An incremental analysis method, system and storage medium for judging network asset mutual visit security

Abstract

The application discloses a kind of judgment network asset mutual visit security incremental analysis method, system and storage medium, it is according to the configuration information of pre-change and constructs pre-change network forwarding graph model and reverse pre-change network forwarding graph model;According to pre-change network forwarding graph model and basic network forwarding graph model, find the interface of forwarding behavior change, and construct the change set that asset interface pair mutual visit relationship can change;Then each source asset interface in change set is using depth-first search algorithm, obtain new reachable relationship and message space, finally, based on new reachable relationship and message space, check the security of new mutual visit relationship of network asset.The application significantly reduces the verification delay and the consumption of computing resources under dynamic network scenario, realizes the synchronous adaptation of verification efficiency and network change frequency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to an incremental analysis method and system for judging the security of network asset intercommunication, and a storage medium. BACKGROUND

[0002] A corporate network is generally planned according to certain business intentions for various assets existing in the Internet. For security considerations, the intercommunication relationship between business assets is generally controlled to ensure the security of intercommunication between businesses. Ensuring that the network is correctly configured to ensure the correct intercommunication relationship between network assets is an important means to ensure business security.

[0003] There are some efficient methods for judging the security of network asset intercommunication. For example, Chinese patent CN118413399B (a method, system, medium and program product for judging the security of business network intercommunication) constructs a forwarding graph model, finds all source network assets that can reach the destination network asset for each destination network asset by using a depth-first search algorithm, and then judges the security of network asset intercommunication.

[0004] At the same time, in modern network systems, network configuration needs to be frequently changed due to business requirements or operation and maintenance optimization, such as adjusting access control policies or adding or deleting routing rules. These changes may cause changes in network reachability, which in turn may cause changes in network asset intercommunication relationships, posing a threat to corporate security protection.

[0005] For the above situation, a simplest method is to use a full analysis method (CN118413399B) to recalculate the network asset intercommunication relationship. However, this solution has high complexity, especially when facing a large number of devices, a large number of policy configurations and forwarding table entries. In addition, network configuration is generally only partially changed, and only a small number of network asset connectivity changes are affected. If a full analysis method is used, the connectivity relationship of all network assets is obtained, and there is a possibility of redundant calculation.

[0006] There are also some methods that directly compare the changes in network topology links to determine whether the network changes meet the requirements, such as Chinese patent CN117792900B (network change method and device). However, network assets pass through various devices (such as firewalls and switches) in the middle, and it is an end-to-end connectivity relationship. Changes in topology (links) may not necessarily result in changes in end-to-end connectivity relationships, and there may be a large number of changes in end-to-end connectivity relationships. Therefore, directly comparing the changes in network topology links to determine whether the network changes meet the requirements has low accuracy in actual application. SUMMARY

[0007] In view of the problems in the prior art, the present application aims to provide an incremental analysis method, system and storage medium for judging network asset inter-visit security, so as to reduce the verification time delay and computing resource consumption in a dynamic network scenario.

[0008] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is:

[0009] An incremental analysis method for judging network asset inter-visit security, the method constructs a pre-change network forwarding graph model and a reverse pre-change network forwarding graph model according to pre-change configuration information; finds interfaces with changed forwarding behaviors according to the pre-change network forwarding graph model and a basic network forwarding graph model, and constructs a change set in which asset interface pairs are possible to change inter-visit relations; then adopts a depth-first search algorithm for each source asset interface in the change set to obtain new reachable asset interface pairs and path information; superimposes the new reachable asset interface pairs and path information on original reachable asset interface pairs and path information to obtain new reachable relations and a message space; and finally checks the security of new network asset inter-visit relations based on the new reachable relations and the message space, and updates a reachable mapping table when the security requirement is met.

[0010] The method comprises the following steps:

[0011] S1, judging whether it is the first execution: according to the basic network configuration and the network topology, it is judged whether there is a corresponding basic network forwarding graph model and a reachable mapping table, if yes, jumping to S4, otherwise, executing S2;

[0012] S2, establishing a basic network forwarding graph model: obtaining the basic network configuration and the network topology, calculating a network forwarding table, and establishing a basic network forwarding graph model;

[0013] S3, establishing a reachable mapping table: selecting each asset interface as a starting node to traverse the basic network forwarding graph model, setting an initial message space as a full space, traversing all interfaces on the forwarding graph by using a depth-first search algorithm, calculating a reachable asset interface set of each starting node, and updating the reachable mapping table according to the reachable path to form a corresponding relation between the interfaces and the reachable asset interface pairs;

[0014] S4, establishing a pre-change network forwarding graph model and finding interfaces with changed forwarding behaviors;

[0015] According to the pre-change configuration information, a new network configuration and a network topology are generated, the pre-change network forwarding graph model and the reverse pre-change network forwarding graph model are generated by re-executing S2 according to the new network configuration and the network topology;

[0016] Then, the interfaces with changed forwarding behaviors are determined according to the pre-change network forwarding graph model and the basic network forwarding graph model.

[0017] S5, constructing a change set of the visiting relationship of the asset interface that may change;

[0018] For the change interface and the delete interface, searching the reachable asset interface pair corresponding to the current interface in the reachable mapping table and adding to the change set;

[0019] For the new interface, based on the reverse pre-change network forwarding graph model, for each interface whose forwarding behavior changes, the following operations are performed: starting from the new interface, performing a depth-first search algorithm on the reverse pre-change forwarding graph to calculate all reachable source asset interface sets, and adding the source asset interface sets to the change set;

[0020] S6, recalculating the network asset visiting relationship in the change set and generating a new reachable relationship and packet space;

[0021] For each source asset interface in the change set determined in S5, a depth-first search algorithm is used to obtain new reachable asset interface pairs and path information, which are superimposed with the original reachable asset interface pairs and path information to obtain a new reachable relationship and packet space;

[0022] S7, checking the security of the new network asset visiting relationship;

[0023] For the asset interface connectivity information in the new reachable relationship and packet space, the connectivity between the asset interfaces is compared with the user security configuration policy to confirm that the connectivity between the asset interfaces meets the security requirements such as business isolation; if the security requirements are met, the pre-change configuration and the device are issued, the pre-change network forwarding graph model is updated to the latest basic network forwarding graph model, and the reachable mapping table is updated according to the new reachable relationship and packet space; if not, an alarm is issued.

