A security policy tree construction method and device, a storage medium and a computing device

Abstract

This application provides a method, apparatus, storage medium, and computing device for constructing a security policy tree. It employs a two-stage bit selection mechanism: in the coarse selection stage, the partitioning performance of each candidate bit is evaluated by calculating policy similarity and difference parameters, and high-quality candidate bits are selected; in the fine selection stage, candidate bit combinations are generated by dynamically adjusting the combination upper limit through sequential or full combination, and the optimal target bit combination is selected based on partitioning cost, maximizing the effective partitioning of node policies. By reasonably setting the leaf node policy threshold, multiple policy trees with controllable depth are constructed, ensuring that the vast majority of policies are concentrated in the preorder tree, reducing the total number of trees. During matching, the target bits stored in the node are used to quickly locate the leaf node, requiring only a linear search of a small number of policies to complete the matching, significantly reducing traversal and search latency and improving matching performance in large-scale dynamic policy scenarios.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, apparatus, storage medium, and computing device for constructing a security policy tree. Background Technology

[0002] In multi-tenant cloud computing scenarios, firewall security policies are increasingly numbering in the millions. Constructing security policy trees can improve the efficiency of matching these policies. When building multiple security policy trees, the way the security policies are partitioned determines the depth of the tree, and the depth of the tree affects the matching performance. Therefore, the way the security policies are partitioned plays a crucial role in the matching performance of the security policy tree.

[0003] However, the current method of dividing security policies suffers from an imbalance in the division of security policies, which affects the depth and rationality of the constructed security policy tree, thereby reducing the matching performance of the security policy tree, and the drawbacks are obvious. Summary of the Invention

[0004] In view of this, this application provides a security policy tree construction method, apparatus, storage medium and computing device to construct a security policy tree with reasonable depth through a balanced security policy partitioning method, thereby significantly improving the matching performance of the security policy tree.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] In a first aspect, embodiments of this application provide a method for constructing a security policy tree, including:

[0007] For the current node in the currently constructed security policy tree, determine whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node.

[0008] If not, then from multiple preset bits, at least one bit to be selected is determined based on the selected bits of the parent nodes that have been built at each level in the security policy tree for the current node;

[0009] Based on the bit value of each security policy to be assigned under each selectable bit, determine the number of policies for each selectable bit under different bit values;

[0010] Based on the number of policies, the number of targets, and the current depth of the security policy tree, the target bit selected by the current node is determined from each of the bits to be selected, and each child node corresponding to the current node is constructed according to the number of target bits.

[0011] Based on the bit value of each security policy to be assigned under each target bit, determine the security policy to be assigned for each child node;

[0012] Return to the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until all leaf nodes of the security policy tree are constructed.

[0013] Secondly, embodiments of this application also provide a security policy tree construction apparatus, comprising:

[0014] The first determining module is used to determine whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node in the currently constructed security policy tree.

[0015] The filtering module is used to determine at least one bit to be selected from multiple preset bits, based on the selected bits of the parent nodes built at each level of the current node in the security policy tree;

[0016] The second determining module is used to determine the number of policies for each selected bit under different bit values ​​based on the bit value of each security policy to be assigned under each selected bit.

[0017] The construction module is used to determine the target bit selected by the current node from the various bits to be selected based on the number of policies, the number of targets, and the current depth of the security policy tree, and to construct each child node corresponding to the current node based on the number of target bits.

[0018] The third determining module is used to determine the security policy to be assigned to each child node based on the bit value of each security policy to be assigned under each target bit.

[0019] The loop module is used to return the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until all leaf nodes of the security policy tree are constructed.

[0020] Thirdly, an optional implementation of this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the first aspect above, or any possible implementation of the first aspect.

[0021] Fourthly, an optional implementation of this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps as described in the first aspect above, or any possible implementation of the first aspect.

[0022] The security policy tree construction method, apparatus, storage medium, and computing device provided in this application, during the construction of child nodes of the current node, restrict the selectable bits of the current node based on the selected bits of the parent nodes at each level. This avoids computational redundancy and incomplete policy partitioning caused by parent and child nodes selecting the same bits for node construction. Selecting target bits based on the number of policies under different bit values ​​of the selectable bits fully considers the impact of various values ​​on security policy replication, thereby selecting target bits suitable for the current node. Then, constructing each child node corresponding to the current node based on the target bits and partitioning the security policies to be allocated based on the bit values ​​of the security policies under the target bits, achieves the goal of partitioning as many security policies as possible into a single security policy tree while ensuring that the security policies are partitioned into as many child nodes as possible within that single security policy tree. This reduces the depth of the single security policy tree while minimizing the number of security policy trees constructed. Furthermore, by using as few security policy trees as possible, the number of security policy trees that need to be traversed during matching can be reduced, improving matching speed. By reducing the depth of a single security policy tree and increasing the number of leaf nodes, the traversal time of a single security policy tree and the matching overhead within leaf nodes can be reduced when using the security policy tree for matching, thereby further improving the matching speed. Thus, this application, by optimizing bit selection during node splitting to improve the quality of security policy partitioning and reduce security policy redundancy, can significantly improve the rationality of security policy tree construction and overall matching performance while ensuring no policy duplication.

[0023] For a description of the effects of the aforementioned security policy tree construction apparatus, computer-readable storage medium, and computer device, please refer to the description of the security policy tree construction method above; it will not be repeated here.

[0024] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a security policy tree construction method according to an exemplary embodiment of this application;

[0026] Figure 2This is a schematic diagram illustrating a specific process of security policy matching according to an exemplary embodiment of this application;

[0027] Figure 3 This is a schematic diagram of a security policy tree construction apparatus shown in an exemplary embodiment of this application;

[0028] Figure 4 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of this application. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0031] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0032] Research has revealed that in multi-tenant cloud computing scenarios where firewall security policies are applied, the number of firewall security policies has surged from tens of thousands to hundreds of thousands or even millions as the tenant base continues to expand. This presents unprecedented challenges to security policy matching performance. When constructing multiple security policy trees, the quality of the security policy partitioning method directly determines the depth of the final generated security policy tree, which in turn directly affects the number of nodes required to traverse during packet matching. Therefore, the security policy partitioning method plays a decisive role in the matching performance of the security policy tree. It is known that distributing security policies across as many child nodes as possible minimizes the depth of the security policy tree; distributing security policies across as many child nodes as possible within a single security policy tree minimizes the number of security policy trees. At the same threshold for the number of security policies per leaf node, fewer security policy trees and lower security policy node heights result in higher performance during security policy matching. By constructing a security policy tree using a multi-bit selection method, the security policies in the tree nodes can be divided into multiple child nodes at once, thereby effectively reducing the height of the security policy tree and providing a new technical approach for efficient partitioning of security policies and improving the matching performance of the security policy tree.

[0033] Existing multi-bit selection-based partitioning methods, when constructing the security policy tree, mostly focus on analyzing the cases where the bit value is 0 or 1, while ignoring the cases where the bit value is "". The impact of any value (i.e., 0 or 1) on security policy partitioning. This oversight leads to a large number of security policy copies or delays during the partitioning process, increasing the number and depth of the security policy tree and affecting matching efficiency. For example, while using continuous or discrete multi-bit selection, combined with heuristic or greedy methods to optimize bit selection can optimize security policy partitioning to some extent, existing multi-bit selection methods either fail to consider the bit value as "0 or 1" or are therefore problematic. The problem of uneven distribution of security policies in the security policy tree leads to an imbalance in the distribution of security policies, which affects the matching performance of the constructed security policy tree. Alternatively, the computational complexity of using a greedy method for multi-bit selection is too high, making it difficult to apply to online processing scenarios and preventing the security policies from taking effect quickly. Furthermore, the matching performance of the constructed security policy tree has room for optimization.

[0034] Based on the above research, this application proposes a security policy tree construction method based on two-stage discrete multi-bit selection. It includes two core stages: "coarse selection" and "fine selection" to determine the basis for splitting tree nodes. Under the condition that security policies are not copied, it performs multi-security policy tree construction and message matching. In the coarse selection stage, the selection criteria are determined by statistically analyzing the values ​​of each bit to be selected when they are 0, 1, or "0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1 ... The system calculates the number of security policies under the current security policy tree and comprehensively evaluates the balance and clarity of each candidate bit for security policy partitioning. It then selects a target bit set that promotes a balanced distribution of security policies and is ideally placed within the current security policy tree. During the selection phase, the upper limit of candidate bit combinations is dynamically adjusted based on the number of security policies corresponding to the current tree node or the tree depth. A pre-set upper limit determines the generation strategy of sequential or full combination. Based on the selected generation strategy, candidate bit combinations are obtained, and the partitioning cost of using these combinations for security policy partitioning is evaluated. The optimal bit combination is then selected from the candidate combinations to achieve the best partitioning effect for the security policies to be assigned to the current node. When constructing the security policy tree, a reasonable number of security policies for each leaf node is configured according to the application requirements of the security policies. The threshold mechanism enables the construction of multiple security policy trees with controllable depth and balanced policy distribution without policy replication. This effectively retains the vast majority of security policies within the pre-built security policy trees, significantly reducing the overall number and depth of security policy trees. During packet matching, the "fast filtering" function, utilizing the target bit set stored in each tree node, allows for precise and rapid location of potential matching child nodes without traversing all security policies in the entire security policy tree. This continues until the target leaf node is reached, ultimately requiring only a linear search of a small number of security policies within the target leaf node to complete the match. This reduces invalid traversals and matches, significantly lowering the latency of security policy tree traversal and leaf node search, resulting in a substantial improvement in matching performance in highly dynamic, large-scale security policy scenarios.

[0035] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this application below should be considered as the inventor's contributions to this application.

[0036] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0037] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0038] To facilitate understanding of this embodiment, a detailed description of the security policy tree construction method disclosed in this application embodiment will be provided first. The execution subject of the security policy partitioning method provided in this application embodiment is generally a terminal device or other processing device with certain computing capabilities. The terminal device can be a user equipment (UE), mobile device, user terminal, terminal, personal digital assistant device (PDA), handheld device, computer device, etc. In some possible implementations, the security policy tree construction method can be implemented by the processor calling computer-readable instructions stored in the memory.

