Redundancy configuration detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a redundancy configuration detection method and device, electronic equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: obtaining a plurality of first reference ranges of a first type of ports and a second reference range of a second type of ports corresponding to each first reference range from a reference rule; according to the first sub-range and the second sub-range, at least one first detection range of the first type of ports and a second detection range, corresponding to each first detection range, of the second type of ports are obtained from a to-be-detected configuration item of the to-be-detected rule, and each first detection range is located in a first reference range; and for each first detection range, comparing a second detection range corresponding to the first detection range with a second reference range corresponding to a first reference range to which the first detection range belongs, and determining whether the to-be-detected configuration item is a redundant configuration item based on a comparison result. By applying the scheme provided by the embodiment of the invention, the redundant configuration in the firewall security rule can be detected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a redundancy configuration detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] Firewall technology is one of the core technologies for protecting network boundaries. By configuring firewall security rules, network traffic can be controlled and illegal access can be blocked.

[0003] At present, with the increasing complexity of modern network environments, the number of firewall security rules that need to be configured also increases exponentially. However, there are problems such as difficulty in unified planning and real-time adjustment in the process of configuring firewall security rules, which leads to the existence of redundancy configurations in the configured firewall security rules. These redundant configurations not only waste device resources, but also increase the management difficulty of operation and maintenance personnel.

[0004] In view of the above situation, it is necessary to provide a redundancy configuration detection scheme to detect redundant configurations in firewall security rules so as to timely eliminate them. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a redundancy configuration detection method, device, electronic device and storage medium to detect redundant configurations in firewall security rules. The specific technical solutions are as follows:

[0006] In a first aspect, the embodiments of the present application provide a redundancy configuration detection method, comprising:

[0007] From the benchmark rules included in the configured firewall security rules, a plurality of first benchmark ranges of a first type of port and a second benchmark range of a second type of port corresponding to each first benchmark range are obtained, and the plurality of first benchmark ranges include a first sub-range and a second sub-range in a port range of the first type of port;

[0008] According to the first sub-range and the second sub-range, at least one first detection range of the first type of port and a second detection range of the second type of port corresponding to each first detection range are obtained from a to-be-detected configuration item of a to-be-detected rule, and each first detection range is located within a first benchmark range;

[0009] For each first detection range, the second detection range corresponding to the first detection range and the second benchmark range corresponding to the first benchmark range to which the first detection range belongs are compared, and based on the comparison result, it is determined whether the to-be-detected configuration item is a redundant configuration item.

[0010] In a second aspect, the embodiments of the present application provide a redundancy configuration detection device, comprising:

[0011] The baseline range acquisition module is used to acquire multiple first baseline ranges for a first type of port and a second baseline range for a second type of port corresponding to each first baseline range from the baseline rules included in the configured firewall security rules. The multiple first baseline ranges include: a first sub-range and a second sub-range in the port range of the first type of port.

[0012] The detection range acquisition module is used to obtain at least one first detection range of the first type of port and a second detection range of the second type of port corresponding to each first detection range from the detection configuration items of the detection rule according to the first sub-range and the second sub-range, wherein each first detection range is located within a first reference range;

[0013] The redundancy detection module is used to compare, for each of the first detection ranges, the second detection range corresponding to the first detection range and the second reference range corresponding to the first reference range to which the first detection range belongs, and determine whether the configuration item to be detected is a redundant configuration item based on the comparison result.

[0014] Thirdly, embodiments of the present invention provide an electronic device, including:

[0015] Memory, used to store computer programs;

[0016] A processor, when executing a program stored in memory, implements the method described in the first aspect.

[0017] Fourthly, embodiments of the present invention provide a computer-readable storage medium, comprising:

[0018] Memory, used to store computer programs;

[0019] A processor, when executing a program stored in memory, implements the method described in the first aspect.

[0020] Fifthly, embodiments of the present invention also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect.

[0021] As can be seen from the above, in the scheme provided by the embodiment of the present application, firstly, the port range of the first type of port defined by each configuration item in the reference rule is divided into a plurality of first reference ranges, and the second reference range of the second type of port corresponding to each first reference range is determined; then, at least one first detection range of the first type of port is determined from the to-be-detected configuration item of the to-be-detected rule according to each divided first reference range, and each first detection range is located within a first reference range; in this way, by comparing the second detection range of the second type of port corresponding to the first detection range with the second reference range, whether the port range defined by the to-be-detected configuration item is located within the port range defined by the reference rule, that is, whether the reference rule covers the to-be-detected configuration item, can be efficiently and accurately detected, and accurate and efficient detection of the redundant configuration is realized. In addition, after the redundant configuration is detected, the redundant configuration in the rule can be timely eliminated and / or modified, thereby reducing the occupation of device resources by the redundant configuration and reducing the management difficulty of the operation and maintenance personnel.

[0022] Of course, implementing any product or method of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other embodiments can also be obtained by those skilled in the art based on these drawings.

[0024] Figure 1 A flowchart of a first redundant configuration detection method provided by the embodiment of the present application;

[0025] Figure 2a A schematic diagram of a first port range provided by the embodiment of the present application;

[0026] Figure 2b A schematic diagram of a second port range provided by the embodiment of the present application;

[0027] Figure 2c A schematic diagram of a third port range provided by the embodiment of the present application;

[0028] Figure 2d A schematic diagram of a fourth port range provided by the embodiment of the present application;

[0029] Figure 2e A schematic diagram of a fifth port range provided by the embodiment of the present application;

[0030] Figure 2f A schematic diagram of a sixth port range provided by the embodiment of the present application;

[0031] Figure 2g A seventh port range diagram provided for an embodiment of the present application;

[0032] Figure 2h An eighth port range diagram provided for an embodiment of the present application;

[0033] Figure 3 A flow diagram of a second redundancy configuration detection method provided for an embodiment of the present application;

[0034] Figure 4a A ninth port range diagram provided for an embodiment of the present application;

[0035] Figure 4b A tenth port range diagram provided for an embodiment of the present application;

[0036] Figure 4c An eleventh port range diagram provided for an embodiment of the present application;

[0037] Figure 4d A twelfth port range diagram provided for an embodiment of the present application;

[0038] Figure 4e A thirteenth port range diagram provided for an embodiment of the present application;

[0039] Figure 4f A fourteenth port range diagram provided for an embodiment of the present application;

[0040] Figure 5 A structure diagram of a redundancy configuration detection device provided for an embodiment of the present application;

[0041] Figure 6 A structure diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art based on the present application are within the scope of protection of the present application.