[0024] In S2, according to the network forwarding table of the network device, based on the longest prefix matching principle, the packet space that can be forwarded by each out interface is calculated, and the packet spaces with the same out interface are merged to represent the entire packet space that can be forwarded by the out interface. Finally, according to the calculated packet space, a basic network forwarding graph model is established;

[0025] The basic network forwarding graph model is based on a directed graph, the interface is a point, and the edge represents the topological connection and forwarding relationship between the interfaces, and the edge has a packet space constraint.

[0026] S2 is specifically as follows:

[0027] S2.1, generating a network forwarding table;

[0028] Call the network simulator, take the basic network configuration and network topology as input, generate the network forwarding table of all devices in the network under each virtual routing environment;

[0029] S2.2、In the process of constructing the basic network forwarding graph model, the modeling operation of the router and switch device in the network is as follows:

[0030] S2.2.1, analyze the network forwarding table of each VRF, and calculate the packet space that can be forwarded by each possible out interface based on the longest prefix matching principle;

[0031] S2.2.2, take all interfaces corresponding to the VRF as the ingress interface, take each interface used in the network forwarding table of the VRF as the egress interface, connect any ingress interface to the egress interface, and the packet space constraint on this edge is the packet space calculated for the egress interface in the network forwarding table. If the egress interface has been calculated, take the union of the newly calculated packet space and the previously calculated packet space;

[0032] S2.2.3, if there is an egress interface for another VRF, re-execute S2.1.1; otherwise, execute S2.2.2;

[0033] S2.3、In the process of constructing the basic forwarding graph model, the modeling operation of the firewall device in the network is as follows:

[0034] S2.3.1, analyze the network forwarding table of each vsys, and calculate the packet space that can be forwarded by each possible out interface based on the longest prefix matching principle;

[0035] S2.3.2, take all interfaces corresponding to the vsys as the ingress interface, take each interface used in the network forwarding table of the vsys as the egress interface, connect any ingress interface to the egress interface, and the packet space constraint on this edge is the packet space calculated for the egress interface in the network forwarding table. If the egress interface has been calculated, take the union of the newly calculated packet space and the previously calculated packet space;

[0036] S2.3.3, if there is an egress interface for another vsys, re-execute S2.2.1; otherwise, execute S2.4;

[0037] S2.4, in the process of constructing the basic network forwarding graph model, the modeling operation of the cross-device edge is as follows: for the interfaces (intf1, intf2) belonging to different devices, the packet space on the edge is the intersection of the ACL allowed packet space in the out direction of intf1 and the ACL allowed packet space in the in direction of intf2;

[0038] S2.5, in the process of constructing the base network forwarding graph, create a reverse edge with the same message space for each edge when creating each edge, and construct a reverse base forwarding graph.

[0039] The S3 is specifically as follows:

[0040] S3.1, the specific operation of the depth-first search process is: taking any asset interface as a starting node, establishing a path stack for recording the interfaces and their message space information on the current traversal path, and entering the starting node and its initial message space into the stack, and setting the current node as the starting node.

[0041] S3.1.1, first, obtain all the out-edge information of the current node in the forwarding graph, determine the next-hop node set of the current node according to the message space corresponding to each out-edge; for each next-hop node, perform the following operations:

[0042] Obtain the message space of the current node and the message space of the out-edge pointing to the current node, calculate the intersection of the two as the propagation message space of the next hop;

[0043] If the intersection is empty, skip the processing of this node;

[0044] If the intersection is not empty, continue to perform S3.1.2;

[0045] S3.1.2, judge whether the next-hop node is an asset interface:

[0046] If it is an asset interface and different from the starting node, it indicates that the asset interface is reachable from the starting node; at this time, a corresponding entry is added or updated in the reachable mapping table, and all interfaces in the path stack are associated with the starting and ending asset interface pairs;

[0047] If the node is not an asset interface, continue to perform the recursive search process of S3.2;

[0048] S3.2, update the current message space to the intersection of the existing message space and the out-edge message space, and recursively perform the depth-first search process with the next-hop node as the new current node;

[0049] S3.3, when all the next-hop nodes of the current node are traversed, remove the node from the path stack to realize the backtracking of the depth-first search, and continue to process other unvisited branches of the previous node;

[0050] S3.4, after completing the depth-first traversal of all asset interfaces, an initial reachable mapping table is formed; if multiple reachable asset interface pairs have the same source asset interface, the target asset interfaces are merged into a target asset set.

[0051] The interface where the forwarding behavior changes is specifically as follows:

[0052] For each interface on the pre-change network forwarding graph model, compare with the corresponding interface on the base network forwarding graph model: if the interface only exists on the pre-change network forwarding graph model, mark the interface as an added interface; if the interface only exists on the base network forwarding graph model, mark the interface as a deleted interface; if the interface exists on both the pre-change network forwarding graph model and the base network forwarding graph model, compare all edges with the interface as a starting point, compare the message space of the corresponding edge on the pre-change network forwarding graph model and the base network forwarding graph model, and if there is a difference, mark the interface as a changed interface.