[0039] The following describes the security policy tree construction method provided in this application embodiment, taking a cloud computing server as the execution subject as an example.

[0040] like Figure 1 The flowchart shown is a security policy tree construction method provided in an embodiment of this application, which may include the following steps:

[0041] S101: For the current node of the currently constructed security policy tree, determine whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node.

[0042] Here, the security policy tree construction method provided in this application embodiment is applicable to application scenarios that construct security policy trees corresponding to firewall security policy sets and have high requirements for the matching performance of security policy trees. It improves construction efficiency and enhances the rationality of the number, depth, structure, and matching performance of the constructed security policy trees. Furthermore, the improvement in construction efficiency and effectiveness increases with the size of the security policy set. Therefore, the security policy tree construction method provided in this application embodiment is particularly suitable for application scenarios that require the division of large-scale, dynamic security policy sets when constructing security policy trees. Examples include security policy tree construction in multi-tenant cloud computing scenarios and security policy tree construction in complex network environments.

[0043] The security policy tree currently constructed can be a multi-branch tree. The number of security policy trees can be one or more; this application does not limit the number of security policy trees. However, it should be noted that, based on the security policy tree construction method provided in this application embodiment, when dividing a certain number of security policies to be assigned and constructing a security policy tree, the number of security policy trees constructed will be minimized. Any security policy tree can be constructed according to the method provided in this application embodiment. The security policies corresponding to each security policy tree can be a set of security policies stored in the leaf nodes of that security policy tree. There is no policy duplication between the security policies corresponding to different security policy trees; that is, the security policies corresponding to different security policy trees are different. The security policies to be assigned corresponding to a security policy tree are the security policies that need to be divided into the leaf nodes of the security policy tree for storage. However, it should be noted that the number of security policies to be assigned to a security policy tree is not necessarily equal to the number of security policies ultimately divided in that security policy tree. As the partitioning process progresses, some security policies awaiting assignment in a security policy tree may be removed. These removed policies will then become the security policies for the next security policy tree to be built. The number of security policies awaiting assignment in different security policy trees can vary. As the number of already built security policy trees increases, the number of security policies awaiting assignment in the new security policy trees that need to be built will decrease. In a security policy tree, only leaf nodes are used to store security policies; other tree nodes do not store any security policies.

[0044] The current node is the tree node being processed in the node loop construction process of the security policy tree. This tree node can be a leaf node or a non-leaf node. When constructing the security policy tree, it can be built layer by layer starting from the root node. The security policies to be assigned corresponding to the root node represent all the security policies to be assigned in the security policy tree. A leaf node is a tree node in the security policy tree that has no child nodes; that is, it is a tree node at the lowest level of the security policy tree. Leaf nodes can be used to store the various security policies assigned to the security policy tree.

[0045] The security policies to be assigned to the current node are those belonging to the current node and awaiting further partitioning or storage. Within the same security policy tree, as the node construction process progresses, the number of security policies to be assigned to a parent node is typically greater than the number of security policies to be assigned to its child nodes. The security policies to be assigned to the current node form the security policy set P corresponding to the current node. `policy` represents the various security policies to be assigned, and `num_policy` represents the number of security policies to be assigned. If the current node is a non-leaf node, the security policies to be assigned corresponding to the current node will need to be further assigned to the various child nodes corresponding to the current node; if the current node is a leaf node, the security policies to be assigned corresponding to the current node will be directly stored in the current node. For example, if the current node is a non-leaf node (referred to as current node A) and corresponds to 1000 security policies to be assigned, and the child nodes constructed for current node A include A1, A2, A3, and A4, then when recursively processing the child nodes A1, A2, A3, and A4 corresponding to the current node, if there are no security policies to be assigned to the next security policy tree, then the target number of each security policy to be assigned corresponding to child nodes A1, A2, A3, and A4 can be 450, 300, 200, and 50, respectively.

[0046] In practice, to determine whether the current node is a leaf node, the target number of each security policy to be assigned to the current node can be compared with the threshold for the number of security policies for a leaf node. If the target number is greater than the threshold, the current node is not a leaf node; if the target number is not greater than the threshold, the current node is a leaf node.

[0047] Understandably, when constructing a security policy tree, regardless of whether there is security policy replication or not, a balance needs to be struck between the depth (i.e., height) of the security policy tree and the number of security policies in the leaf nodes. During security policy matching, the threshold for the number of security policies in the leaf nodes significantly impacts matching performance. However, setting a universally optimal threshold is extremely difficult because it is closely related to the specific distribution of the security policy set (the configuration of the security policy set itself), the hardware environment (CPU, memory), and performance requirements (latency). If the threshold for the number of security policies in the leaf nodes is set too high, although it can reduce the depth of the security policy tree and reduce node traversal overhead, it will lead to an excessive number of security policies in the leaf nodes, significantly increasing the linear search time within the leaf nodes. If the threshold is set too low, although it can reduce the search overhead within the leaf nodes, it will increase the depth of the security policy tree. The overhead of pointers and structures leads to an increase in total memory usage, which in turn increases the node traversal latency. Therefore, the total latency of security policy matching is jointly determined by the tree traversal latency and the search latency within the leaf nodes, and there exists a theoretically optimal balance point. However, existing solutions mostly rely on preset fixed thresholds or offline threshold optimization, making it difficult to dynamically adapt the optimal threshold to large-scale security policy sets (such as hundreds of thousands to millions of policies). This is especially true in online security policy tree construction scenarios, where the threshold selection directly impacts the online construction time. If the threshold is improperly selected, resulting in excessively long security policy tree construction time, new security policies may not take effect in a timely manner. Therefore, to improve the rationality of setting the threshold for the number of security policies in leaf nodes, this application also proposes a method for dynamically determining the threshold.

[0048] Specifically, in one embodiment, S101 can be implemented according to steps S101-1 to S101-2:

[0049] S101-1: Determine the target policy threshold based on the application requirements of the security policy; the application requirements include at least one of the following: matching latency requirements, memory limits, and build time requirements.

[0050] Here, the application requirements of security policies refer to the specific performance and resource constraints that must be met when actually deploying and running a firewall system. These constraints directly determine the direction of setting security policy tree construction parameters. These application requirements specifically include, but are not limited to, matching latency requirements with strict requirements on packet matching speed, memory limitations constrained by hardware resources, and construction time requirements sensitive to the efficiency of security policy tree generation or updates. These requirements collectively constitute the core decision-making basis for dynamically determining the target policy threshold. The target policy threshold is the threshold for the number of leaf node security policies set for the currently constructed security policy tree.

[0051] This application can pre-determine the quantitative relationship between application requirements and target policy thresholds through a variable-controlled experimental analysis method. Specifically, the test policy threshold is used as a variable, while other experimental parameters are kept fixed. Based on a sample security policy set, corresponding test security policy trees are constructed under multiple different test policy thresholds using existing security policy tree construction techniques or the security policy tree construction method provided in this application. Subsequently, security policy matching tests are performed on the test security policy trees corresponding to each test policy threshold using test packets. Key performance matching indicators are collected for each test policy threshold, including but not limited to security policy tree construction time, memory usage (including but not limited to total memory usage, minimum and maximum memory usage, and average memory usage), and packet matching latency under average / worst conditions. Regression analysis is performed using the collected data points (threshold, construction time), (threshold, memory), and (threshold, latency) to fit a tree construction time function, a memory usage function, and a latency growth function. A quantitative relationship between policy thresholds and application requirements is established based on these three functions. This quantitative relationship can be a fitted linear model or a more complex nonlinear model. For example, the fitted metalinear regression model can be... Where Memory represents the memory usage function related to memory limits, Threshold represents the threshold for the number of safety policies for leaf nodes, time represents the tree construction time function related to tree construction time requirements, and latency represents the latency growth function related to matching latency requirements. , , These are the fitted regression coefficients, and C represents the fitted constant.

[0052] In practice, the target policy threshold can be dynamically determined using the fitted model based on the specific application requirements of the current security policy set to be divided (such as memory limits, delay service level agreements (SLAs), and build time limits).

[0053] S101-2: Determine whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node and the relationship between the target policy threshold and the target number.

[0054] In practice, for the current node in the security policy tree being built, the target quantity can be compared with the target policy threshold of the leaf node. If the target quantity is less than or equal to the target policy threshold, the current node is determined to be a leaf node. Otherwise, if the target quantity is greater than the target policy threshold, the current node is determined to be a non-leaf node, and the following S102 will continue to be executed, that is, the process of further allocating each security policy to be assigned will be executed, thereby recursively creating its child nodes and continuing the construction process of the next current node.

[0055] In one embodiment, for the above S101, if the current node is a leaf node, then each security policy to be assigned corresponding to the current node can be stored in the current node.

[0056] For example, if the current node is determined to be a leaf node, it can be determined that the node splitting process of the current node is completed, the current node is designated as a leaf node, and the various security policies to be assigned corresponding to the current node are stored in the current node.

[0057] S102: If not, then from multiple preset bits, determine at least one bit to be selected based on the selected bits of the parent nodes that have been built at each level in the security policy tree for the current node.

[0058] Here, multiple preset bits are a predefined set of a fixed number of bits, the total number of which is determined. These preset bits collectively constitute a complete dimensional space for dividing the security policy. This application does not specifically limit the number of preset bits; the security policy tree construction method provided in this application is applicable to various numbers of preset bits. There is a direct mapping relationship between each preset bit and a security policy matching domain. Specifically, each preset bit corresponds to at least one policy matching domain (such as source Internet Protocol (IP) address, destination IP address, protocol type, port number, etc.). The value of a security policy under a certain preset bit is used to characterize the specific policy information of the security policy under each policy matching domain corresponding to that preset bit. For example, the value of a preset bit can correspond to specific policy binary information in a matching domain (e.g., the m-th binary bit of the source IP address), or it can achieve "cross-domain" mapping, that is, the value of a preset bit is jointly determined by specific binary information in multiple matching domains. For example, the value under a preset bit can characterize the "XOR result of the source IP address and the destination port number" of the security policy. This design offers great flexibility, enabling the extraction of the most effective discriminative features from the multidimensional information in the entire message header.