[0043] First, the application scenarios of the embodiments of the present application are introduced.

[0044] The scenario of detecting the redundancy configuration in the firewall security rules of the firewall device configuration.

[0045] Currently, with the increasing complexity of modern network environment, the number of firewall security rules to be configured also increases exponentially. However, there are problems in the process of configuring firewall security rules, such as difficult to plan and adjust in real time, which leads to the existence of redundant configurations in the configured firewall security rules in the device.

[0046] The above-mentioned redundant configuration will be described more intuitively through a simple example.

[0047] Table 1

[0048]

[0049] In the above table 1, srcport represents the source port, dstport represents the destination port, the execution priority of rule 1 is higher than that of rule 2 and rule 3, and each row of configuration statement in each rule can be referred to as a configuration item. Hereinafter, the Nth configuration item in the rule is referred to as configuration item N. It can be seen that rule 1 includes 2 configuration items, configuration item 1 represents controlling the transmission control protocol (TCP) network traffic with the source port in the range of 1-101 and the destination port in the range of 310-350, and configuration item 2 represents controlling the TCP network traffic with the source port in the range of 2-102 and the destination port in the range of 320-360; rule 2 includes 1 configuration item, which represents controlling the TCP network traffic with the source port in the range of 1-102 and the destination port in the range of 320-350; rule 3 includes 1 configuration item, which represents controlling the TCP network traffic with the source port in the range of 2-101 and the destination port in the range of 310-360.

[0050] It can be easily seen by analysis that the source port range and the destination port range specified in the configuration item in rule 2 completely fall within the range specified in the configuration item in rule 1. Because the execution priority of rule 1 is higher than that of rule 2, in essence, the configuration item in rule 1 covers the configuration item in rule 2, and the traffic has no chance to match the configuration item in rule 2 with low priority. In this case, the configuration item in rule 2 is a redundant configuration item. Of course, because rule 2 includes only one configuration item, rule 2 as a whole can be referred to as a redundant rule. Similarly, the configuration item in rule 1 covers the configuration item in rule 3, and the configuration item in rule 3 is a redundant configuration item. Because rule 3 includes only one configuration item, rule 3 is also a redundant rule.

[0051] And, with the passage of time, the redundant configuration in the device will continue to accumulate. These redundant configurations not only cause waste of device resources, but also bring serious challenges to daily operation and maintenance. In this context, the accurate detection and optimization of redundant configurations between strategies have gradually become an important part of network security operation and maintenance.

[0052] In view of the above, it is necessary to provide a redundant configuration detection scheme to detect the redundant configuration in the firewall security rule so as to timely eliminate it.

[0053] It should be noted that in the scheme provided by the embodiments of the present application, the first type of port is one of the source port and the destination port, and the second type of port is the other type of port except the first type of port.

[0054] For example, the first type of port can be the source port, and the second type of port is the destination port; for another example, the first type of port can be the destination port, and the second type of port is the source port.

[0055] For the convenience of description, the scheme provided by the embodiments of the present application will be introduced below taking the first type of port as the source port and the second type of port as the destination port as an example.

[0056] In addition, it should be noted that the tables and diagrams in the following are only examples for understanding and do not constitute a limitation on the embodiments of the present application.

[0057] The redundant configuration item detection scheme provided by the embodiments of the present application will be described in detail below in combination with the flow chart and the schematic diagram.

[0058] Referring to Figure 1 The flow chart of the first redundant configuration detection method provided by the embodiments of the present application is shown in the above method, which includes the following steps S101-S103.

[0059] Step S101: From the reference rule included in the configured firewall security rule, a plurality of first reference ranges of the first type of port and a second reference range of the second type of port corresponding to each first reference range are obtained.

[0060] First, the reference rule and the rule to be detected in the embodiments of the present application are introduced.

[0061] 1. Reference rule

[0062] The above reference rule is a rule in the configured firewall security rule, which is used as a reference for comparison to detect the redundant configuration in the firewall security rule with lower execution priority. In view of this, the reference rule can be a rule with higher execution priority in the configured firewall security rule.

[0063] 2. Rule to be detected

[0064] The to-be-detected rule can also be referred to as a to-be-compared rule, and the execution priority of the to-be-detected rule is lower than that of the benchmark rule, so that when the configuration item in the to-be-detected rule is completely covered by the benchmark rule, the configuration item in the to-be-detected rule can be considered as a redundant configuration item.

[0065] The to-be-detected rule can be a firewall security rule that has been configured in the device, so that after the redundant configuration item in the to-be-detected rule is determined, the redundant configuration item can be removed, the device resource occupation is reduced, and the management difficulty of the operation and maintenance personnel is reduced; the to-be-detected rule can also be a firewall security rule that is to be configured and has not been actually configured, so that after the redundant configuration item in the to-be-detected rule is determined, the redundant configuration item can be removed to avoid increasing the redundant configuration item in the device.

[0066] In an embodiment of the present application, the benchmark rule can be a rule with the highest execution priority in the firewall security rule.

[0067] In this way, the rule with the highest execution priority in the configured firewall security rule is taken as the benchmark for detection, which can take the remaining rules in the firewall security rule as to-be-detected rules and perform redundant configuration item detection, thereby facilitating more comprehensive detection of the redundant configuration item in the firewall security rule.