[0053] An incremental analysis system for judging network asset inter-visit security, comprising a judgment module, a forwarding graph construction module, a reachability analysis and mapping module, an incremental change analysis module, an influence evaluation and strategy verification module;

[0054] The judgment module is used to judge whether it is the first execution: according to the base network configuration and network topology, it is judged whether there is a corresponding base network forwarding graph model and reachability mapping table;

[0055] The forwarding graph construction module is connected to the judgment module, when the judgment module judges that this is the first execution, the forwarding graph construction module calculates the network forwarding table according to the base network configuration and network topology, and establishes the base network forwarding graph model; when the judgment module judges that this is not the first execution, the forwarding graph construction module generates a new network configuration and network topology according to the pre-change configuration information, calculates a new network forwarding table, and establishes a pre-change network forwarding graph model and a reverse pre-change network forwarding graph model;

[0056] All reachability analysis and mapping modules are connected to the forwarding graph construction module, and the reachability analysis and mapping module selects each asset interface as a starting node to traverse, sets the initial message space as the full space, traverses all interfaces in the base network forwarding graph model using the depth-first search algorithm, calculates the reachable asset interface set of each starting node, and updates the reachability mapping table according to the reachable path to form the corresponding relationship between the interface and the reachable asset interface pair;

[0057] All incremental change analysis modules are connected to the forwarding graph construction module; the incremental change analysis module determines the interfaces whose forwarding behavior changes according to the pre-change network forwarding graph model and the base network forwarding graph model, and constructs a change set in which the inter-visit relationship of the asset interface pair may change; then, the depth-first search algorithm is used for each source asset interface in the change set to obtain new reachable asset interface pairs and path information; the new reachable asset interface pairs and path information are superimposed with the original reachable asset interface pairs and path information to obtain new reachability and message space;

[0058] The impact assessment and policy verification module is connected with the incremental analysis module, the impact assessment and policy verification module compares the connectivity between asset interfaces in the new reachable relationship and the message space with the user security configuration policy, confirms that the connectivity between the asset interfaces meets the business isolation and other security requirements. If the security requirements are met, the pre-change configuration and the device are issued, the pre-change network forwarding graph model is updated to the latest basic network forwarding graph model, and the reachable mapping table is updated according to the new reachable relationship and the message space. If not, an alarm is issued.

[0059] The incremental change analysis module determines the interface whose forwarding behavior changes, specifically: for each interface on the pre-change network forwarding graph model, compare it with the corresponding interface on the basic network forwarding graph model: if the interface only exists on the pre-change network forwarding graph model, mark the interface as a new interface; if the interface only exists on the basic network forwarding graph model, mark the interface as a deleted interface; if the interface exists on both the pre-change network forwarding graph model and the basic network forwarding graph model, compare all edges starting from the interface, and compare the message space of the corresponding edge on the pre-change network forwarding graph model and the basic network forwarding graph model. If there is a difference, mark the interface as a changed interface.

[0060] The incremental change analysis module constructs a change set in which the visiting relationship of the asset interface pair may change, specifically:

[0061] For the changed interface and the deleted interface, search for the reachable asset interface pair corresponding to the current interface in the reachable mapping table and add it to the change set;

[0062] For the new interface, based on the reverse pre-change network forwarding graph model, for each interface whose forwarding behavior changes, perform the following operations: starting from the new interface, perform a depth-first search algorithm on the reverse pre-change forwarding graph model to calculate all reachable source asset interface sets, and add the source asset interface set to the change set.

[0063] A computer readable storage medium having stored thereon computer programs / instructions, which, when executed by a processor, implement the steps of the incremental analysis method for judging the security of network asset visiting as described above.

[0064] After adopting the above scheme, when the network configuration is partially changed, the application only needs to quickly locate the asset interface pair set affected by the change through the reachable mapping table and reverse traversal, and finally only recalculates the local reachability of these point pairs, solving the performance bottleneck problem of the traditional scheme that needs to verify the global path again. The verification time delay and computing resource consumption in the dynamic network scenario can be significantly reduced, and the verification efficiency and network change frequency are synchronously adapted. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 is a method flowchart of the present application;

[0066] Figure 2 is a system module schematic diagram of the present application;

[0067] Figure 3 is a case topology structure schematic diagram in an embodiment of the present application;

[0068] Figure 4 is a case forwarding diagram schematic diagram in an embodiment of the present application;

[0069] Figure 5 is a reachable mapping table before and after case change in an embodiment of the present application. DETAILED DESCRIPTION

[0070] As shown in Figure 1 , the present application discloses an incremental analysis method for judging network asset mutual visit security, which comprises the following steps:

[0071] S1, judging whether it is the first execution: according to the basic configuration information (basic network configuration and network topology), it is judged whether there is a corresponding basic network forwarding graph model and a reachable mapping table, if there is, it jumps to S4, otherwise, S2 is executed.

[0072] S2, establishing a basic network forwarding graph model: obtaining the basic network configuration and the network topology, the network devices such as routers, switches and firewall devices in the network are traversed and modeled, and the network forwarding table (FIB) is calculated; then according to the network forwarding table of the network device, based on the longest prefix matching principle, the message space that each out interface can forward is calculated, and the message spaces with the same out interface are merged, representing all the message spaces that the out interface can forward, and finally, the basic network forwarding graph model is established according to the calculated message space.

[0073] The basic network forwarding graph model is based on a directed graph, the interface is a point, and the edge represents the topological connection and forwarding relationship between the interfaces, and the edge has a message space constraint, wherein the message space can be represented by (BDD, ddNF, Tenary Bits, equivalence class) and the like.

[0074] The message space refers to an abstract space for describing a set of network data messages, which includes one or more combinations of source address, destination address, source port number, destination port number and protocol type, and is used to represent the header field characteristics of the data messages transmitted in the network; the message space represents the forwarding behavior of the network device and the constraint conditions of the access control policy on the traffic through set operation.

[0075] S2.1, generating a network forwarding table.

[0076] Call network simulator, take the base network configuration and network topology as input, generate the network forwarding table (FIB) of all devices (routers, firewalls, etc.) in the network under each virtual routing environment (VRF / vsys).

[0077] Network device forwarding table (Forwarding Information Base, FIB): routers and switches are common network forwarding devices in the network, and their forwarding behavior is strictly limited by the forwarding information base (FIB; or forwarding table). The FIB consists of multiple forwarding table entries, each of which describes the destination network segment address and the outgoing interface. For a packet, the input destination IP address is determined by the longest prefix matching method to match the table entry, and then the packet is forwarded out of the interface. Assuming that the FIB only exists for the 10.0.0.0 / 24 table entry, the outgoing interface is eth0. If the destination address of the packet is 10.0.0.1, the packet will match this table entry and be forwarded out of eth1.