[0059] The selected bits represent the bits chosen from various preset bits for dividing the security policy among the existing parent nodes at each level corresponding to the current node. Each level of the existing parent node is the parent node located at a higher level below the current node in the currently constructed security policy tree. For example, if the current node corresponds to the third level, then each level of the existing parent nodes could include a parent node from the second level and the root node from the first level.

[0060] The bits to be selected are the bits in the preset bits that are excluding the already selected bits. All the bits to be selected form the first bit set, which can be represented by set B. It should be noted that if the current node has no parent node, i.e., the current node is the root node, then for the current node, there are no already selected bits. In this case, the first bit set can contain all the preset bits, and each bit to be selected is simply a different preset bit.

[0061] The bit to be selected can be represented as b_i, where Let 'i' represent the i-th bit. The bits to be selected are the bits that the current node can choose for security policy partitioning, and at least one bit must be selected. For example, assuming the preset total number of bits is 8 (Bit0 to Bit7), and the current node has two levels of parent nodes, with the previous parent node having selected Bit0 and Bit1 for security policy partitioning, and the next higher parent node having selected Bit3 for security policy partitioning, then for the current node, the selected bits are Bit0, Bit1, and Bit3, and the bits to be selected in the first bit set include Bit2, Bit4, Bit5, Bit6, and Bit7.

[0062] Specifically, this application does not impose a specific limit on the number of selectable bits for each current tree node. However, it is understood that for current nodes in the upper-level structure of the security policy tree (such as the root node or the child node corresponding to the root node), the number of corresponding security policies to be allocated is relatively large (such as hundreds of thousands) and the number of parent nodes at each level is relatively small, so the number of selectable bits is relatively large and used to further allocate the various security policies to be allocated. On the other hand, for current nodes in the lower-level structure of the security policy tree (such as leaf nodes or the parent node above the leaf node), the number of corresponding security policies to be allocated is relatively small (such as hundreds) and the number of parent nodes at each level is relatively large, so the number of selectable bits is relatively small.

[0063] In practice, when it is determined that the current node is not a leaf node, its hierarchical position in the currently constructed security policy tree can be used to trace all its constructed parent nodes (starting from the constructed parent nodes of adjacent levels up to the root node), and determine the selected bits that each constructed parent node has selected in the previous partitioning steps. Then, each selected bit is removed from each preset bit set to obtain each unselected bit that has not been used by any constructed parent node, forming the first bit set.

[0064] S103: Determine the number of policies for each selected bit under different bit values ​​based on the bit value of each security policy to be assigned under each selected bit.

[0065] Here, the bit value under the bit to be selected is the specific value of the security policy to be allocated in the policy matching field corresponding to the bit to be selected. It indicates that the policy has clear and fixed binary information in this bit. Each specific value is the different bit value mentioned above. Specific values ​​can include, for example, "0", "1", and "2". ", meaning the security policy to be assigned can take the values ​​"0", "1", and "" under the bit to be selected. One of them, and " "" indicates any value or "not concerned". If the security policy to be assigned takes the value "" under the bit to be selected. If the value is ',' it means that the policy has no constraint on this bit position and can match either '0' or '1'. The bit value of the security policy to be matched under each preset bit can be directly determined according to the policy information in the corresponding policy matching field (such as a certain bit of the IP address, a certain bit of the port number, etc.) based on the specific rules of the security policy.

[0066] The number of policies for each bit value of the candidate bit represents the number of security policies to be assigned for that bit value. For any b_i in the first bit set B, we can traverse all the security policies to be assigned corresponding to the current node and count the value distribution at that specific bit to obtain the number of policies for that specific bit. Specifically, for any b_i in the first bit set B, the number of policies in P where b_i has a value of "0" can be obtained using... It means that, among them, ; This represents the value of the security policy p to be assigned in b_i. Similarly, the number of policies in P where b_i is "1" can be represented by... It means that, among them, In P, the value of b_i is " The number of strategies can be used It means that, among them, .

[0067] For example, for the first bit set B of the current node, the number of strategies for each bit to be selected under different bit values ​​can be achieved by the following expression:

[0068] For any optional Bit, where :

[0069] , Let P represent the number of policies in P where b_i is 0, where P is the set of all security policies to be assigned to the current node, and p is a single security policy to be assigned to the current node. This indicates that the security policy p has a value of 0 on a specific bit b_i.

[0070] , This represents the number of strategies in P where b_i is 1. This indicates that the security policy p has a value of 1 on a specific bit b_i.

[0071] , This indicates that the value of b_i in P is... The number of (arbitrary / indifferent) strategies. This indicates that the security policy p takes the value of a specific bit b_i. .

[0072] Clearly, for any b_i, the following equation (1) always holds:

[0073] (1)

[0074] Where num_policy represents the number of policies in each security policy set P to be assigned to the current node.

[0075] S104: Based on the number of policies, the number of targets, and the current depth of the security policy tree, determine the target bit selected by the current node from the bits to be selected, and construct the child nodes corresponding to the current node according to the number of target bits.

[0076] Here, the target number refers to the number of security policies to be assigned. The current depth of the security policy tree is an important construction parameter, representing the level depth of the current node in the currently constructed security policy tree. It dynamically reflects the vertical position of the current node in the overall tree structure. Specifically, the depth of the root node can be defined as 0 or the initial level, the depth of the direct children of the root node is 1, and so on, with the depth value increasing with each lower level.

[0077] The target bits represent the optimal combination of discrete bits selected by the current node. They serve as the basis for splitting the current node and are used to evenly distribute the various security policies corresponding to the current node to the child nodes. Each child node is a subsequent node created at the next level corresponding to the current node, and the number of target bits determines the number of child nodes created for the current node.

[0078] In practice, the number of target bits to be selected can be determined based on the target number of security policies to be allocated and the current depth of the constructed security policy tree. Based on this number and the impact of the number of policies for each target bit at different bit values ​​on allocation balance, this number of bits is selected as the target bits for the current node. Then, based on the number of target bits, the number of child nodes to be created for the current node is determined, and this number of child nodes is created, with an identifier assigned to each child node. The identifier of the child node can be determined by sequential numbering based on the number of child nodes; for example, if the number of target bits is N1, then the number of child nodes to be created is 2^N1.

[0079] For example, suppose we select 3 target bits {Bit0, Bit3, Bit7} from the various candidate bits {Bit0, Bit1, Bit3, Bit6, Bit7}; then create 2^3=8 child nodes for the current node, and the identifiers of the 8 child nodes can be 0~7 in sequence.

[0080] It should be noted that each child node carries the specific rules for dividing the security policy from the parent node (current node) to the child node. Therefore, during message matching, based on the target bits corresponding to the current node, the actual values ​​of the corresponding bits in the message can be extracted to quickly map and locate the unique target child node, thus achieving efficient traversal. For details, please refer to the subsequent description of the matching process; it will not be elaborated upon here.

[0081] In one embodiment, the step of "determining the target bit selected by the current node" in S104 above can be determined according to steps S104-1 to S104-4:

[0082] S104-1: Determine the policy similarity / similarity parameter corresponding to each candidate bit based on the number of policies for each candidate bit under different bit values.

[0083] Here, the Policy Dissimilarity Value (PDV) is used to quantitatively evaluate the effect of each candidate bit on the allocation of various security policies corresponding to the current node. PDV is a parameter used to quantitatively select the target bit that is most beneficial to "efficient allocation of security policies" from a large number of candidate bits, ensuring the balance and clarity of the security policy allocation. The lower the PDV value, the better the candidate bit can meet the requirements of "balanced allocation and clear allocation", and the more conducive it is to the allocation of security policies to child nodes. The PDV value can be calculated according to the following formula (2):

[0084] (2)

[0085] in, This represents the strategy similarity / similarity parameter for the i-th candidate bit b_i in the first bit set. This represents the number of strategies in P where b_i has a value of 0. This represents the number of strategies in P where b_i has a value of 1. This represents the absolute value of the difference between the number of policies in P with b_i = 0 and the number of policies in P with b_i = 1. This indicates that the value of b_i in P is... The number of (arbitrary / indifferent) strategies, where m is the impact factor (IF).

[0086] Balanced and The impact, The minimum is 0: that is, when and Same and The value that is 0; Maximum That is, when and =0 and The value when it is num_policy.

[0087] The influence factor m is used to adjust the value of the bit to be selected, b_i. The impact of the allocation security policy on partitioning quality. The value of m directly affects the "partition balance" (determined by...). (embodied) and "clarity of division" (by This application does not impose specific limitations on the value of m, which can be preset based on experience. For example, the security policy under b_i can be set to... When m=2, it means that the security policy can match either bit0 or bit1 under this bit, so usually m=2 can be taken.

[0088] Furthermore, the balance and clarity of security policy allocation comprehensively affect the current node's allocation effect on each security policy to be assigned. Allocation balance can be determined by the absolute value of the difference between the number of policies in P where b_i is 0 and the number of policies in P where b_i is 1. The smaller the difference (i.e., the smaller the absolute value), the more evenly the security policies to be assigned can be distributed among the child nodes when using this bit for allocation. For example, for a certain bit b_2 to be selected... , ,but A certain bit to be selected, b_3, , ,but Then b_2 can make the load on child nodes more balanced, avoiding the "node height increase" caused by assigning too many security policies to a certain child node. The clarity of the partition can be determined by the value of b_i in P. The number of strategies is determined by the value of b_i. The fewer the number of strategies (num_bit_any[i]) for a given bit, the fewer security strategies will be pushed to subsequent security strategy trees for partitioning due to the "uncertainty of bit values." In other words, as many security strategies as possible will be allocated to the child nodes corresponding to the current node in the current security strategy tree. For example, a bit b_2 to be selected... And the other bit to be selected, b_4, Using b_2 to partition the security policies to be assigned allows more security policies to remain in the currently constructed security policy tree, reducing the total number of security policy trees that need to be constructed subsequently. The fewer the total number of trees, the fewer security policy trees need to be traversed during subsequent packet matching, resulting in higher matching performance.