[0068] The first benchmark range and the second benchmark range will be introduced below.

[0069] 1. First benchmark range

[0070] The first benchmark range belongs to the port range of the first type of port specified in the benchmark rule, and specifically includes a first sub-range and a second sub-range in the port range of the first type of port. The first sub-range is a repeated range in the configuration items included in the benchmark rule, and the second sub-range is a non-repeated range, i.e., a unique range, in the configuration items included in the benchmark rule.

[0071] Still taking Table 1 as an example, if rule 1 is the benchmark rule, the source port range specified by configuration item 1 in rule 1 is [1-101], and the source port range specified by configuration item 2 in rule 1 is [2-102], then the repeated range in the source port ranges of configuration item 1 and configuration item 2 is [2-101], and the unique ranges are [1-1] and [102-102], respectively.

[0072] The following will be more intuitively explained in combination with the accompanying drawings. Referring to Figure 2a , which is a schematic view of the repeated range and the unique range in the configuration item. Figure 2aThe two rectangles arranged in upper, middle and lower positions respectively represent the source port ranges defined by the configuration item 1 and the configuration item 2, and the numerals represent the port numbers. The shaded parts in the two rectangles represent the overlapping range in the source port ranges of the configuration item 1 and the configuration item 2, i.e. [2-101]. The non-shaded parts in the two rectangles represent the unique ranges in the configuration item 1 and the configuration item 2, respectively. In this example, each of the two unique ranges includes only one port number, which can be represented as [1-1] and [102-102].

[0073] It can be seen that the first reference ranges are actually the ranges obtained by integrating the overlapping ranges in the source port ranges of the configuration items in the reference rule, and the first reference ranges do not overlap with each other. In other words, if the source port ranges of the configuration items are expressed as line segments, and the source port ranges are cut according to the overlapping common parts, the first reference ranges can be obtained.

[0074] 2. Second reference range

[0075] The second reference range is the second reference range of the second type of port corresponding to the first reference range in the reference rule.

[0076] As introduced above, the source port range and the destination port range corresponding to the source port range are defined in each configuration item. Thus, the second reference range corresponding to the first reference range can be determined from the configuration item.

[0077] Specifically, the port range of the second type of port defined by the configuration item including the first reference range can be obtained from the reference rule as the second reference range corresponding to the first reference range. The configuration item including the first reference range is the configuration item whose defined source port range includes the first reference range.

[0078] For example, referring to Figure 2b , the correspondence between the source port ranges and the destination port ranges defined by the configuration items is shown. The destination port range corresponding to the configuration item 1 in the reference rule is [310-350], and the destination port range corresponding to the configuration item 2 is [320-360].

[0079] In this case, the second reference ranges corresponding to the three first reference ranges determined above are shown in Table 2.

[0080] Table 2

[0081]

[0082] It can be seen that, for the unique ranges [1-1] and [102-102], they inherit the destination port ranges of the configuration items to which they belong, for example, the unique range [1-1] inherits the destination port range [310-350] of the configuration item 1, and the unique range [102-102] inherits the destination port range [320-360] of the configuration item 2; for the repeated range [2-101], it inherits the destination port ranges of two configuration items, for example, the repeated range [2-101] inherits the destination port range [310-350] of the configuration item 1 and the destination port range [320-360] of the configuration item 2.

[0083] In view of this, in one embodiment of the present application, the destination port ranges corresponding to the repeated ranges can be merged. That is, for a first reference range belonging to a repeated range, the port ranges of the second type ports defined by the configuration items including the repeated range can be merged, and the merged port range is taken as the second reference range corresponding to the first reference range; for a first reference range belonging to a unique range, the port ranges of the second type ports defined by the configuration items including the unique range can be directly taken as the second reference range corresponding to the first reference range.

[0084] In this way, referring to Table 2, Figure 2c The destination port ranges [310-350] and [320-360] corresponding to the repeated range [2-101] can be merged to obtain [310-360] as the second reference range corresponding to the repeated range [2-101]; the second reference ranges corresponding to the unique ranges [1-1] and [102-102] are [310-350] and [320-360] respectively. The second reference ranges corresponding to the first reference ranges after merging are shown in Table 3.

[0085] Table 3

[0086]

[0087] That is, for a first reference range that inherits the port ranges of multiple second type ports, the port ranges of the multiple second type ports inherited by the first reference range can be merged, and the second reference range obtained after merging does not include repeated parts, so that redundant comparison in the subsequent port range comparison stage can be reduced, and the efficiency of redundant configuration detection is improved.

[0088] Step S102: According to the first sub-range and the second sub-range, at least one first detection range of the first type ports and the second detection range of the second type ports corresponding to each first detection range are obtained from the to-be-detected configuration items of the to-be-detected rule.

[0089] The to-be-detected rule can be any rule with a lower execution priority than the benchmark rule, and the to-be-detected configuration item can be any configuration item in the to-be-detected rule. Each first detection range is located within a first benchmark range.

[0090] In this step, the source port range specified by the to-be-detected configuration item needs to be divided into first detection ranges located within the first benchmark ranges according to the first benchmark ranges.

[0091] Specifically, it can be determined whether the first port range of the first type of port specified by the to-be-detected configuration item is located within a target benchmark range in the plurality of first benchmark ranges. If not, the overlapping range between the first port range and each first benchmark range is determined respectively, and each determined overlapping range is taken as the first detection range of the first type of port.

[0092] For example, the source port range specified by the to-be-detected configuration item of rule 2 is [1-102], and the first benchmark ranges of the benchmark rule are [1-1], [2-101], and [102-102]. The first detection ranges obtained after the to-be-detected configuration item is split are [1-1], [2-101], and [102-102]. As shown in FIG. 2, from the perspective of visualization, the source port range of the to-be-detected configuration item is cut to obtain the first detection ranges belonging to the first benchmark ranges. Figure 2d Figure 2d Different shaded rectangles represent different first detection ranges.