[0078] S2.2, in the process of constructing the base network forwarding graph model, the modeling operation of the router and switch devices in the network is as follows:

[0079] S2.2.1, analyze the network forwarding table of each VRF, and calculate the packet space that can be forwarded by each possible outgoing interface based on the longest prefix matching principle. Specifically, for all forwarding rules, sort them by prefix length, and the packet space that each forwarding rule can forward is the packet space represented by the rule minus the packet space represented by higher priority rules. In addition, the packet spaces with the same outgoing interface are merged to represent the entire packet space that the outgoing interface can forward.

[0080] VRF (Virtual Routing and Forwarding) virtual routing and forwarding, create multiple independent virtual routing tables on a physical device, which is equivalent to logically dividing a firewall into multiple "virtual firewalls", each with independent routing and interfaces, and do not interfere with each other.

[0081] S2.2.2, take all interfaces corresponding to the VRF as the incoming interface, take each interface used in the network forwarding table of the VRF as the outgoing interface, connect any one incoming interface to this outgoing interface, and the packet space constraint on this edge is the packet space calculated for the outgoing interface in the network forwarding table. If this outgoing interface has been calculated, take the union of the newly calculated packet space and the previously calculated packet space.

[0082] S2.2.3, if there is an out-interface for another VRF, re-execute S2.1.1; otherwise execute S2.2.2.

[0083] S2.3, in the process of constructing the basic forwarding graph model, the modeling operation inside the firewall device in the network is as follows:

[0084] S2.3.1, analyze the network forwarding table of each vsys, and calculate the message space that each possible out-interface can forward based on the longest prefix matching principle. Specifically, for all forwarding rules, sort them according to the prefix length, and the message space that each forwarding rule can forward is the message space represented by the rule minus the message space represented by the higher priority rule. In addition, the message spaces with the same out-interface are merged to represent the entire message space that the out-interface can forward.

[0085] Vsys (Virtual system) is another virtualization technology in the firewall, similar to VRF but more comprehensive, mainly used to realize completely independent virtual firewall instances.

[0086] S2.3.2, take all interfaces corresponding to the vsys as the in-interface, and take each interface used in the network forwarding table of the vsys as the out-interface. Connect any one in-interface to this out-interface, and the message space on this edge is calculated by the intersection of the network forwarding table and the Zone configuration in the vsys. The message space of the out-interface. If this out-interface has been calculated, take the union of the newly calculated message space and the previously calculated message space.

[0087] S2.3.3, if there is an out-interface for another vsys, re-execute S2.2.1; otherwise execute S2.4.

[0088] S2.4, in the process of constructing the basic network forwarding graph model, the modeling operation on the cross-device edge is as follows: for interfaces (intf1, intf2) belonging to different devices, the message space on the edge is the intersection of the ACL allowed message space in the out direction of intf1 and the ACL allowed message space in the in direction of intf2.

[0089] S2.5, in the process of constructing the basic network forwarding graph, create a reverse edge with the same message space for each edge while creating each edge, and construct a reverse basic forwarding graph.

[0090] S3: Establishing a reachable mapping table: for the basic network forwarding graph model, selecting each asset interface as a starting node to traverse, setting the initial message space as the full space, traversing all interfaces on the forwarding graph using a depth-first search (DFS) algorithm, calculating the reachable asset interface set of each starting node, and updating the reachable mapping table according to the reachable path to form the correspondence between the interface and the reachable asset interface pair.

[0091] S3.1, the specific operation of the depth-first search process is: taking any asset interface as a starting node, establishing a path stack for recording the interfaces and their message space information on the current traversal path. The starting node and its initial message space are stacked, and the current node is set as the starting node.

[0092] S3.1.1, first obtain all out-edge information of the current node in the forwarding graph, determine the next-hop node set of the current node according to the message space corresponding to each out-edge. For each next-hop node, perform the following operations:

[0093] Obtain the message space of the current node and the message space of the out-edge pointing to the current node, calculate the intersection of the two as the propagation message space of the next hop;

[0094] If the intersection is empty, skip the processing of this node;

[0095] If the intersection is not empty, continue to perform S3.1.2.

[0096] S3.1.2, judge whether the next-hop node is an asset interface:

[0097] If it is an asset interface and different from the starting node, it indicates that the asset interface is reachable from the starting node. At this time, a new or updated entry is added in the reachable mapping table, and all interfaces in the path stack are associated with the start and end asset interface pair, including the asset interface corresponding to the starting node and the target asset interface;

[0098] If the node is not an asset interface, continue to perform the recursive search process of S3.2.

[0099] S3.2, update the current message space to the intersection of the existing message space and the out-edge message space, and take the next-hop node as the new current node to recursively perform the depth-first search process.

[0100] S3.3, when all next-hop nodes of the current node are traversed, remove the node from the path stack to realize the backtracking of the depth-first search, and continue to process other unvisited branches of the previous node.

[0101] S3.4, after the depth-first search of all asset interfaces is completed, an initial reachable mapping table is formed. If multiple reachable asset interface pairs have the same source asset interface, these target asset interfaces can be merged into a target asset set to simplify the mapping table structure.

[0102] S4, a pre-change network forwarding graph model is established and interfaces with changed forwarding behaviors are found.

[0103] According to the pre-change configuration information, a new network configuration and a network topology are generated, and S2 is re-executed according to the new network configuration and the network topology to generate a pre-change network forwarding graph model and a reverse pre-change network forwarding graph model.

[0104] For each interface (point) on the pre-change network forwarding graph model, the corresponding interface (point) on the basic network forwarding graph model is compared: if the interface only exists on the pre-change network forwarding graph model, the interface is marked as a new interface; if the interface only exists on the basic network forwarding graph model, the interface is marked as a deleted interface; if the interface exists on both the pre-change network forwarding graph model and the basic network forwarding graph model, all edges of the interface as a starting point are compared, and the message space of the corresponding edge on the pre-change network forwarding graph model and the basic network forwarding graph model is compared. If there is a difference, the interface is marked as a changed interface (i.e., the forwarding behavior has changed).

[0105] S5, a change set in which the asset interface pair visiting relationship may change is constructed.

[0106] For the changed interface and the deleted interface, the reachable asset interface pair corresponding to the current interface in the reachable mapping table is searched and added to the change set. The reachable asset interface pair includes a source asset interface and a target asset interface.