[0089] In specific implementation, for each candidate bit in the first bit set, the number of strategies under different bit values ​​is obtained; then, the strategy similarity parameter corresponding to each candidate bit is calculated according to formula (2). Thus, each bit to be selected is assigned an evaluation value for the quantization effect.

[0090] S104-2: Determine the first quantity based on the target quantity, the current depth, and the preset number of bits.

[0091] Here, the first quantity (which can be represented as num_op) is the upper limit of the number of bits that the current node can choose from the first bit set. , where n represents the total number of preset bits, with the first maximum being the number of preset bits and the minimum being 1.

[0092] This application does not specify the exact value of the first quantity, but it is understood that for nodes in the upper structure of the security policy tree (such as the root node or the child node corresponding to the root node), the number of security policies to be assigned is large (i.e., the target number, such as hundreds of thousands), so a smaller first quantity can be selected; while for nodes in the deeper structure of the security policy tree (such as the parent node above the leaf node), the number of each security policy to be assigned is often small (such as hundreds), so a larger first quantity can be selected.

[0093] In practice, based on the target number of each security policy to be assigned to the current node, the depth of the current node in the security policy tree, and the preset number of bits n, the number of selectable bits corresponding to the current node is determined based on the fitting relationship between the target number, depth, n and num_op. Then, the first number is determined by combining the maximum number of bits to be selected and the number of selectable bits.

[0094] For example, nodes with shallower depths (such as top-level nodes) need to adopt a conservative strategy (such as using a smaller initial quantity) to control computational complexity due to the large and abundant number of targets; while nodes with deeper depths (such as lower-level nodes) can adopt a more aggressive strategy (such as appropriately increasing the initial quantity) to pursue better local partitioning because the number of targets is smaller.

[0095] S104-3: Based on the ascending sorting order of the difference parameters of each strategy and the first number, select the first number of candidate bits from the bits to be selected.

[0096] Here, the ascending order is the order in which the PDV values ​​corresponding to all candidate bits in the first bit set are sorted from smallest to largest. The ascending order of the policy difference parameter is also the ascending order of the candidate bits. By establishing an objective priority standard, candidate bits with better partitioning efficiency (i.e., smaller PDV values) are placed at the front, thus ensuring that subsequent processes can accurately and efficiently select a fixed number of high-quality candidate bits that are most conducive to the balanced partitioning of the current node's policy, based on this order and the initial quantity constraint, laying the foundation for subsequent processing.

[0097] Candidate bits are bits selected from the candidate bits that may have a better partitioning effect when used as target bits.

[0098] In practice, the bits to be selected in the first bit set can be sorted in ascending order according to the strategy similarity / difference parameter (i.e., PDV value) corresponding to each bit to be selected, forming an ordered sequence from smallest to largest. Then, based on a first quantity, starting from the beginning of the sorted sequence, a first quantity of bits to be selected are sequentially selected as candidate bits.

[0099] For all the bits to be selected, the corresponding num_policy is always the same. After sorting the PDV values ​​of the bits to be selected in ascending order, the bit corresponding to the PDV value that appears earlier in the sort is more likely to be used to evenly distribute the security policy to be allocated to the child nodes.

[0100] When sorting the PDV values ​​in ascending order, at least two candidate bits with the same PDV value may be sorted adjacently. Since candidate bits with the same PDV value have the same impact on the allocation of the security policy, selecting them together as candidate bits will not lead to a better policy allocation effect. Therefore, to maximize the policy allocation effect, the following steps can be implemented for S104-3 above:

[0101] In the process of selecting the first number of candidate bits according to the ascending order of the strategy similarity difference parameters, if there are at least two candidate bits that are adjacent in ascending order and have the same strategy similarity difference parameters, then one candidate bit is selected from the at least two candidate bits as the candidate bit.

[0102] In the embodiments of this application, multiple (at least two) candidate bits may have the same Policy Differential Value (PDV) parameter. This is because different candidate bits may have completely identical value distribution characteristics in each security strategy to be assigned. During ascending sorting, candidate bits with the same PDV value will become adjacent items in the sequence. At this point, a unique selection is required, that is, selecting only one candidate bit from these multiple candidate bits with the same PDV value. The fundamental reason is that these candidate bits are considered completely equivalent in terms of partitioning utility; their partitioning ability and impact on each security strategy to be assigned are the same. If multiple equivalent candidate bits are selected simultaneously, not only will it fail to bring a cumulative optimization effect to subsequent partitioning, but it will also unnecessarily narrow the search space of candidate combinations in the subsequent selection stage, leading to a decrease in partitioning quality. Therefore, a unique selection can effectively improve partitioning quality while ensuring partitioning potential.

[0103] It should be noted that during the unique selection process, a single bit can be selected from multiple candidate bits with the same PDV value according to preset rules. These preset rules can include various rules, including but not limited to random selection, the lowest historical usage frequency priority rule (i.e., prioritizing the bit with the lowest selection frequency in the constructed security policy tree to promote balanced utilization of bit resources), or the smallest num_bit_any value priority rule (i.e., selecting the candidate bit with the smallest num_bit_any value, aiming to minimize the impact of wildcards). The rule delay caused by the fact that the smaller the value of num_bit_any is preferred, can make it possible to divide the security policies to be assigned into the tree nodes of this security policy tree as much as possible.

[0104] In practice, when selecting candidate bits in ascending order according to the strategy difference parameter, if there are other candidate bits with the same PDV value that are adjacent to the candidate bits within the first number range, one of these equivalent bits can be selected as a candidate bit according to the preset rules to achieve unique selection.

[0105] For example, when there are three candidate bits (Bit2, Bit5, Bit8) with the same PDV value, their ascending PDV values ​​will be adjacent, allowing for unique selection based on preset rules. For instance, if a random selection rule is used, Bit5 might be selected as a candidate bit using a random function; if a historical usage frequency rule is used, querying the construction records reveals that Bit2 has been used 15 times, Bit5 10 times, and Bit8 12 times, then Bit5, with the lowest usage frequency, is selected as the candidate bit; if the minimum num_bit_any rule is used, comparing Bit2's... Bit5 Bit8 Then choose The bit with the smallest value (Bit8) is selected as the candidate bit.

[0106] S104-4: Determine the target bit based on each candidate bit.

[0107] In practice, the above-mentioned steps for selecting candidate bits can be the bit coarse selection stage of this application. After completing the coarse selection stage, each candidate bit selected in the coarse selection stage can be directly used as the target bit. Alternatively, the candidate bits selected in the coarse selection stage can be further selected to obtain the target bit through the fine selection stage described later.

[0108] S105: Determine the security policy to be assigned for each child node based on the bit value of each security policy to be assigned under each target bit.

[0109] In practice, each security policy to be assigned corresponding to the current node can be traversed, and the specific bit values ​​(e.g., 0, 1, ...) of the security policy to be assigned under each target bit can be determined using the target bits determined for the current node. Then, based on these bit values, determine whether the currently traversed security policy to be assigned needs to be assigned to the next security policy tree to be built; if yes, continue traversing the next security policy to be assigned; if no, determine the child node to which the currently traversed security policy to be assigned belongs based on the bit values, and assign the currently traversed security policy to its child node as the security policy to be assigned corresponding to that child node.

[0110] S106: Returns the steps for determining whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node, until all leaf nodes of the security policy tree are constructed.

[0111] In practice, after generating the child nodes of the current node and assigning the security policies to be allocated to each child node, the security policies to be allocated for each child node can be obtained. Then, the security policy tree can be recursively constructed. Specifically, each newly generated child node is treated as the new current node, and step S101 is executed again, which returns to the step of determining whether the new current node is a leaf node based on the target number of security policies to be allocated corresponding to it, thus achieving the allocation of security policies for the new child node. This process iterates until all leaf nodes of the security policy tree are constructed, completing the construction of the current security policy tree.

[0112] Furthermore, after the current security policy tree is constructed, if there are still unassigned security policies to be assigned, the next security policy tree can be constructed based on the steps S101 to S106 above, until all the unassigned security policies in the security policy set are divided.

[0113] It should be noted that when constructing any security policy tree, you can directly construct the root node first and use the root node as the current node for security policy partitioning.

[0114] In one embodiment, to further improve the rationality of the target bit selection, the candidate bits selected in the coarse selection stage can be further filtered. Specifically, for S104-4 above, steps A1-A4 can be followed to determine:

[0115] A1: Based on the first quantity and the preset combination quantity threshold, determine the target combination method from multiple preset combination methods; the preset combination methods include sequential combination method and full combination method.

[0116] Here, this application proposes two combination generation methods: "ordered combination method" and "full combination method." The choice between these two methods directly affects the computational overhead during policy partitioning and thus the construction time of the security policy tree. For ease of description, the set of candidate bits will be defined as candidate bit set B_cand below.

[0117] The Full Combination method aims to generate all possible non-empty subsets of the candidate bit set. This method enumerates all combinations from single bits to those including all candidate bits. Specifically, the Full Combination method can generate the set of bits corresponding to B_cand. A non-empty subset S1 (i.e., all possible candidate bit combinations, regardless of the order of the candidate bits). The advantage of the full combinatorial approach is that it can perform a global exploration, theoretically making it more likely to find the optimal bit combination, thus obtaining a higher quality bit combination for partitioning. However, the number of combinations increases exponentially with num_op, and the computational complexity also increases exponentially with num_op, that is, the computational complexity is O(n^2). When num_op is slightly large (e.g., more than 10), the "full combinatorial approach" will cause a "combinatorial explosion" problem, making the construction of the security policy tree extremely time-consuming. Therefore, it is usually only used when the initial quantity is small (i.e., the num_op value is small) to ensure computational feasibility.

[0118] Ordered Combination is a heuristic strategy for efficiently generating candidate bit combinations, aiming to generate combinations according to the sorted order of candidate bits. This method generates an increasing sequence of combinations, containing the first 1, the first 2, ..., the first num_op candidate bits, following the inherent order of the candidate bits within the set. The number of combinations generated by Ordered Combination is linearly related to num_op, and its computational complexity is also linearly related to num_op, i.e., O(num_op). When num_op is large, Ordered Combination fundamentally avoids the combinatorial explosion problem, greatly reducing computational complexity. It is suitable for scenarios with high efficiency requirements, especially for handling top-level nodes or large-scale policy sets.