[0093] If the first port range is located within a target benchmark range in the plurality of first benchmark ranges, the first port range does not need to be divided, and the first port range is directly taken as the first detection range.

[0094] For example, the source port range specified by the to-be-detected configuration item of rule 3 is [2-101], which is located within the first benchmark range [2-101]. At this time, [2-101] is directly taken as the first detection range. In this case, the entire source port range is essentially taken as one first detection range.

[0095] The second detection range is the port range of the second type of port corresponding to the first detection range in the to-be-detected configuration item, which directly inherits the destination port range of the to-be-detected configuration item. For example, the second detection ranges corresponding to the first detection ranges [1-1], [2-101], and [102-102] of rule 2 are all [320-350].

[0096] ​It can be seen that, in this way, whether the first port range of the first type of port specified by the to-be-detected configuration item is located in a target reference range in the plurality of first reference ranges, different ways can be adopted to efficiently and reasonably determine the first detection range.

[0097] Step S103: For each first detection range, compare the second detection range corresponding to the first detection range and the second reference range corresponding to the first reference range to which the first detection range belongs, and determine whether the to-be-detected configuration item is a redundant configuration item based on the comparison result.

[0098] Specifically, for each first detection range, it is judged whether the second detection range corresponding to the first detection range is located in the second reference range corresponding to the first reference range to which the first detection range belongs, and a judgment result is obtained; if the judgment result indicates that the second detection range corresponding to all the first detection ranges is located in the second reference range corresponding to the first reference range to which the first detection range belongs, it indicates that the to-be-detected configuration item is a redundant configuration item, otherwise, it indicates that the to-be-detected configuration item is not a redundant configuration item.

[0099] The following will be described in detail by way of examples.

[0100] Example 1:

[0101] If rule 2 is the to-be-detected rule, and the 1 configuration item included therein is the to-be-detected item, as known from the foregoing, the first detection ranges thereof are [1-1], [2-101] and [102-102] respectively, then comparison is made for each first detection range:

[0102] For the first detection range [1-1], the second detection range corresponding thereto is [320-350], and the first reference range thereof is [1-1], according to Table 3, it can be seen that the second reference range corresponding to the first reference range [1-1] is [310-350]; comparing the second detection range [320-350] and the second reference range [310-350], as shown in Figure 2e , [320-350] is located in the range [310-350].

[0103] For the first detection range [2-101], the second detection range corresponding thereto is [320-350], and the first reference range thereof is [2-101], and according to Table 3, it can be seen that the second reference range corresponding to the first reference range [2-101] is [310-360]; comparing the second detection range [320-350] and the second reference range [310-360], as shown in Figure 2f , [320-350] is located in the range [310-360].

[0104] For the first detection range [102-102], its corresponding second detection range is [320-350], and its first reference range is [102-102]. Similarly, according to Table 3, the first reference range [102-102] corresponds to the second reference range [320-360], as shown in Figure 2g [320-350] is located in the range [320-360].

[0105] At this point, the second detection range corresponding to the entire first detection range of the to-be-detected item is located in the corresponding second reference range, so that it can be determined that the to-be-detected item of rule 2 is a redundant configuration item.

[0106] In an embodiment of the present application, the to-be-detected rule including each configuration item as a redundant configuration item can be determined as a redundant rule. For example, rule 2 includes only one to-be-detected item, and the to-be-detected item is a redundant configuration item, so rule 2 is a redundant rule. In this way, the to-be-detected rule including each configuration item as a redundant configuration item can be determined as a redundant rule, which facilitates subsequent timely elimination of the entire redundant rule.

[0107] Example 2:

[0108] If rule 3 is a to-be-detected rule, it includes one configuration item as a to-be-detected item, and according to the foregoing, the entire source port range of the to-be-detected item is taken as a first detection range [2-101]. The following is a comparison of the first detection range:

[0109] For the first detection range [2-101], its corresponding second detection range is [310-360], and its first reference range is [2-101]. Similarly, according to Table 3, the first reference range [2-101] corresponds to the second reference range [310-360], as shown in Figure 2h [310-360] is completely consistent with [310-360], and of course [310-360] can also be said to be located in the range [310-360].

[0110] At this point, the second detection range corresponding to the entire first detection range of the to-be-detected item is located in the corresponding second reference range, so that it can be determined that the to-be-detected item of rule 3 is a redundant configuration item. Since rule 3 includes only one to-be-detected item, rule 3 is a redundant rule.

[0111] As can be seen from the above, in the scheme provided by the embodiment of the application, first, the port range of the first type of port is divided into a plurality of first reference ranges that do not overlap with each other according to the repetition range and the unique range of the first type of port defined by each configuration item in the reference rule, and the second reference range of the second type of port corresponding to each first reference range is determined; then, at least one first detection range of the first type of port is determined from the to-be-detected configuration item of the to-be-detected rule according to each divided first reference range, and each first detection range is located within a first reference range; in this way, by comparing the second detection range of the second type of port corresponding to the first detection range with the second reference range, whether the port range defined by the to-be-detected configuration item is located within the port range defined by the reference rule, that is, whether the reference rule covers the to-be-detected configuration item, can be efficiently and accurately detected, and accurate and efficient detection of the redundant configuration is realized. In addition, after the redundant configuration is detected, the redundant configuration in the rule can be timely eliminated and / or modified, thereby reducing the occupation of device resources by the redundant configuration and reducing the management difficulty of the operation and maintenance personnel.

[0112] In an embodiment of the application, after the scheme provided by the embodiment of the application is executed, the reference rule can also be updated to a rule in the firewall security rule that is not determined as a reference rule and has the highest execution priority, and then the above scheme is repeatedly executed until the number of the firewall security rules that are not determined as reference rules is 1.