[0107] For the new interface, based on the reverse pre-change network forwarding graph model, for each interface with changed forwarding behavior, the following operations are performed: starting from the new interface, performing the depth-first search algorithm described in S3.1 to S3.4 on the reverse pre-change forwarding graph to calculate all reachable source asset interface sets, and adding the source asset interface sets to the change set.

[0108] S6, the corresponding network asset visiting relationship in the change set is recalculated and a new reachable relationship and message space are generated.

[0109] For each source asset interface in the change set determined in S5, a depth-first search algorithm is used to obtain a new reachable asset interface pair and path information, which is superimposed with the original reachable asset interface pair and path information to obtain a new reachable relationship and message space.

[0110] S7, the security of the new network asset visiting relationship is checked.

[0111] The new reachable relationship and the asset interface connectivity information in the message space are compared with the user security configuration policy, and it is confirmed that the connectivity between the asset interfaces meets the security requirements such as business isolation. If the security requirements are met, the pre-change configuration and the device are issued, the pre-change network forwarding graph model is updated to the latest basic network forwarding graph model, and the reachable mapping table is updated according to the new reachable relationship and the message space; if not, an alarm is issued.

[0112] As shown in Figure 2 The application further discloses an incremental analysis system for judging network asset intercommunication security, which comprises a judgment module, a forwarding graph construction module, a reachability analysis and mapping module, an incremental change analysis module, and an influence evaluation and policy verification module.

[0113] The judgment module is used to judge whether it is the first execution or not: according to the basic configuration information (basic network configuration and network topology), it is judged whether the corresponding basic network forwarding graph model and the reachable mapping table exist or not.

[0114] The forwarding graph construction module is connected with the judgment module. When the judgment module judges that this is the first execution, the forwarding graph construction module calculates the network forwarding table according to the basic network configuration and the network topology, and establishes the basic network forwarding graph model; when the judgment module judges that this is not the first execution, the forwarding graph construction module generates new network configuration and network topology according to the pre-change configuration information, calculates the new network forwarding table, and establishes the pre-change network forwarding graph model and the reverse pre-change network forwarding graph model.

[0115] The reachability analysis and mapping module is connected with the forwarding graph construction module. The reachability analysis and mapping module selects each asset interface as a starting node for traversal according to the basic network forwarding graph model, sets the initial message space as the full space, uses the depth-first search algorithm to traverse all interfaces in the basic network forwarding graph model, calculates the reachable asset interface set of each starting node, and updates the reachable mapping table according to the reachable path, to form the corresponding relationship between the interface and the reachable asset interface pair.

[0116] The incremental change analysis module is connected with the forwarding graph construction module. The incremental change analysis module determines the interfaces whose forwarding behaviors change according to the pre-change network forwarding graph model and the basic network forwarding graph model, and constructs a change set in which the intercommunication relationship of the asset interface pair may change; then, the depth-first search algorithm is used for each source asset interface in the change set to obtain new reachable asset interface pairs and path information; the new reachable asset interface pairs and path information are superimposed with the original reachable asset interface pairs and path information to obtain new reachable relationship and message space.

[0117] The interface whose forwarding behavior changes is determined as follows: for each interface on the pre-change network forwarding graph model, the corresponding interface on the base network forwarding graph model is compared: if the interface exists only on the pre-change network forwarding graph model, the interface is marked as an added interface; if the interface exists only on the base network forwarding graph model, the interface is marked as a deleted interface; if the interface exists on both the pre-change network forwarding graph model and the base network forwarding graph model, all edges with the interface as a starting point are compared, and the message spaces of the corresponding edges on the pre-change network forwarding graph model and the base network forwarding graph model are compared; if there is a difference, the interface is marked as a changed interface (i.e., the forwarding behavior changes).

[0118] The change set in which the inter-visit relationship of the asset interface may change is constructed as follows:

[0119] For the changed interface and the deleted interface, the reachable asset interface pair corresponding to the current interface is searched in the reachable mapping table and added to the change set. The reachable asset interface pair includes a source asset interface and a target asset interface.

[0120] For the added interface, the following operations are performed on each interface whose forwarding behavior changes based on the reverse pre-change network forwarding graph model: starting from the added interface, a depth-first search algorithm is performed on the reverse pre-change forwarding graph model to calculate a set of all reachable source asset interfaces, and the set of source asset interfaces is added to the change set.

[0121] The influence evaluation and policy verification module is connected to the incremental analysis module, the influence evaluation and policy verification module compares the connectivity between the asset interfaces in the new reachable relationship and the message space with the user security configuration policy to confirm that the connectivity between the asset interfaces meets the business isolation and other security requirements. If the security requirements are met, the pre-change configuration and the device are issued, the pre-change network forwarding graph model is updated to the latest base network forwarding graph model, and the reachable mapping table is updated according to the new reachable relationship and the message space. If the security requirements are not met, an alarm is issued.

[0122] The present application realizes an incremental computing mechanism based on the reachable mapping table and reverse traversal, avoids full-network path recalculation, and reduces the verification complexity from O (N2) to O (M) (N is the network size and M is the change-related asset quantity), improves the verification real-time performance in a dynamic scenario, and realizes the improvement of the incremental asset interface inter-visit relationship calculation efficiency in the network configuration change scenario.

[0123] The present application also provides a computer readable medium, which can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device.

[0124] The computer readable medium described above carries one or more programs, which when executed by the electronic device, cause the electronic device to implement the methods described in the above embodiments.

[0125] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, such a division is not mandatory. Indeed, according to an embodiment of the disclosure, the features and functionalities of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functionalities of one module or unit described above can be further divided into embodied by multiple modules or units.