[0119] The target combination method is a preset combination method to be selected, which can be either "sequential combination method" or "full combination method".

[0120] This application determines the target combination method to be used by dynamically setting a preset combination threshold. Different tree nodes correspond to different preset combination thresholds. The preset combination threshold, denoted by k, indicates the maximum allowed number of bit combinations and is used to determine which combination method (sequential combination or full combination) to use to generate candidate bit combinations during the selection phase. By setting a hard upper limit constraint on combinations, the "combination explosion" problem can be effectively prevented when the number of candidate bits is large, ensuring that the construction of the security policy tree is completed within an acceptable time complexity.

[0121] Furthermore, the preset combination threshold can be dynamically adjusted using a "dynamic adjustment" strategy. Specifically, k is not fixed but can be adaptively adjusted based on the adjustment parameters corresponding to the current node. For example, the adjustment parameters can be the target quantity num_policy corresponding to the current node, the current depth of the security policy tree, etc. For high-level tree nodes with large num_policy and shallow depth, a smaller k and a simpler combination can be used to prioritize construction efficiency; while for low-level nodes with small num_policy and deep depth, the upper limit is relaxed (i.e., a larger k is used), allowing for more complex combinations to pursue better partitioning accuracy. This dynamic strategy achieves a reasonable allocation of computing resources in the global construction process.

[0122] In practice, for the current node, a hard preset threshold k for the number of combinations can be dynamically determined, and the number of combination subsets corresponding to the first number of candidate bits num_op ( The target combination is determined by comparing the result with the preset combination threshold. Then select the full combination method as the target combination method; if If the computationally complex full combinatorial approach is abandoned, the efficient sequential combinatorial approach will be chosen instead; if the number of combinatorial subsets is... Then, processing can be performed according to preset combination determination rules. These preset combination determination rules can be either directly selecting the full combination method to fully utilize its global search advantage, or prioritizing the more computationally efficient sequential combination method based on actual load or optimization goals to ensure construction speed. Optionally, auxiliary criteria such as node depth and the number of strategies can be introduced for dynamic decision-making. For example, when there are deep nodes or a small number of targets, the full combination method can still be used; otherwise, sequential combination can be switched, thus achieving a flexible trade-off between computational resources and partitioning accuracy.

[0123] A2: Arrange and combine each candidate bit according to the target combination method to obtain multiple candidate bit combinations.

[0124] Here, candidate bit combination is a subset of combinations generated by combining candidate bits using the target combination method.

[0125] In specific implementation, if the target combination method is a full combination method, then the full combination method is used to generate (based on each candidate bit in B_cand) There are ) non-empty subsets S1. Among them, Let sj be the generated j-th candidate bit combination. If the target combination method is ordered combination, then num_op candidate bit combinations sj are generated according to the order of the candidate bits in the candidate bit set, where the generated j-th candidate bit combination includes the first j candidate bits. The num_op candidate bit combinations generated according to the combination method can be formed into a set S2. .

[0126] A3: Select the target bit combination from multiple candidate bit combinations based on the second number of target candidate bits in each candidate bit combination and the second number of target policies with target bit values ​​under each candidate bit combination for the security policy to be assigned.

[0127] Here, the target candidate bit is the candidate bit included in the candidate bit combination. For example, Bit1 in the candidate bit combination {Bit1} is a target candidate bit, and Bit1 and Bit2 in the candidate bit combination {Bit1, Bit2} are both target candidate bits within that combination. These specific individual bits are the basic units for strategy partitioning statistics and cost calculation.

[0128] Second quantity ( The number of target candidate bits included in the candidate bit combination determines the theoretical number of child nodes to be created when performing strategy partitioning for the current node (i.e., The second quantity snum = 3 is a key dimension parameter for subsequent calculations of evaluation indicators such as partitioning costs. For example, if the candidate bit combination s = {Bit1, Bit2, Bit3} has a second quantity snum = 3, the corresponding potential child nodes are 2^3 = 8, which can be child nodes 0 to 7.

[0129] Furthermore, based on the second number of candidate bit combinations |snum|, P is divided into... Among the child nodes, each child node, under the candidate bit combination, corresponds to a security policy to be allocated, which can be used... express.

[0130] The target bit value can be " For any candidate bit combination, the target policy can be any one or more target candidate bits in the combination that take the value "" from all the security policies to be allocated corresponding to the previous node. "Security policies that cannot be explicitly assigned to any child node by this combination; the number of second policies is the total number of target policies under the candidate bit combinations. The number of second policies can intuitively reflect the effectiveness of candidate bit combinations in processing values..." The capability deficiencies in security strategies are a negative indicator for evaluating the quality of partitioning schemes. For example, the number of second strategies for the j-th candidate bit combination can be expressed as... That is, for the j-th candidate bit combination sj, in the statistical strategy set P, at least one bit b_i belonging to sj has a value of "". The total number of strategies p.

[0131] The target bit combination (s_best) is the optimal discrete multi-bit set determined after evaluation and screening from multiple candidate bit combinations. This combination will serve as the final splitting basis for the current node, directly used to allocate the security policy to be assigned to the current node to its corresponding child nodes.

[0132] In practice, for each candidate bit combination, the second number of target candidate bits in that combination and the second strategy number for each target candidate bit under the target bit value can be counted. By comprehensively evaluating the partitioning granularity represented by the second number of each candidate bit combination and the partitioning completeness reflected by the corresponding second strategy number, target bit combinations that can maximize the number of effective child nodes while minimizing the number of unpartitioned strategies can be selected from the candidate bit combinations.

[0133] A4: Take each target candidate bit in the target bit combination as the target bit.

[0134] In practice, each target candidate bit included in the target bit combination can be directly used as the target bit to be finally selected for the security policy partitioning of the current node.

[0135] In one embodiment, step A2 above can be implemented as follows:

[0136] When the target combination method is sequential combination, the ascending order of each candidate bit is determined according to the first strategy quantity of each candidate bit under the target bit value, and the candidate bits are arranged and combined according to the ascending order of each candidate bit to obtain the first number of candidate bit combinations; or, when the target combination method is full combination, the candidate bits are fully combined to obtain multiple non-empty candidate bit combinations.

[0137] Here, to further encourage the allocation of security policies to be included within the current security policy tree, the bits with smaller num_bit_any values ​​under the candidate bits can be prioritized to reduce the impact of the target bit value on the allocation of security policies. "The probability of a conflict being postponed to a subsequent policy tree is reduced. This significantly increases the retention rate of the security policy to be assigned in the current security policy tree, reduces the total number of trees required to partition the complete policy set, and improves the overall matching performance during the final matching process because fewer trees need to be traversed and the policy distribution is more concentrated."

[0138] Each candidate bit corresponds to a first policy quantity. For any candidate bit, the first policy quantity is the value of the security policy to be assigned to the current node for that candidate bit. The total number of security policies.

[0139] In practical implementation, when using the sequential combination method, the number of first strategy bits corresponding to each candidate bit can be determined (i.e., The candidate bits are sorted in ascending order according to the first strategy, and the ascending order of each candidate bit is obtained. Then, based on the ascending order and the ordered sequence, candidate bit combinations containing the first candidate bit, candidate bit combinations containing the first two candidate bits, candidate bit combinations containing the first three candidate bits, and so on, until candidate bit combinations containing the first num_op candidate bits are generated. For example, if... Then num_op=3, generated using the sequential combination method. There are a total of 3 bit sets. It can be seen that "ordered combination" is a greedy strategy, and its effectiveness in the security strategy partitioning is highly dependent on the accuracy of the ascending order of the candidate bits.

[0140] When using a full combination approach, existing algorithms such as recursive algorithms or bitmasking techniques can be used to exhaustively enumerate all possible non-empty subsets of the candidate bit set, resulting in combinations of candidate bits ranging from containing a single candidate bit to containing all num_op candidate bits. For example, if... If num_op=3, then the candidate bit combinations generated using the full combination method can be: S1={s1={Bit1}, s2={Bit2}, s3={Bit3}, s4={Bit1, Bit2}, s5={Bit1, Bit3}, s6={Bit2, Bit3}, s7={Bit1, Bit2, Bit3}}, for a total of 2³-1=7 combination subsets.

[0141] In one embodiment, A3 above can be implemented according to the following steps A3-1 to A3-3:

[0142] A3-1: For any candidate bit combination, determine the number of non-empty child nodes under the candidate bit combination.

[0143] Here, the number of non-empty child nodes represents the number of valid child nodes among all potential child nodes corresponding to the current node under the candidate bit combination, which can be represented by num_child(sj); where a valid child node is a child node assigned to a security policy that is not empty. If a potential child node is not assigned to any security policy to be matched, then it is meaningless to the "partitioning strategy". num_child(sj) directly reflects the actual segmentation effect of the candidate bit combination on each security policy to be assigned, and is a key indicator for measuring whether the partitioning scheme is effective in avoiding resource waste and achieving a balanced distribution.

[0144] In practice, for any candidate bit combination, based on the values ​​of each target candidate bit in that candidate bit combination for each security policy to be assigned, the potential child nodes corresponding to each security policy to be assigned can be determined from the potential child nodes corresponding to the current node in the candidate bit combination. This allows us to determine the valid child nodes assigned security policies and the invalid child nodes not assigned any security policies. The number of valid child nodes is taken as the number of non-empty child nodes in that candidate bit combination. For example, a candidate bit combination contains two bits {Bit1, Bit2}, and the current node corresponds to four potential child nodes (potential child nodes 0~3). After dividing the security policies to be assigned to the current node, it is found that: potential child node 0 contains 5 policies (non-empty), potential child node 1 contains 0 policies (empty), potential child node 2 contains 3 policies (non-empty), and potential child node 3 contains 4 policies (non-empty). Therefore, the number of non-empty child nodes for the candidate bit combination {Bit1, Bit2} is 3.