[0113] In this way, the firewall security rules can be sequentially executed as reference rules for redundant configuration detection in the order from high to low of the execution priority, and through iterative detection, the redundant configuration in the firewall security rule can be more comprehensively and deeply detected, the detection rate of the redundant configuration is improved, and the occupation of device resources by the redundant configuration is further reduced.

[0114] In Figure 1 On the basis of the embodiment shown in the figure, the edge port numbers of the second port range of the first type of port defined by each configuration item included in the reference rule can be sorted, and the plurality of first reference ranges of the first type of port can be obtained. In view of the above, the second redundant configuration detection method is provided in the embodiment of the application.

[0115] Referring to Figure 3 The second redundant configuration detection method provided in the embodiment of the application is shown in the flowchart. The above method includes the following steps S301-S307.

[0116] Step S301: Obtain the edge port numbers of the second port range of the first type of port defined by each configuration item included in the reference rule.

[0117] The edge port number can also be referred to as an end point of the second port range. For example, for the second port range [1-101], the edge port numbers are 1 and 101.

[0118] Step S302: Sort the edge port numbers in ascending order.

[0119] Step S303: For each sorted edge port number, combine the edge port number with its adjacent next edge port number to obtain each initial range.

[0120] Step S304: Integrate the multiple initial ranges including the repeated port numbers, and take the integrated initial ranges as the multiple first reference ranges of the first type of ports.

[0121] In this step, the multiple initial ranges including the repeated port numbers are integrated to remove the repeated port numbers in the initial ranges to obtain each first reference range not including the repeated port numbers.

[0122] Specifically, the number of the second port ranges to which the multiple initial ranges including the repeated port numbers belong can be counted respectively to obtain multiple first numbers, and then the multiple first numbers are compared, and other first numbers except the maximum value in the multiple first numbers are obtained; the repeated port numbers are removed from the initial ranges corresponding to the other first numbers, and the initial ranges after the removal are taken as the integrated initial ranges. For details, see the subsequent examples, which will not be described here.

[0123] In this way, based on the number of times that the initial ranges are included in the source port range of the reference rule, the attribution of the repeated ports in the initial ranges can be conveniently and reasonably determined.

[0124] Step S305: Obtain the second reference range of the second type of ports corresponding to each first reference range.

[0125] Step S306: According to the first sub-range and the second sub-range, obtain at least one first detection range of the first type of ports and the second detection range of the second type of ports corresponding to each first detection range from the to-be-detected configuration item of the to-be-detected rule.

[0126] Step S307: For each first detection range, compare the second detection range corresponding to the first detection range with the second reference range corresponding to the first reference range to which the first detection range belongs, and determine whether the to-be-detected configuration item is a redundant configuration item based on the comparison result.

[0127] The implementation of steps S305-S307 can refer to the implementation of steps S101-S103 in the example shown in Figure 1 The implementation of steps S101-S103 in the example shown in

[0128] In this embodiment, the source port range in the reference rule is cut in a line segment manner, and the cutting manner is: the edge port numbers of the source port range of each configuration item are sorted, the adjacent edge port numbers after sorting form an initial range, and the initial range including the repeated port number is integrated, so that each first reference range which does not overlap each other can be reasonably and conveniently divided.

[0129] Next, taking the aforementioned rule 1 as the reference rule, rule 2 and rule 3 as the to-be-detected rules as an example, the detection manner of the redundant configuration shown in the embodiment is introduced intuitively, and specific reference can be made to the following steps P1-P9. Figure 3

[0130] Step P1: Put the port range defined by each configuration item included in the reference rule into an array.

[0131] As shown in FIG. 1, the source port range [1-101] and [2-102] defined by two configuration items included in the reference rule can be put into one array, the destination port range [310-350] and [320-360] defined by two configuration items included in the reference rule can be put into array 2, and the elements at the same position in the two arrays are associated. In this way, the destination port range corresponding to the source port range defined by each configuration item can be conveniently represented based on the array. Figure 4a

[0132] Step P2: Sort the end point values of the source port range defined by each configuration item of the reference rule.

[0133] The end point values are also the aforementioned edge port numbers.

[0134] The source port range defined by each configuration item is [1-101] and [2-102], and all the end point values are 1, 101, 2, and 102. After sorting, they are 1, 2, 101, and 102.

[0135] Step P3: Combine each end point value to obtain each initial range.

[0136] Specifically, starting from the first end point value after sorting, the end point value and the adjacent end point value after it are combined to obtain each initial range [1-2], [2-101], and [101-102].

[0137] Step P4: Count the number of source port ranges to which each initial range including a repeated port belongs.

[0138] As can be seen, after step P3, some initial ranges include repeated ports, and we need to determine which initial range the repeated port belongs to.

[0139] ​​Specifically, in this step, the number of source port ranges to which each initial range including the duplicate port belongs can be counted first.

[0140] For example, the initial ranges [1-2] and [2-101] include the duplicate port 2; as shown in Figure 4b the initial range [1-2] belongs to only the source port range [1-101], i.e., the number of source port ranges to which the initial range [1-2] belongs is 1; as shown in Figure 4c the initial range [2-101] belongs to the source port ranges [1-101] and [2-102], i.e., the number of source port ranges to which the initial range [2-101] belongs is 2.

[0141] Similarly, the initial ranges [2-101] and [101-102] include the duplicate port 101, and according to the above manner, the number of source port ranges to which the initial range [2-101] belongs is 2, and the number of source port ranges to which the initial range [101-102] belongs is 1.

[0142] Step P5: According to the number counted, the initial range to which the duplicate port belongs is determined, the duplicate port is removed from the remaining initial ranges, and each divided source port range is obtained.