[0126] Now the present invention is illustrated by the following enumerated embodiments:

[0127] First, the embodiment contains a network topology structure as shown in Figure 3 :

[0128] The core of the topology structure is a firewall (FW), which is internally divided into two virtual systems sys1 and vsys2, each having an independent FIB. The interface eth0 of the firewall is connected to the Internet and belongs to zone1 (untrust), while eth1 and eth2 are connected to the subsequent router and both belong to zone2 (trust). The zone policy of the firewall clearly stipulates that the traffic from zone1 to zone2 and from zone2 to untrust (zone1) is allowed to pass. Specifically, the FIB configuration of vsys1 enables it to forward the 10.0.0.0 / 24 packet to eth0, and forward the 10.0.1.0 / 24 and 10.0.2.0 / 24 packets to vsys2. The FIB of vsys2 forwards the 10.0.0.0 / 24 packet to vsys1, the 10.0.1.0 / 24 packet to eth1, and the 10.0.2.0 / 24 packet to eth2.

[0129] The eth1 interface of the firewall is further connected to the eth0 interface of the router R1, and the eth1 interface of the router R1 is connected to the host 1 (10.0.1.1). The FIB of the router R1 is configured to forward the message of 10.0.0.0 / 24 to the eth0 and forward the message of 10.0.1.0 / 24 to the eth1. Meanwhile, the eth2 interface of the firewall is connected to the eth0 interface of the router R2, and the eth1 interface of the router R2 is connected to the host 2 (10.0.2.1). The FIB of the router R2 is configured to forward the message of 10.0.0.0 / 24 to the eth0 and forward the message of 10.0.2.0 / 24 to the eth1. Meanwhile, an ACL rule is configured on the eth1 interfaces of R1 and R2, which allows only the traffic with the destination port of 80 to flow to the host 1 and the host 2.

[0130] According to the above information, the current configuration is modeled according to the S1-S2 steps and the deep search process of S3 described in the application:

[0131] Firstly, the network simulator is invoked to generate the FIB of all devices based on the routing protocol configuration (even static routing in this example) and topology of each device. Then the network topology is modeled, and the forwarding interfaces of the firewall (FW), the routers R1 and R2 are taken as the nodes of the directed graph, as shown in the following figure: Figure 3 Based on the FIB in the VRF / vsys of each device and the longest prefix matching principle, the message space that can be forwarded by each outgoing interface is calculated. For example, in the vsys1 of the FW, the outgoing interface for the message with the destination address of 10.0.1.0 / 24 is vsys2; in the vsys2 of the FW, the outgoing interface for the message with the destination address of 10.0.1.0 / 24 is eth1. Similarly, the FIB of R1 makes the message with the destination address of 10.0.1.0 / 24 be forwarded through the eth1 interface of R1. In addition, since there are ACL rules on the eth1 interface of R1 and the eth1 interface of R2, these rules will be taken as additional forwarding constraints to further limit the message space through these interfaces, i.e. only the message with the destination port of 80 is allowed to pass. At the same time, considering the zone-to-zone policy of the firewall, the message needs to be subject to the corresponding policy constraints when crossing between different zones. These forwarding constraints are abstracted as attributes on the edges to build an end-to-end basic forwarding graph model. The reachability information of the asset interface pairs in the whole network is obtained by traversing the whole basic forwarding graph through DFS, and the association relationship between the forwarding interfaces and these reachable asset interface pairs is established.

[0132] For example, in a process of DFS traversal in the created base forwarding graph model, the system starts from the source node Internet, exploring the packet header space as { *}. First, from the Internet node, the traffic enters the eth0 interface of the firewall FW (belongs to zone1). According to the FIB rule of FW-vsys1, when the destination address of the packet matches 10.0.1.0 / 24, it is identified that the out interface is vsys2. At this time, the packet header space is narrowed from { *} to { DstIP: 10.0.1.0 / 2}, and the DFS is transferred from the FW-eth0 node to the FW-vsys2 node. Next, according to the FIB of vsys2, the packet with the destination address of 10.0.1.0 / 24 is transferred out from the eth1 interface. In this process, the system checks the security policy from zone1 to zone2 to confirm that the traffic of the narrowed DstIP is allowed to pass. Subsequently, the traffic reaches the eth0 interface of R1, and R1 transfers the packet from the eth1 interface according to the FIB, and finally reaches host1 (10.0.1.1). At the eth1 interface of R1, the system further checks the ACL rule on the interface. Since the ACL only allows traffic with the destination port of 80 to pass, the packet header space will be narrowed again to { DstIP: 10.0.1.0 / 24, DstPort: 80}. In the entire DFS traversal process, the system records the sequence of the passed forwarding interfaces (such as Internet -> FW-eth0 -> FW-vsys2 -> FW-eth1 -> R1-eth0 -> R1-eth1 -> host1), and updates the packet header space in real time as it is constrained by each hop forwarding. In this way, the system can completely establish the forwarding path from Internet to host1, and associate the corresponding final packet header space (in this example, { DstIP: 10.0.1.0 / 24} ), thereby determining the reachability from Internet to host1. The reachability information is recorded at the same time, and the system adds the association between the specific forwarding path and the forwarding interfaces involved (such as FW-eth0, FW-vsys2, FW-eth1, R1-eth0, R1-eth1, etc.) and the asset interface of "Internet to host1" to the reachability mapping table.

[0133] After the base forwarding graph modeling and the mapping table initialization are completed, the configuration is changed as follows: a new security policy is added on the firewall, which specifies that all traffic from ZONE1 to ZONE2 with the destination address of 10.0.1.0 / 24 is denied.

[0134] Then, we perform incremental updates according to the S4-S6 steps described in the patent:

[0135] First, the forwarding graph is updated based on the incremental configuration. The system first compares the forwarding graph before and after the change, and identifies the edges in the message space that have changed. In this example, since the ZONE1 to ZONE2, deny policy for destination address 10.0.1.0 / 24 is added on the firewall, the direct impact is the forwarding path from vsys1 to vsys2 inside the firewall, which is blocked for the message space with destination address 10.0.1.0 / 24. Next, the system uses the mechanism described in S5 to locate the affected asset interface pair:

[0136] Since the forwarding path from vsys1 to vsys2 inside the firewall is identified as the interface where the forwarding behavior has changed, the system uses this interface as an index to directly query the reachability mapping table, returning the set of asset interfaces that passed through this path before the change {(Internet, host1)}.

