via a system bus.

[0139] In one embodiment, when processor 801 executes the ACL automatic creation program in memory 802, the following steps can be implemented:

[0140] In response to the ACL creation request, the switch receives 5-tuple information and switch attribute information, wherein the 5-tuple information includes the source IP address;

[0141] The configuration file and routing table of the switch are obtained based on the attribute information;

[0142] The configuration file and the routing table are parsed, and a routing table model and an ACL model are established based on the parsing results. The routing table model includes multiple routing tables of different types, as well as a first network interface and subnet matching each routing table. The ACL model includes multiple ACLs, as well as a second network interface matching each ACL, a rule list, a rule ID, and the binding direction of the ACL to the second network interface.

[0143] Based on the source IP address and the subnet, determine the ingress interface of the switch in the first network interface;

[0144] Based on the ingress interface, determine the first target ACL with the binding direction as ingress from among the multiple ACLs;

[0145] Detect whether there exists a first target rule in the first target rule list that matches the first target ACL and intersects with the five-tuple information;

[0146] If the existence of the first target rule is detected and the processing action of the first target rule is rejection, the first target ACL and the first target rule ID corresponding to the first target rule are added to a preset positive ACL list to be enabled.

[0147] It should be understood that when the processor 801 executes the ACL automatic creation program in the memory 802, in addition to the functions mentioned above, it can also perform other functions, as detailed in the description of the corresponding method embodiments above.

[0148] Furthermore, this embodiment of the invention does not specifically limit the type of electronic device 800 mentioned. Electronic device 800 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the invention, electronic device 800 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0149] Accordingly, this application also provides a storage medium for storing computer-readable programs or instructions. When the programs or instructions are executed by a processor, they can implement the steps or functions of the ACL automatic creation method provided in the above-described method embodiments.

[0150] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.), and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0151] The above provides a detailed description of the ACL automatic creation method, apparatus, electronic device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for automatically creating ACLs, characterized in that, include: In response to the ACL creation request, the switch receives 5-tuple information and switch attribute information, wherein the 5-tuple information includes the source IP address; The configuration file and routing table of the switch are obtained based on the attribute information; The configuration file and the routing table are parsed, and a routing table model and an ACL model are established based on the parsing results. The routing table model includes multiple routing tables of different types, as well as a first network interface and subnet matching each routing table. The ACL model includes multiple ACLs, as well as a second network interface matching each ACL, a rule list, a rule ID, and the binding direction of the ACL to the second network interface. Based on the source IP address and the subnet, determine the ingress interface of the switch in the first network interface; Based on the ingress interface, determine the first target ACL with the binding direction as ingress from among the multiple ACLs; Detect whether there exists a first target rule in the first target rule list that matches the first target ACL and intersects with the five-tuple information; If the existence of the first target rule is detected and the processing action of the first target rule is rejection, the first target ACL and the first target rule ID corresponding to the first target rule are added to a preset positive ACL list to be enabled.

2. The ACL automatic creation method according to claim 1, characterized in that, The first target rule list includes multiple first rules, and each first rule includes a corresponding first rule ID; The step of detecting whether there exists a first target rule in the first target rule list that matches the first target ACL and intersects with the five-tuple information includes: Based on the priority of the preset first rule ID, the five-tuple information is matched sequentially with multiple first rules in the first target rule list; If the matching result shows that the quintuple information intersects with the first target rule among multiple first rules, the quintuple information is split into an intersecting part and a non-intersecting part, wherein the rule ID of the first target rule is the first target rule ID; The non-overlapping parts are matched with the rules in the first target rule list that have a higher priority than the first target rule ID, until all the first rules in the first target rule list have been matched.

3. The ACL automatic creation method according to claim 2, characterized in that, The step of matching the five-tuple information with multiple first rules in the first target rule list sequentially according to the priority of the preset first rule ID includes: The first rule IDs are arranged in ascending order of priority, and the quintuple information is matched with multiple first rules in sequence according to the priority order. The method further includes: In response to the rule ID generation request, the comparison rule ID preceding the first target rule ID is determined according to the priority order. Calculate the difference between the first target rule ID and the comparison rule ID; If the difference is greater than 1, the newly generated rule ID is set to the average of the first target rule ID and the comparison rule ID; If the difference is equal to 1, the newly generated rule ID is set to the opposite of the first target rule ID.