[0145] A3-2: Determine the strategy partitioning cost of candidate bit combinations based on the target number, the number of second strategies, and the number of non-empty child nodes.

[0146] Here, Mean Partition Cost (MPC) is used to quantitatively evaluate the partitioning performance of candidate bit combinations. Its value comprehensively reflects the average cost that candidate bit combinations need to pay when partitioning each security strategy to be partitioned. MPC provides an accurate decision-making basis for objectively selecting the target bit combination with the best overall partitioning performance from a large number of candidate bit combinations. The MPC value can be calculated according to the following formula (3):

[0147] (3)

[0148] Where MPC(sj) represents the policy partitioning cost corresponding to the j-th candidate bit combination. num_policy represents the number of security policies to be assigned to the current node, i.e., the target number. num_remainder(sj) represents the number of second policies corresponding to candidate bit combination sj. num_child(sj) represents the number of non-empty child nodes corresponding to candidate bit combination sj. This represents the number of security policies successfully assigned to each child node.

[0149] In practice, for each candidate bit combination, the strategy partitioning cost of the candidate bit combination can be determined by formula (3) based on the target number corresponding to the current node, the number of strategies that could not be partitioned under the candidate bit combination due to wildcard conflict (the number of second strategies), and the number of effective child nodes (i.e., the number of non-empty child nodes).

[0150] A3-3: Divide the cost according to the strategy of each candidate bit combination, and select the target bit combination from multiple candidate bit combinations.

[0151] In practice, the policy partitioning cost (MPC value) of all candidate bit combinations is compared, and the candidate bit combination with the smallest MPC value is selected as the target bit combination s_best. The target bit combination optimizes the average partitioning cost for constructing child nodes and partitioning security policies for the current node. Its characteristic is that it can simultaneously minimize the number of unsuccessful policy partitioning (num_remainder) and maximize the number of effective child nodes (num_child), thus achieving an optimal balance in partitioning performance. In this way, by adopting a phased selection strategy and systematically and quantitatively evaluating the quality of security policy partitioning, the effect of security policy partitioning can be optimized, significantly improving the matching performance of the security policy tree.

[0152] This application, while ensuring that security policies are not copied, employs a heuristic multi-discrete bit selection method to construct a multi-security policy tree. This allows for the construction of as many security policies as possible within the current security policy tree and their distribution across as many child nodes as possible. Distributing security policies across as many child nodes as possible minimizes the node height of the security policy tree; conversely, distributing security policies across as many child nodes as possible minimizes the number of security policy trees. At the same threshold for the number of security policies per leaf node, minimizing the number of security policy trees and minimizing the node height results in higher performance during security policy matching.

[0153] In one embodiment, S105 described above can be implemented according to the following steps:

[0154] S105-1: Based on the bit value of each security policy to be assigned under each target bit, determine whether there exists a first security policy with a target bit value under any target bit among the security policies to be assigned.

[0155] Here, the first security policy can be a security policy to be assigned where the value on at least one target bit is "". The first security strategy is often based on the principle of "security". "The value exists, but it cannot be explicitly assigned to any child node. Therefore, the first security policy refers to the security policy to be matched for the current node that has not been successfully assigned."

[0156] In practice, the system iterates through all the security policies to be assigned corresponding to the current node, and for each security policy to be assigned, it determines whether the target bit value exists in the bit values ​​of each target bit. If it does, the security policy is designated as the first security policy; otherwise, it is determined that the security policy is not the first security policy. Based on the traversal of each security policy to be matched, the determination of whether a first security policy exists is thus completed.

[0157] If no first security policy exists, the child nodes to which each security policy belongs can be determined directly from the child nodes corresponding to the current node based on the bit values ​​of each security policy under each target bit. Understandably, to improve partitioning efficiency, when traversing the security policies to be assigned, if it is found that the currently traversed security policy is not the first security policy, its child nodes can be determined directly based on the bit values ​​of that security policy under each target bit, and then the next security policy to be assigned can be traversed.

[0158] S105-2: If so, for each of the second security policies other than the first security policy in the security policies to be allocated, determine the child node corresponding to the second security policy according to the bit value of the second security policy under each target bit.

[0159] Here, the second security policy is the remaining security policy among all the security policies to be assigned to the current node, excluding the first security policy. The second security policy has a definite bit value (i.e., 0 or 1) under all target bits of the target bit combination. The second security policy can be uniquely and definitively assigned to the corresponding child node of the current node based on its bit value under each target bit.

[0160] The bit value of the second security policy under each target bit can constitute the policy feature identifier of the second security policy under each target bit.

[0161] For example, for the target bit combination [Bit2, Bit6] corresponding to the target bit, when the bit value under each target bit is 0 or 1, the possible bit value combinations are: Bit2=0, Bit6=0 → binary 00 → decimal 0 → child node 0; Bit2=0, Bit6=1 → binary 01 → decimal 1 → child node 1; Bit2=1, Bit6=0 → binary 10 → decimal 2 → child node 2; Bit2=1, Bit6=1 → binary 11 → decimal 3 → child node 3. Furthermore, since the bit value under the target bit in the second security policy is definitely not "", Therefore, based on the bit values ​​of the second security policy under each target bit, the corresponding policy feature identifier can be determined. Based on the policy feature identifier, the identifier of the child node to which it belongs can be determined. When performing message matching, if the message has a value of 0 under Bit2 and a value of 1 under Bit6, it can be determined that the message matches child node 1.

[0162] In practice, once a first security policy is determined to exist, for all the security policies to be assigned that are classified as second security policies corresponding to the current node, a one-to-one correspondence between each second security policy and its child nodes is established based on the explicit bit value (0 or 1) under each target bit. Based on this correspondence, each second security policy is accurately assigned to the corresponding child node, thereby completing the determination of the child node affiliation of the clearly identifiable security policies to be matched within the current node.

[0163] Furthermore, after constructing the leaf nodes of the current security policy tree, if there are still undefined security policies, i.e., if a first security policy still exists, a new security policy tree needs to be constructed to define the first security policy. Specifically, the construction of the new security policy tree can be implemented according to the following steps S1 and S2:

[0164] S1: If a first security policy exists, then the first security policy will be used as the security policy to be assigned to the root node of the next security policy tree to be constructed.

[0165] The security policy tree to be built is the next security policy tree that needs to be built. It is in addition to the currently completed security policy tree to accommodate the existing security policy trees. The root node of the newly constructed security policy tree prepared for the remaining policies (i.e., the first security policy) that failed to be divided due to value conflicts will carry the aforementioned remaining policies and start a new round of tree recursive construction process.

[0166] In practice, after constructing all leaf nodes of the current security policy tree, it checks whether there are any unassigned security policies marked as the first security policy. If so, these first security policies are used as the unassigned security policies corresponding to the root nodes of the next security policy tree to be constructed, and the recursive construction process of the new security policy tree begins based on each unassigned security policy. If none exist, it means that all unassigned security policies have been successfully assigned to the leaf nodes of the constructed security policy tree, and the construction process of the multi-security policy tree automatically terminates.

[0167] S2: Continue building the next security policy tree and use the next security policy tree as the current security policy tree. Return the steps of determining whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node, until there is no first security policy, and obtain each security policy tree.

[0168] Here, returning to the step of determining whether the current node is a leaf node is to construct a new security policy tree based on a recursive construction mechanism, thereby systematically handling all remaining policies that could not be partitioned due to wildcard conflicts. By iteratively using the first security policy remaining in the previous security policy tree as input for subsequent trees, it ensures that every security policy in the original set of security policies to be assigned can eventually be partitioned into a leaf node of a security policy tree, until there are no remaining unpartitioned policies. This mechanism guarantees the integrity of the multi-tree structure and the completeness of the policy set partitioning, and is a key technical means to efficiently accommodate large-scale policy sets without security policy replication.

[0169] In practice, after the construction of a security policy tree is completed, if there are unassigned first security policies, these policies are used as the set of unassigned security policies corresponding to the root node of the next security policy tree to be constructed, and the construction of the next security policy tree to be constructed begins. The new security policy tree is used as the new current security policy tree to be constructed, and the complete construction process of S101 to S106 is re-executed. Each security policy tree is constructed in sequence until there are no new first security policies (that is, until each security policy is successfully assigned to a leaf node of a certain security policy tree that has been constructed). Finally, the construction of the security policy trees is completed, and each security policy tree is used to load the original set of unassigned security policies.

[0170] In one embodiment, after obtaining the various security policy trees, packet matching can be performed according to steps B1 to B4:

[0171] B1: In response to receiving a message to be matched, determine the message field information of the message to be matched under each attribute field.

[0172] Here, attribute fields are standard field areas in the message header that carry specific semantic information. These fields form the dimensional basis for security policies to make matching judgments. Typical attribute fields include, but are not limited to, the source Internet Protocol (IP) field, the destination IP field, the client identifier field, the physical address field, the client attribute field, and the client name field. Optional attribute fields such as message type (data flow, control flow) and network service type (e.g., HTTP) can also be added according to management requirements. Each attribute field corresponds to one or more preset bits. Based on the message field information of the message to be matched under each attribute field and the preset bits corresponding to each attribute field, the message value of the message to be matched under each preset bit can be determined.

[0173] The message to be matched is the data packet carried in the access request initiated by the tenant, which needs to undergo security control verification through the security policy tree. Security policies can include policy attributes under different attribute domains. Policy attributes can include, for example, policy range information and its corresponding policy rules. For instance, a security policy might allow or deny access to the message to be matched from a source port range of 80-90 and a destination port range of 100-120. By comparing the message field information of the message to be matched under each attribute domain with the policy attributes of the security policy under the corresponding attribute domain, it can be accurately determined whether the message to be matched matches the security policy.