[0143] Specifically, the initial range corresponding to the larger value can be determined as the initial range to which the duplicate port belongs, i.e., the duplicate port 2 belongs to the initial range [2-101], and then the duplicate port 2 can be removed from the initial range [1-2] to obtain the initial range [1-1].

[0144] Similarly, according to the above manner, it can be determined that the duplicate port 101 belongs to the initial range [2-101], so that the duplicate port 101 can be removed from the initial range [101-102] to obtain the initial range [102-102].

[0145] After the above step of removing the duplicate port, the final obtained each divided source port range is: [1-1], [2-101], and [102-102].

[0146] Step P6: For the adjusted source port range, the destination port range thereof is inherited.

[0147] The inheritance manner of the destination port range has been described above, and will not be repeated here.

[0148] Referring to Figure 4dFor example, the adjusted source port range [1-1] is a unique range, only included by the source port range [1-101], so only the destination port range [310-350] corresponding to the source port range [1-101] is inherited; for another example, the adjusted source port range [2-101] is a repeated range, included by the source port ranges [1-101] and [2-102], so the destination port ranges [310-350] and [320-360] corresponding to the source port ranges [1-101] and [2-102] are inherited; the adjusted source port range [102-102] is a unique range, only included by the source port range [2-102], so only the destination port range [320-360] corresponding to the source port range [2-102] is inherited.

[0149] As can be known from the foregoing, for the repeated range [2-101], the corresponding destination port ranges [310-350] and [320-360] can be combined to obtain the destination port range [310-360], and the combined destination port range is shown in Figure 4e .

[0150] Step P7: According to the divided source port ranges in the reference rule, the source port ranges defined by the configuration item in rule 2 are divided to obtain the source port ranges [1-1], [2-101] and [102-102], and whether the destination port ranges corresponding to the divided source port ranges are contained in the reference rule is compared, and whether rule 2 is redundant is determined according to the comparison result.

[0151] The manner of splitting the source port ranges defined by the configuration item in rule 2 has been described in the foregoing, and the three divided source port ranges and the destination port ranges corresponding to the source port ranges are shown in Figure 4f .

[0152] The following compares the divided source port ranges [1-1], [2-101] and [102-102] respectively.

[0153] For the divided source port range [1-1], the corresponding destination port range is [320-350], and the corresponding destination port range in the reference rule is [310-350], and [320-350] is located in the range [310-350].

[0154] For the divided source port range [2-101], the corresponding destination port range is [320-350], and the corresponding destination port range in the reference rule is [310-360], and [320-350] is located in the range [310-360].

[0155] For the split source port range [102-102] of the configuration item, the corresponding destination port range is [320-350], and the corresponding destination port range in the benchmark rule is [320-360], and [320-350] is located in the range [320-360].

[0156] At this point, the destination port range corresponding to the split source port range of the configuration item in rule 2 is contained in the benchmark rule, so it can be determined that the configuration item of rule 2 is a redundant configuration item. Because rule 2 only includes one to-be-detected item, and the to-be-detected item is a redundant configuration item, rule 2 is a redundant rule.

[0157] Step P8: In a similar way, whether the destination port range corresponding to the source port range of the configuration item in rule 3 is contained in the benchmark rule is compared, and whether rule 3 is redundant is determined according to the comparison result.

[0158] Similarly, the source port range [2-101] of the configuration item in rule 3 belongs to the source port range [2-101] divided by the benchmark rule, the corresponding destination port range is [310-360], and the corresponding destination port range in the benchmark rule is also [310-360], and [310-360] is located in the range [310-360].

[0159] At this point, the destination port range corresponding to the source port range of the configuration item in rule 3 is contained in the benchmark rule, so it can be determined that the configuration item of rule 3 is a redundant configuration item. Because rule 3 only includes one to-be-detected item, and the to-be-detected item is a redundant configuration item, rule 3 is a redundant rule.

[0160] It can be seen that the source port range in the benchmark rule is cut in order to ensure that there is no overlapping range between each first benchmark range obtained after cutting, so that after the recombination of each first benchmark range and the second benchmark range, the subsequent redundant comparison stage can reduce the redundant comparison process and improve the detection efficiency.

[0161] In addition, for the repeated range in the first benchmark range, the inherited destination port range can be merged, because in the subsequent redundant determination stage, it is not necessary to know which configuration item of the rule the destination port range comes from, but only to compare whether the destination port range of the to-be-detected configuration item is within the destination port range of the benchmark rule. In this way, it is also beneficial to reduce the redundant comparison of the subsequent port range comparison stage, and improves the redundant configuration detection efficiency.

[0162] Corresponding to the foregoing redundant configuration detection method, the embodiment of the application also provides a redundant configuration detection device.

[0163] Reference Figure 5A structural schematic diagram of a redundancy configuration detection device provided by an embodiment of the present application, the device comprising the following modules:

[0164] A reference range acquisition module 501, configured to acquire a plurality of first reference ranges of a first type of port and a second reference range of a second type of port corresponding to each of the first reference ranges from reference rules included in a configured firewall security rule, the plurality of first reference ranges comprising a first sub-range and a second sub-range in a port range of the first type of port;

[0165] A detection range acquisition module 502, configured to acquire at least one first detection range of the first type of port and a second detection range of the second type of port corresponding to each of the first detection ranges from a to-be-detected configuration item of a to-be-detected rule according to the first sub-range and the second sub-range, each of the first detection ranges being located within one of the first reference ranges;

[0166] A redundancy detection module 503, configured to, for each of the first detection ranges, compare a second detection range corresponding to the first detection range and a second reference range corresponding to a first reference range to which the first detection range belongs, and determine whether the to-be-detected configuration item is a redundant configuration item based on a comparison result.