4. The ACL automatic creation method according to claim 1, characterized in that, The 5-tuple information also includes the destination IP address; the method further includes: Based on the destination IP address and the subnet, determine the outgoing interface of the switch in the first network interface; Based on the outgoing interface, determine the second target ACL whose binding direction is outgoing from among the multiple ACLs; Detect whether there is a second target rule in the list of second target rules that matches the second target ACL that intersects with the five-tuple information; If the existence of the second target rule is detected and the processing action of the second target rule is rejection, the second target ACL and the second target rule ID corresponding to the second target rule are added to the positive ACL list to be enabled.

5. The ACL automatic creation method according to claim 4, characterized in that, The quintuple information also includes protocol information and the destination port; When the protocol information is TCP, the method further includes: The source IP address and the destination IP address are swapped to obtain a new source IP address and a new destination IP address, and the destination port is set to a preset number of ports; Based on the outgoing interface, determine the third target ACL whose binding direction is inbound from among the multiple ACLs; Detect whether there is a third target rule in the list of third target rules that matches the third target ACL that intersects with the five-tuple information, wherein the port of the third target rule is the preset number of ports; If the existence of the third target rule is detected and the processing action of the third target rule is rejection, the third target ACL and the third target rule ID corresponding to the third target rule are added to a preset reverse ACL list to be enabled.

6. The ACL automatic creation method according to claim 5, characterized in that, The method further includes: Based on the ingress interface, determine the fourth target ACL whose binding direction is outgress from among the multiple ACLs; Detect whether there is a fourth target rule in the list of fourth target rules that matches the fourth target ACL that intersects with the five-tuple information, wherein the port of the fourth target rule is the preset number of ports; If the existence of the fourth target rule is detected and the processing action of the fourth target rule is rejection, the fourth target ACL and the fourth target rule ID corresponding to the fourth target rule are added to the reverse pending ACL list.

7. The automatic ACL creation method according to any one of claims 1 to 6, characterized in that, The attribute information includes the switch manufacturer and model; The step of obtaining the switch's configuration file and routing table based on the attribute information includes: The configuration command for the switch is determined based on the switch manufacturer and model. The switch is connected via Secure Enclosure Protocol, and the switch is controlled to execute the configuration command to obtain the configuration file and the routing table.

8. An automatic ACL creation device, characterized in that, include: The module includes a receiving module, an acquiring module, a parsing module, a first determining module, a second determining module, a detection module, and a creation module. The receiving module is used to respond to ACL creation requests, receive 5-tuple information and switch attribute information, wherein the 5-tuple information includes the source IP address; The acquisition module is used to acquire the configuration file and routing table of the switch based on the attribute information; The parsing module is used to parse the configuration file and the routing table, and establish a routing table model and an ACL model based on the parsing results. The routing table model includes multiple routing tables of different types, as well as a first network interface and subnet matching each routing table. The ACL model includes multiple ACLs, as well as a second network interface matching each ACL, a rule list, a rule ID, and the binding direction of the ACL to the second network interface. The first determining module is used to determine the ingress interface of the switch in the first network interface based on the source IP address and the subnet; The second determining module is used to determine, based on the ingress interface, a first target ACL whose binding direction is ingress from among a plurality of ACLs; The detection module is used to detect whether there is a first target rule in the first target rule list that matches the first target ACL and has an intersection with the five-tuple information; The creation module is used to add the first target ACL and the first target rule ID corresponding to the first target rule to a preset positive ACL list when it detects the existence of the first target rule and the processing action of the first target rule is rejection.

9. An electronic device, the electronic device comprising a processor and a memory, characterized in that, The memory is used to store instructions, and the processor is used to call the instructions in the memory to cause the electronic device to execute the ACL automatic creation method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores computer instructions that, when executed on an electronic device, cause the electronic device to perform the ACL automatic creation method as described in any one of claims 1 to 7.

Images