[0174] The information carried in the message to be matched includes message field information corresponding to different attribute fields. This information is the core basis for matching with the security policies stored in the leaf nodes. For example, when a user accesses the business system on the company's cloud server through an office computer, a data packet transmitted in the network is the message to be matched. Its specific message field information is as follows: source IP address is 192.168.1.XXX, destination IP address is the public IP address of the cloud server (10.2X.3X.XX), source port is a temporary port randomly assigned to the office computer (56XXX), destination port is the service port corresponding to the business system of the cloud server (e.g., 80), and the transmission protocol is Transmission Control Protocol (TCP). This specific information of the message will fully present its transmission scenario and communication object. As the core matching basis, it is compared one by one with the security policies stored in the leaf nodes of the security policy (such as the policy of "allowing the 192.168.XX / XX network segment to access 10.2X.3X.XX: 80 port through the Transmission Control Protocol TCP") to finally determine whether there is a match and the corresponding control action.

[0175] The message field information under the attribute field can be specific message information related to the attribute field carried by the message to be matched. For example, the message field information corresponding to the "source IP address" attribute field is the specific network address of the sender of the message to be matched; the message field information of the "destination IP address" attribute field is the specific network address of the receiver; the message field information of the "source port number" and "destination port number" attribute fields is the specific port value used by the sender and receiver when communicating; and the message field information of the "transmission protocol type" attribute field is the specific protocol (such as TCP) followed by the message transmission.

[0176] In practice, when the firewall system receives a packet to be matched, it first parses the packet and extracts the packet field information corresponding to each of the predefined multiple attribute fields.

[0177] B2: Traverse each security policy tree in turn, and for the current security policy tree, determine the target leaf node in the security policy tree that matches the message to be matched, based on the hierarchical order of each node in the security policy tree, the target bits corresponding to each node, and the message value of the message field information under the target bits.

[0178] Here, the target leaf node is the leaf node in the security policy tree that matches the packet to be matched. Understandably, the target leaf node for some security policy trees may be empty.

[0179] In practice, each security policy tree can be traversed sequentially according to its construction order. For the currently traversed security policy tree, the matching process begins from the root node: starting from the root node, the search proceeds layer by layer according to the hierarchical order of the nodes in the security policy tree. For a currently found node, it is determined whether the node is a leaf node. If so, it can be used as the target leaf node in the currently traversed security policy tree to match the message to be matched. If not, based on the target bits and message field information corresponding to the currently found node, the message value corresponding to each target bit is determined. Based on the message value, it is determined whether there is a next-hop child node among the direct child nodes of the currently found node that matches the message to be matched. If so, the step of determining whether the node is a leaf node is returned, until there is no next-hop child node or until the target leaf node that matches the message to be matched is determined, thus completing the traversal of the current security policy tree. If the target leaf node does not exist, it can be determined that there is no matching target leaf node in the currently traversed security policy tree, that is, the target leaf node is empty, and it can be determined that the traversal of the current security policy tree is complete. Then, if there is an untraversed security policy tree, the same node search process can be repeated for the next security policy tree.

[0180] B3: Based on the message field information and the policy attributes of each security policy stored in the target leaf node under each attribute field, determine the matching security policy in the target leaf node that matches the message to be matched, and use the matching security policy as the candidate security policy corresponding to the security policy tree.

[0181] Here, policy attributes refer to the various matching conditions that constitute the core content of security policy rules. Specifically, they are the policy scope information defined by the security policy in various attribute fields such as source address, destination address, protocol type, and port range, as well as the corresponding policy rules.

[0182] A candidate security policy is at least one security policy in a single security policy tree that successfully matches the message to be matched. As a candidate, it is used to participate in the global decision-making of the optimal security policy after all security policy trees have been traversed.

[0183] In practice, once the target leaf node in the security policy tree is located, each security policy stored within that leaf node is traversed sequentially. Based on the currently traversed security policy, and considering its policy attributes in each attribute field (such as source IP address range, destination IP address range, protocol type, source port range, and destination port range), as well as the packet field information of the packet to be matched in each attribute field (such as the actual source IP address, destination IP address, protocol type, source port number, and destination port number), it is determined whether the security policy matches the packet to be matched. For example, for the IP address field, it checks whether the packet address falls within the address range specified by the security policy; for the port field, it verifies whether the packet port is within the port range defined by the policy; for the protocol type, it determines whether the packet protocol is consistent with the policy requirements. If the policy attributes of all attribute fields of a security policy successfully match the packet field information, then the policy is determined to be a matching security policy, and the traversal continues to the next security policy until all security policies have been traversed, resulting in a set of matching security policies. If at least one attribute field of a security policy fails to match the message field information, then the security policy is determined to be mismatched with the message to be matched, and the process continues to traverse the next security policy. Finally, after traversal, all matching security policies are summarized and recorded as the candidate security policy set corresponding to the current security policy tree, for use in subsequent cross-tree decisions. Understandably, it is possible that none of the security policies stored in the target leaf node contain a matching security policy (i.e., the matching security policy is empty), in which case the candidate security policy corresponding to the current security policy tree is determined to be empty.

[0184] B4: Determine the target security policy that matches the packet to be matched based on the policy priority of the candidate security policies corresponding to each security policy tree.

[0185] Here, policy priority is a core attribute of the security policy itself, used to clarify the importance of different security policies. For example, the more important the security policy, the higher its execution priority. When a packet to be matched is matched with security policies of different priorities, the security policy with the highest policy priority is selected as the security policy to be executed for the packet to be matched. The target security policy is the security policy with the highest policy priority among all candidate security policies, which is the final matching result of the packet matching.

[0186] In practice, the candidate security policy with the highest priority can be selected based on the policy priority of each candidate security policy corresponding to each security policy tree, and then returned as the target security policy to be matched with the message to be matched.

[0187] like Figure 2 The above is a schematic diagram of a security policy matching process provided in an embodiment of this application. Starting from the arrival of a new message, the message field information under each attribute field of the message is first extracted, and the matching result set is initialized. Then, all security policy trees are traversed sequentially. In each security policy tree, single-tree matching begins from the root node. During tree matching, for the current node, it is determined whether the current node is a leaf node. If so, all security policies stored in the leaf node are linearly traversed to determine if a matching security policy exists that matches the message. Each determined matching security policy is added to the matching result set R. The traversal of all security policies in the leaf node is then complete, indicating that the current security policy tree traversal is finished. If the current node is not a leaf node, based on the target bits corresponding to the current node and the bit values ​​corresponding to the message field information under each target bit, it is determined whether a matching next-hop child node exists among the child nodes of the current node. If it exists, the next-hop child node is used as the new current node, and the step of determining whether the current node is a leaf node is returned. If it does not exist, the current security policy tree traversal is considered complete. After completing the traversal of the current security policy tree, determine whether all security policy trees have been traversed. If so, compare the policy priorities of all matching security policies in the result set R and output the security policy with the highest priority as the final matching result. If not, continue traversing the next security policy tree until all security policy trees have been traversed, and output the final matching result.

[0188] The security policy tree construction method provided in this application optimizes the efficiency of security policy matching and system resource utilization by splitting a large-scale security policy set into multiple independent security policy trees. By introducing multiple configurable parameters (including influence factor m, first quantity num_op, combination upper limit k, and leaf node policy threshold), multi-objective optimization aims to synergistically optimize three core performance indicators: memory usage, matching latency, and construction time. Based on a two-stage bit filtering mechanism of coarse and fine selection, combined with a policy-free replication construction architecture for multiple security policy trees, a complete and engineering-implementable technical path is provided for achieving efficient processing of large-scale security policies.

[0189] Based on the same inventive concept, this application also provides a security policy tree construction device corresponding to the security policy tree construction method. Since the principle of the device in this application is similar to the security policy tree construction method described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0190] like Figure 3 The diagram shown is a schematic of a security policy tree construction device provided in an embodiment of this application, comprising:

[0191] The first determining module 301 is used to determine whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node in the currently constructed security policy tree.

[0192] The filtering module 302 is used to determine at least one bit to be selected from a plurality of preset bits, based on the selected bits of the parent nodes of the current node at each level in the security policy tree.

[0193] The second determining module 303 is used to determine the number of policies for each selected bit under different bit values ​​based on the bit value of each security policy to be assigned under each selected bit.

[0194] The construction module 304 is used to determine the target bit selected by the current node from the various bits to be selected based on the number of policies, the number of targets and the current depth of the security policy tree, and to construct each child node corresponding to the current node based on the number of target bits.

[0195] The third determining module 305 is used to determine the security policy to be assigned for each child node based on the bit value of each security policy to be assigned under each target bit.

[0196] The loop module 306 is used to return the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until each leaf node of the security policy tree is constructed.

[0197] In one possible implementation, the device further includes a storage module 307 for:

[0198] If the current node is a leaf node, then all security policies to be assigned corresponding to the current node are stored in the current node.

[0199] In one possible implementation, the construction module 304, when determining the target bit selected by the current node from among the bits to be selected based on the number of policies, the number of targets, and the current depth of the security policy tree, is configured to:

[0200] Based on the number of strategies for each bit to be selected under different bit values, determine the strategy similarity / similarity parameter corresponding to each bit to be selected;

[0201] The first quantity is determined based on the target quantity, the current depth, and the number of bits in the preset bit.

[0202] Based on the ascending sorting order of the various strategy similarity difference parameters and the first quantity, a first quantity of candidate bits is selected from the bits to be selected.

[0203] The target bit is determined based on each of the candidate bits.

[0204] In one possible implementation, the construction module 304, when filtering out a first number of candidate bits from the bits to be selected based on the ascending sorting order of the respective strategy similarity difference parameters and the first number, is configured to:

[0205] In the process of selecting a first number of candidate bits according to the ascending order of the strategy similarity difference parameters, if there are at least two candidate bits that are sequentially adjacent in ascending order and have the same strategy similarity difference parameters, then one candidate bit is selected from the at least two candidate bits as the candidate bit.

[0206] In one possible implementation, the construction module 304, when determining the target bit based on each of the candidate bits, is configured to:

[0207] Based on the first quantity and the preset combination quantity threshold, a target combination method is determined from a variety of preset combination methods; the preset combination methods include sequential combination method and full combination method;

[0208] According to the target combination method, the candidate bits are arranged and combined to obtain multiple candidate bit combinations;

[0209] Based on the second number of target candidate bits in each candidate bit combination and the second number of target policies with target bit values ​​under each candidate bit combination, a target bit combination is selected from the plurality of candidate bit combinations;

[0210] Each target candidate bit in the target bit combination is taken as the target bit.