[0167] As can be seen from the above, in the scheme provided by the embodiment of the present application, first, the port range of the first type of port is divided into a plurality of first reference ranges according to the repeated range and the unique range of the first type of port specified by each configuration item in the reference rule, and the second reference range of the second type of port corresponding to each of the first reference ranges is determined; then, at least one first detection range of the first type of port is determined from the to-be-detected configuration item of the to-be-detected rule according to each of the divided first reference ranges, and each of the first detection ranges is located within one of the first reference ranges; in this way, by comparing the second detection range of the second type of port corresponding to the first detection range and the second reference range, it can be efficiently and accurately determined whether the port range specified by the to-be-detected configuration item is located within the port range specified by the reference rule, that is, whether the reference rule covers the to-be-detected configuration item, thereby achieving accurate and efficient detection of the redundant configuration. In addition, after the redundant configuration is detected, the redundant configuration in the rule can be timely eliminated and / or modified, thereby reducing the occupation of device resources by the redundant configuration and reducing the management difficulty of the operation and maintenance personnel.

[0168] In an embodiment of the present application,

[0169] The detection range acquisition module 502 is specifically configured to determine whether the first port range of the first type port specified by the to-be-detected configuration item is located in a target reference range of the plurality of first reference ranges; if not, determine the overlapping range between the first port range and each of the first reference ranges respectively, and take each of the determined overlapping ranges as the first detection range of the first type port; if yes, take the first port range as the first detection range.

[0170] It can be seen that, in this way, according to whether the first port range of the first type port specified by the to-be-detected configuration item is located in a target reference range of the plurality of first reference ranges, the first detection range can be efficiently and reasonably determined in different ways.

[0171] In an embodiment of the present application, the reference range acquisition module 501 specifically comprises:

[0172] An acquisition submodule is configured to acquire the edge port number of the second port range of the first type port specified by each configuration item included in the reference rule;

[0173] An ordering submodule is configured to order the edge port numbers in ascending order;

[0174] A combination submodule is configured to, for each ordered edge port number, combine the edge port number and the next edge port number adjacent thereto to obtain each initial range;

[0175] An integration submodule is configured to integrate the plurality of initial ranges including the repeated port numbers, and take the integrated initial range as the plurality of first reference ranges of the first type port.

[0176] In the embodiment, the source port range in the reference rule is cut in a line segment manner, and the cutting manner is: ordering the edge port numbers of the source port range of each configuration item, forming an initial range after ordering the adjacent edge port numbers, and then integrating the initial range including the repeated port numbers, so that each non-overlapping first reference range can be reasonably and conveniently divided.

[0177] In an embodiment of the present application,

[0178] The integration submodule is specifically configured to respectively count the number of the second port range to which the plurality of initial ranges including the repeated port numbers belong, to obtain a plurality of first quantities; compare the plurality of first quantities, and acquire other first quantities in the plurality of first quantities except the maximum value; eliminate the repeated port numbers from the initial range corresponding to the other first quantities, and take the eliminated initial range as the integrated initial range.

[0179] In this way, based on the number of times the initial range is included in the source port range of the benchmark rule, the ownership of the repeated port in the initial range can be conveniently and reasonably determined.

[0180] In an embodiment of the present application,

[0181] The benchmark range acquisition module 501 is specifically configured to: for a first sub-range in the multiple first benchmark ranges, determine a port range of a second type of port specified by a configuration item in the benchmark rule that includes the first sub-range; take the determined port range as a second benchmark range of the second type of port corresponding to the first sub-range; for a second sub-range in the multiple first benchmark ranges, merge the port ranges of the second type of port specified by the configuration items in the benchmark rule that include the second sub-range; and take the merged port range as a second benchmark range of the second type of port corresponding to the second sub-range.

[0182] That is, for the first benchmark range that inherits the port ranges of the multiple second type of ports, the port ranges of the multiple second type of ports inherited by the first benchmark range can be merged, and the second benchmark range obtained after the merging does not include a repeated part,

[0183] In this way, the redundant comparison in the subsequent port range comparison stage can be reduced, and the redundancy configuration detection efficiency is improved.

[0184] In an embodiment of the present application,

[0185] The benchmark rule is a rule with the highest execution priority in the firewall security rules;

[0186] And / or

[0187] The to-be-detected rule is a configured firewall security rule.

[0188] The to-be-detected rule can be a firewall security rule that has been configured in the device, so that after the redundant configuration items in the to-be-detected rule are determined, the above redundant configuration items can be removed, the device resource occupation is reduced, and the management difficulty of the operation and maintenance personnel is reduced. In addition, the rule with the highest execution priority in the configured firewall security rule is taken as the benchmark for detection, which can take the remaining rules in the firewall security rule as the to-be-detected rule and detect the redundant configuration items, which is beneficial to more comprehensively detecting the redundant configuration items in the firewall security rule.

[0189] In an embodiment of the present application, the device further comprises:

[0190] The repeat execution module is used to update the baseline rule to the rule in the firewall security rules that has not been determined as a baseline rule and has the highest execution priority, and to repeatedly execute the process of obtaining multiple first baseline ranges of the first type of port and the second baseline range of the second type of port corresponding to each first baseline range from the baseline rules included in the configured firewall security rules, until the number of firewall security rules that have not been determined as baseline rules is 1.

[0191] In this way, firewall security rules can be executed sequentially as baseline rules for redundant configuration detection, in descending order of execution priority. Through iterative detection, redundant configurations in firewall security rules can be detected more comprehensively and deeply, improving the detection rate of redundant configurations and further reducing the resource consumption of redundant configurations.

[0192] In one embodiment of the present invention, the apparatus further includes:

[0193] The redundancy rule determination module is used to determine the rules to be detected as redundant rules if every configuration item included is a redundant configuration item.

[0194] In this way, the rule to be detected, in which every configuration item is a redundant configuration item, can be identified as a redundant rule, making it easier to remove the entire redundant rule in a timely manner.

[0195] Corresponding to the above-mentioned redundant configuration detection method, this embodiment of the invention also provides an electronic device, a computer-readable storage medium, and a computer program.