[0137] Through this direct query based on the mapping table, the system can quickly and accurately locate all possible affected asset interface pairs without additional traversal in the graph. For example, since the path from Internet to host2 does not pass through this change point, the pair (Internet, host2) will not appear in the mapping table entry of this interface, and thus is naturally excluded from the recalculation range, avoiding unnecessary calculations.

[0138] For the set of asset interfaces that may be affected, the system will use the traversal mechanism in S5 to recalculate their reachability on the forwarding graph after the change from the changed interface.

[0139] Finally, by comparing the results of the two calculations, the set of asset interfaces whose reachability has indeed changed is clearly marked, for example, the reachability of Internet to host1 will change from reachable to unreachable, and the network's reachable asset interface pairs and path information in the reachability mapping table are updated accordingly.

[0140] Finally, the system compares the calculated new connectivity information with the current user security policy to confirm whether the current connectivity state is safe.

[0141] Those skilled in the art can easily understand, through the above description of the embodiments, that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to perform the methods according to the embodiments of the present disclosure.

[0142] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the present disclosure cover any and all variations of the present disclosure that come within the scope of the following claims and their equivalents. It is intended that the present disclosure include all modifications and alterations from this disclosure.

[0143] It should be understood that the present disclosure is not limited to the precise structures as herein described and illustrated in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of this present disclosure. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for judging the security of network asset mutual visit, characterized in that, The method comprises the following steps: S1, judging whether it is the first execution: according to the basic network configuration and network topology, it is judged whether there is a corresponding basic network forwarding graph model and a reachability mapping table, if yes, jumping to S4, otherwise, executing S2; S2, establishing a basic network forwarding graph model: obtaining the basic network configuration and network topology, calculating the network forwarding table, and establishing the basic network forwarding graph model; S3, establishing a reachability mapping table: selecting each asset interface as a starting node to traverse the basic network forwarding graph model, setting the initial message space as the full space, traversing all interfaces on the forwarding graph using a depth-first search algorithm, calculating the reachability asset interface set of each starting node, and updating the reachability mapping table according to the reachable path to form the corresponding relationship between the interface and the reachable asset interface pair; S4, establishing a pre-change network forwarding graph model and finding the interface whose forwarding behavior changes; According to the pre-change configuration information, a new network configuration and network topology are generated, and S2 is re-executed according to the new network configuration and network topology to generate a pre-change network forwarding graph model and a reverse pre-change network forwarding graph model; Then, the interface whose forwarding behavior changes is determined according to the pre-change network forwarding graph model and the basic network forwarding graph model; S5, constructing a change set in which the visiting relationship between the asset interfaces may change; For the changed interface and the deleted interface, the reachable asset interface pair corresponding to the current interface in the reachability mapping table is searched and added to the change set; For the added interface, for each interface whose forwarding behavior changes, the following operations are performed: starting from the added interface, performing a depth-first search algorithm on the reverse pre-change forwarding graph to calculate all reachable source asset interface sets, and adding the source asset interface sets to the change set; S6, recalculating the corresponding network asset visiting relationship in the change set and generating a new reachability relationship and message space; For each source asset interface in the change set determined in S5, a depth-first search algorithm is used to obtain a new reachable asset interface pair and path information, which is superimposed with the original reachable asset interface pair and path information to obtain a new reachability relationship and message space; S7, checking the security of the new network asset visiting relationship; The asset interface connectivity information in the new reachability relationship and message space is compared with the user security configuration policy to confirm that the connectivity between the asset interfaces meets the security requirements; if the security requirements are met, the pre-change configuration is issued, the pre-change network forwarding graph model is updated to the latest basic network forwarding graph model, and the reachability mapping table is updated according to the new reachability relationship and message space; if not, an alarm is issued.

2. The incremental analysis method for judging the security of network asset mutual visit according to claim 1, characterized in that, In S2, according to the network forwarding table of the network device, the message space that can be forwarded by each out-interface is calculated based on the longest prefix matching principle, and the message spaces of the out-interfaces are merged to represent the entire message space that can be forwarded by the out-interface. Finally, the basic network forwarding graph model is established according to the calculated message space. The basic network forwarding graph model is based on a directed graph, interfaces are points, and edges represent topological connections and forwarding relationships between interfaces, and the edges have message space constraints.

3. The incremental analysis method for judging the security of network asset mutual visit according to claim 1, characterized in that, The S2 is specifically as follows: S2.1, generating a network forwarding table; Calling a network simulator, taking the basic network configuration and network topology as input, generating a network forwarding table of all devices in the network in each virtual routing environment; S2.2, in the construction process of the basic network forwarding graph model, the modeling operation in the router and switch device in the network is as follows: S2.2.1, analyzing the network forwarding table of each VRF, based on the longest prefix matching principle, calculating the message space that each possible out-interface can forward; S2.2.2, taking all interfaces corresponding to the VRF as the in-interface, taking each interface used in the network forwarding table of the VRF as the out-interface, connecting any one in-interface to this out-interface, and the message space constraint on this edge is the message space calculated in the network forwarding table for this out-interface; if this out-interface has been calculated, take the union of the newly calculated message space and the previously calculated message space; S2.2.3, if there is an out-interface for another VRF, re-execute S2.1.1; otherwise, execute 2.3; S2.3, in the construction process of the basic forwarding graph model, the modeling operation in the firewall device in the network is as follows: S2.3.1, analyzing the network forwarding table of each vsys, based on the longest prefix matching principle, calculating the message space that each possible out-interface can forward; S2.3.2, taking all interfaces corresponding to the vsys as the in-interface, taking each interface used in the network forwarding table of the vsys as the out-interface, connecting any one in-interface to this out-interface, and the message space constraint on this edge is the message space calculated in the network forwarding table for this out-interface; if this out-interface has been calculated, take the union of the newly calculated message space and the previously calculated message space; S2.3.3, if there is an out-interface for another vsys, re-execute S2.3.1; otherwise, execute S2.4; S2.4, in the construction process of the basic network forwarding graph model, the modeling operation for the cross-device edge is as follows: for interfaces (intf1, intf2) belonging to different devices, the message space on the edge is the intersection of the ACL allowed message space in the out direction of intf1 and the ACL allowed message space in the in direction of intf2; S2.5, in the construction process of the basic network forwarding graph, create each edge at the same time, create a reverse edge with the same message space for each edge, and construct a reverse basic forwarding graph.

4. The incremental analysis method for judging the security of network asset mutual visit according to claim 1, characterized in that, The S3 is specifically as follows: S3.1, the specific operation of the depth-first search process is: taking any asset interface as the starting node, establishing a path stack for recording the interfaces and their message space information on the current traversal path, stacking the starting node and its initial message space, and setting the current node as the starting node; S3.1.1, first acquire all the out-edge information of the current node in the forwarding graph, determine the next-hop node set of the current node according to the message space corresponding to each out-edge; for each next-hop node, the following operations are performed: acquire the message space of the current node and the message space pointing to the out-edge of the current node, calculate the intersection of the two as the propagation message space of the next-hop; if the intersection is empty, skip the processing of the node; if the intersection is not empty, continue to perform S3.1.2; S3.1.2, judge whether the next-hop node is an asset interface: if it is an asset interface and different from the starting node, it indicates that the asset interface is reachable from the starting node; at this time, a corresponding entry is added or updated in the reachable mapping table, and all interfaces in the path stack are associated with the start-end asset interface pair; if the node is not an asset interface, continue to perform the recursive search process of S3.2; S3.2, update the current message space to the intersection of the existing message space and the out-edge message space, and take the next-hop node as the new current node to recursively perform the depth-first search process; S3.3, when all next-hop nodes of the current node are traversed, remove the node from the path stack to realize the backtracking of the depth-first search, and continue to process other unvisited branches of the previous node; S3.4, after completing the depth-first traversal of all asset interfaces, an initial reachable mapping table is formed; if multiple reachable asset interface pairs have the same source asset interface, merge these target asset interfaces into a target asset set.

5. The incremental analysis method for judging the security of network asset mutual visit according to claim 1, characterized in that, The interface whose forwarding behavior changes is found as follows: For each interface on the pre-change network forwarding graph model, compare it with the corresponding interface on the basic network forwarding graph model: if the interface only exists on the pre-change network forwarding graph model, mark the interface as a new interface; if the interface only exists on the basic network forwarding graph model, mark the interface as a deleted interface; if the interface exists on both the pre-change network forwarding graph model and the basic network forwarding graph model, compare all edges with the interface as the starting point, and compare the message spaces of the corresponding edges on the pre-change network forwarding graph model and the basic network forwarding graph model. If there is a difference, mark the interface as a changed interface.

6. A system for judging the security of network asset mutual visit, characterized in that, It includes a judgment module, a forwarding graph construction module, a reachability analysis and mapping module, an incremental change analysis module, an influence evaluation and strategy verification module; The judgment module is used to judge whether it is the first execution: according to the basic network configuration and network topology, it is judged whether there is a corresponding basic network forwarding graph model and reachable mapping table; The forwarding graph construction module is connected with the judgment module, when the judgment module judges that this time is the first execution, the forwarding graph construction module calculates the network forwarding table according to the basic network configuration and network topology, and establishes the basic network forwarding graph model; When the judgment module judges that this time is not the first execution, the forwarding graph construction module generates a new network configuration and network topology according to the pre-change configuration information, calculates a new network forwarding table, and establishes a pre-change network forwarding graph model and a reverse pre-change network forwarding graph model; The reachability analysis and mapping module is connected to the forwarding graph construction module, the reachability analysis and mapping module selects each asset interface as a starting node to traverse, sets an initial message space as a full space, traverses all interfaces by using a depth-first search algorithm on the basis network forwarding graph model, calculates a set of reachable asset interfaces of each starting node, and updates a reachability mapping table according to a reachable path, to form a corresponding relationship between an interface and a reachable asset interface pair; The incremental change analysis module is connected to the forwarding graph construction module, the incremental change analysis module determines interfaces whose forwarding behaviors change according to the pre-change network forwarding graph model and the basis network forwarding graph model, and constructs a change set in which a mutual visiting relationship of an asset interface pair may change, then uses a depth-first search algorithm on each source asset interface in the change set to obtain new reachable asset interface pairs and path information, and superimposes the new reachable asset interface pairs and path information on original reachable asset interface pairs and path information to obtain new reachability and a message space; The influence evaluation and strategy verification module is connected to the incremental analysis module, the influence evaluation and strategy verification module compares asset interface connectivity information in the new reachability and message space with a user security configuration strategy to confirm that connectivity between asset interfaces meets security requirements; If the security requirements are met, a pre-change configuration is issued to update the pre-change network forwarding graph model to the latest basis network forwarding graph model, and the reachability mapping table is updated according to the new reachability and message space, and if the security requirements are not met, an alarm is issued.

7. The incremental analysis system for judging the security of network asset inter-visit according to claim 6, characterized in that, The incremental change analysis module determines interfaces whose forwarding behaviors change as follows: for each interface on the pre-change network forwarding graph model, the interface is compared with a corresponding interface on the basis network forwarding graph model, if the interface exists only on the pre-change network forwarding graph model, the interface is marked as a new interface, if the interface exists only on the basis network forwarding graph model, the interface is marked as a deleted interface, and if the interface exists on both the pre-change network forwarding graph model and the basis network forwarding graph model, all edges of the interface as a starting point are compared, and message spaces of corresponding edges on the pre-change network forwarding graph model and the basis network forwarding graph model are compared, if there is a difference, the interface is marked as a changed interface.

8. The incremental analysis system for judging the security of network asset inter-visit according to claim 6, wherein, The incremental change analysis module constructs a change set in which a mutual visiting relationship of an asset interface pair may change as follows: For a changed interface and a deleted interface, a set of reachable asset interfaces corresponding to the current interface is searched in a reachability mapping table and added to the change set; For a new interface, the following operations are performed on each interface whose forwarding behavior changes based on a reverse pre-change network forwarding graph model: starting from the new interface, a depth-first search algorithm is performed on the reverse pre-change forwarding graph model to calculate a set of all reachable source asset interfaces, and the set of all reachable source asset interfaces is added to the change set.

9. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the steps of the incremental analysis method for judging network asset mutual visiting security according to any one of claims 1-5.

Images