[0196] This invention also provides an electronic device, such as... Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0197] Memory 603 is used to store computer programs;

[0198] The processor 601, when executing the program stored in the memory 603, implements the aforementioned redundancy configuration detection method.

[0199] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0200] The communication interface is used for communication between the above electronic device and other devices.

[0201] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the above-mentioned processor.

[0202] The above-mentioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0203] In another embodiment provided by the application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of any of the above redundancy configuration detection methods are implemented.

[0204] In another embodiment provided by the application, a computer program product containing instructions is also provided, and when the computer program product is run on a computer, the computer is caused to execute any of the redundancy configuration detection methods in the above embodiments.

[0205] In the embodiments described above, all or some of the steps can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, all or some of the steps can be implemented in the form of one or more computer programs or program elements. The computer programs reside (at least temporarily) in a memory of a computer during execution. The memory can be a RAM memory, a flash memory, a ROM memory, an EPROM memory, or any other suitable memory. The memory can be integral to or separate from the computer. The computer programs can be written in any suitable programming language, such as C, C++, Java, Visual Basic, etc. The computer programs can be written in assembly or machine language, if desired. The computer programs can be distributed over network coupled file servers, or can be distributed by any other suitable means.

[0206] It should be noted that, in the present document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Furthermore, the term "comprising" is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0207] Each of the embodiments described in the present specification is described in an associated manner, and the same or similar parts among the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the device, electronic device, and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0208] The above merely describes the preferred embodiments of the present application, but is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of detecting a redundancy configuration, the method comprising: The application comprises: obtaining a plurality of first benchmark ranges of the first type of ports and a second benchmark range of the second type of ports corresponding to each of the first benchmark ranges from benchmark rules included in the configured firewall security rules, wherein the plurality of first benchmark ranges comprises a first sub-range and a second sub-range in a port range of the first type of ports; obtaining at least one first detection range of the first type of ports and a second detection range of the second type of ports corresponding to each of the first detection ranges from a to-be-detected configuration item of a to-be-detected rule according to the first sub-range and the second sub-range, wherein each of the first detection ranges is located within one of the first benchmark ranges; comparing the second detection range corresponding to each of the first detection ranges with the second benchmark range corresponding to the first benchmark range to which the first detection range belongs, and determining whether the to-be-detected configuration item is a redundant configuration item based on the comparison result.

2. The method of claim 1, wherein, The method further comprises: determining whether a first port range of the first type of ports specified by the to-be-detected configuration item is located within a target benchmark range in the plurality of first benchmark ranges; if not, determining an overlap range between the first port range and each of the first benchmark ranges respectively, and taking each of the determined overlap ranges as a first detection range of the first type of ports; if yes, taking the first port range as the first detection range.

3. The method of claim 1, wherein, The method further comprises: obtaining edge port numbers of second port ranges of the first type of ports specified by each configuration item included in the benchmark rules; sorting the edge port numbers in ascending order; combining each of the sorted edge port numbers with a next edge port number adjacent thereto to obtain an initial range; integrating a plurality of initial ranges including duplicate port numbers, and taking the integrated initial ranges as a plurality of first benchmark ranges of the first type of ports.

4. The method of claim 3, wherein, The method further comprises: statistically obtaining a plurality of first quantities of the second port ranges to which the plurality of initial ranges including the duplicate port numbers belong respectively; comparing the plurality of first quantities and obtaining other first quantities except for a maximum value in the plurality of first quantities; eliminating the duplicate port numbers from initial ranges corresponding to the other first quantities, and taking the eliminated initial ranges as the integrated initial ranges.

5. The method of claim 1, wherein, The method further comprises: determining a port range of the second type of ports specified by a configuration item including the first sub-range in the benchmark rules for each of the first sub-ranges in the plurality of first benchmark ranges, and taking the determined port range as a second benchmark range of the second type of ports corresponding to the first sub-range. For a second sub-range in the first plurality of reference ranges, merging a port range of a second type of port defined by a configuration item of the reference rule including the second sub-range; and taking the merged port range as a second reference range of the second type of port corresponding to the second sub-range.

6. The method of any of claims 1-5, wherein, the reference rule is a rule with the highest execution priority in the firewall security rules; and / or the to-be-detected rule is a configured firewall security rule.

7. The method according to any one of claims 1-5, characterized in that, The method further comprises: updating the reference rule to a rule with the highest execution priority in the firewall security rules that is not determined as the reference rule; and repeating the process of obtaining the first plurality of reference ranges of the first type of port and the second reference range of the second type of port corresponding to each of the first reference ranges from the reference rules included in the configured firewall security rules until the number of the firewall security rules that are not determined as the reference rule is one. and / or determining the to-be-detected rule as the redundant rule if each of the included configuration items is a redundant configuration item.

8. A redundancy configuration detection apparatus characterized by comprising: comprises: a reference range obtaining module, configured to obtain a first plurality of reference ranges of a first type of port and a second reference range of a second type of port corresponding to each of the first reference ranges from reference rules included in configured firewall security rules, wherein the first plurality of reference ranges includes a first sub-range and a second sub-range in a port range of the first type of port; a detection range obtaining module, configured to obtain at least one first detection range of the first type of port and a second detection range of the second type of port corresponding to each of the first detection ranges from to-be-detected configuration items of a to-be-detected rule according to the first sub-range and the second sub-range, wherein each of the first detection ranges is located within one of the first reference ranges; a redundancy detecting module, configured to, for each of the first detection ranges, compare a second detection range corresponding to the first detection range with a second reference range corresponding to a first reference range to which the first detection range belongs, and determine whether the to-be-detected configuration item is a redundant configuration item based on a comparison result.

9. An electronic device, comprising: comprises a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is configured to store a computer program; the processor is configured to execute the program stored in the memory to implement the method steps of any of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps of any of claims 1-7. The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps of any of claims 1-7.

Images