[0211] In one possible implementation, the construction module 304, when arranging and combining the candidate bits according to the target combination method to obtain multiple candidate bit combinations, is used to:

[0212] When the target combination method is the sequential combination method, the ascending order of each candidate bit is determined according to the second strategy quantity of each candidate bit under the target bit value, and the candidate bits are arranged and combined according to the ascending order of each candidate bit to obtain the first number of candidate bit combinations.

[0213] Alternatively, if the target combination method is a full combination method, each candidate bit is fully combined to obtain multiple non-empty candidate bit combinations.

[0214] In one possible implementation, the construction module 304, when selecting a target bit combination from the plurality of candidate bit combinations based on a second number of target candidate bits in each candidate bit combination and a second number of target policies with target bit values ​​under each candidate bit combination for the security policy to be assigned, is configured to:

[0215] For any of the candidate bit combinations, determine the number of non-empty child nodes under the candidate bit combination;

[0216] The strategy partitioning cost of the candidate bit combination is determined based on the target number, the second strategy number, and the number of non-empty child nodes.

[0217] Based on the strategy-based cost allocation for each candidate bit combination, the target bit combination is selected from the plurality of candidate bit combinations.

[0218] In one possible implementation, the third determining module 305, when determining the security policy to be allocated for each child node based on the bit value of each security policy to be allocated under each target bit, is configured to:

[0219] Based on the bit value of each security policy to be assigned under each target bit, determine whether there exists a first security policy with a target bit value under any target bit among the security policies to be assigned;

[0220] If so, for each of the second security policies other than the first security policy in the security policies to be allocated, the child node corresponding to the second security policy is determined according to the combination of bit values ​​of the second security policy under each target bit;

[0221] The loop module 306, after constructing each leaf node of the security policy tree, is further configured to:

[0222] If the first security policy exists, then the first security policy will be used as the security policy to be assigned corresponding to the root node of the next security policy tree to be constructed.

[0223] Continue building the next security policy tree and use the next security policy tree as the currently built security policy tree. Return to the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until the first security policy does not exist, and obtain each security policy tree.

[0224] In one possible implementation, the first determining module 301, when determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, is configured to:

[0225] The target policy threshold is determined based on the application requirements of the security policy; the application requirements include at least one of the following: matching latency requirements, memory limits, and build time requirements.

[0226] Based on the target number of each security policy to be assigned to the current node and the relationship between the target number and the threshold of the target policy, it is determined whether the current node is a leaf node.

[0227] In one possible implementation, the apparatus further includes a matching module 308, which, after obtaining the various security policy trees, is used to:

[0228] In response to receiving a message to be matched, determine the message field information of the message to be matched under each attribute field;

[0229] Each security policy tree is traversed sequentially, and for the currently traversed security policy tree, the target leaf node in the security policy tree that matches the message to be matched is determined according to the hierarchical order of each node in the security policy tree, the target bit corresponding to each node, and the message value of the message field information under the target bit.

[0230] Based on the message field information and the policy attributes of each security policy stored in the target leaf node under each attribute field, determine the matching security policy in the target leaf node that matches the message to be matched, and use the matching security policy as the candidate security policy corresponding to the security policy tree.

[0231] Based on the policy priority of each candidate security policy corresponding to the security policy tree, the target security policy that matches the message to be matched is determined.

[0232] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0233] Based on the same technical concept, embodiments of this application also provide a computer device. (Refer to...) Figure 4 The diagram shown is a structural schematic of a computer device provided in an embodiment of this application, comprising:

[0234] The system includes a processor 401, a memory 402, and a bus 403. The memory 402 stores machine-readable instructions executable by the processor 401. The processor 401 executes these machine-readable instructions, and when executed, it performs the following steps: S101: For the current node in the currently constructed security policy tree, determine whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node; S102: If not, determine at least one to-be-selected bit from multiple preset bits based on the selected bits of the parent nodes already constructed at each level in the security policy tree; S103: Based on each security policy to be assigned, determine the target number of each security policy to be assigned to the current node in the current node's position in the security policy tree. S104: Determine the number of policies for each candidate bit under different bit values ​​based on the number of policies, the number of targets, and the current depth of the security policy tree; S105: Determine the target bit selected by the current node from each candidate bit, and construct each child node corresponding to the current node based on the number of target bits; S106: Determine the security policy to be assigned to each child node based on the bit value of each security policy to be assigned under each target bit; and S107: Return the step of determining whether the current node is a leaf node based on the number of targets of each security policy to be assigned to the current node, until each leaf node of the security policy tree is constructed.

[0235] The aforementioned memory 402 includes a main memory 4021 and an external memory 4022. The main memory 4021, also known as internal memory, is used to temporarily store the computational data in the processor 401, as well as the data exchanged with external memory such as a hard disk 4022. The processor 401 exchanges data with the external memory 4022 through the main memory 4021. When the computer device is running, the processor 401 and the memory 402 communicate through the bus 403, so that the processor 401 executes the execution instructions mentioned in the above method embodiments.

[0236] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the security policy tree construction method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0237] This application also provides a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the security policy tree construction method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0238] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0239] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interface; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0240] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0241] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0242] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0243] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the user through pop-up information or by asking the user to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0244] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for constructing a security policy tree, characterized in that, The method includes: For the current node in the currently constructed security policy tree, determine whether the current node is a leaf node based on the target number of each security policy to be assigned to the current node. If not, then from multiple preset bits, at least one bit to be selected is determined based on the selected bits of the parent nodes that have been built at each level in the security policy tree for the current node; Based on the bit value of each security policy to be assigned under each selectable bit, determine the number of policies for each selectable bit under different bit values; Based on the number of policies, the number of targets, and the current depth of the security policy tree, the target bit selected by the current node is determined from each of the bits to be selected, and each child node corresponding to the current node is constructed according to the number of target bits. Based on the bit value of each security policy to be assigned under each target bit, determine the security policy to be assigned for each child node; Return to the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until all leaf nodes of the security policy tree are constructed; The step of determining the target bit selected by the current node from among the candidate bits based on the number of policies, the number of targets, and the current depth of the security policy tree includes: Based on the number of strategies for each candidate bit under different bit values, a strategy similarity parameter is determined for each candidate bit; the strategy similarity parameter is calculated according to the following formula: ； in, This represents the strategy similarity / similarity parameter of the i-th candidate bit b_i in the first bit set; the first bit set is the set of all candidate bits corresponding to the current node. This represents the number of policies in P where b_i has a value of 0; P is the set of all security policies to be assigned to the current node. This represents the number of strategies in P where b_i has a value of 1; This represents the absolute value of the difference between the number of policies in P where b_i is 0 and the number of policies in P where b_i is 1. This indicates that the value of b_i in P is... The number of strategies, This represents either "any" or "not concerned"; m is a preset influence factor. Based on the target number, the current depth, and the number of bits of the preset bit, a first quantity is determined; based on the ascending sorting order of the various strategy similarity parameters and the first quantity, a first quantity of candidate bits is selected from the bits to be selected; based on each of the candidate bits, the target bit is determined.

2. The method according to claim 1, characterized in that, The method further includes: If the current node is a leaf node, then all security policies to be assigned corresponding to the current node are stored in the current node.

3. The method according to claim 1, characterized in that, The step of selecting a first number of candidate bits from the bits to be selected based on the ascending sorting order of the various strategy similarity parameters and the first quantity includes: In the process of selecting a first number of candidate bits according to the ascending order of the strategy similarity and difference parameters, if there are at least two candidate bits that are adjacent in ascending order and have the same strategy similarity and difference parameters, then one candidate bit is selected from the at least two candidate bits as the candidate bit.

4. The method according to claim 1, characterized in that, Determining the target bit based on each of the candidate bits includes: Based on the first quantity and the preset combination quantity threshold, a target combination method is determined from a variety of preset combination methods; the preset combination methods include sequential combination method and full combination method; According to the target combination method, the candidate bits are arranged and combined to obtain multiple candidate bit combinations; Based on the second number of target candidate bits in each candidate bit combination and the second number of target policies with target bit values ​​under each candidate bit combination for the security policy to be assigned, target bit combinations are selected from the plurality of candidate bit combinations; the second number of policies is the number of target candidate bits in each candidate bit combination for each security policy to be assigned corresponding to the current node, where the value is taken on at least one target candidate bit in each candidate bit combination. The number of security policies to be assigned that cannot be clearly divided into any child node corresponding to the current node by the candidate bit combination; Each target candidate bit in the target bit combination is taken as the target bit.

5. The method according to claim 4, characterized in that, The step of arranging and combining the candidate bits according to the target combination method to obtain multiple candidate bit combinations includes: When the target combination method is the sequential combination method, the ascending order of each candidate bit is determined according to the first strategy quantity of each candidate bit under the target bit value, and the candidate bits are arranged and combined according to the ascending order of each candidate bit to obtain the first number of candidate bit combinations. Alternatively, if the target combination method is a full combination method, each candidate bit is fully combined to obtain multiple non-empty candidate bit combinations.

6. The method according to claim 4, characterized in that, The step of selecting a target bit combination from the plurality of candidate bit combinations based on a second number of target candidate bits in each candidate bit combination and a second number of target policies with target bit values ​​under each candidate bit combination for the security policy to be allocated includes: For any of the candidate bit combinations, determine the number of non-empty child nodes under the candidate bit combination; wherein, the number of non-empty child nodes is the number of valid child nodes of the current node that have been assigned a security policy to be assigned among the potential child nodes corresponding to the candidate bit combination; the number of potential child nodes is determined based on the second number of target candidate bits in each candidate bit combination; The strategy partitioning cost of the candidate bit combination is determined based on the target number, the second strategy number, and the number of non-empty child nodes. Based on the strategy-based cost allocation for each candidate bit combination, the target bit combination is selected from the plurality of candidate bit combinations.

7. The method according to claim 1, characterized in that, The step of determining the security policy to be assigned for each child node based on the bit value of each security policy to be assigned under each target bit includes: Based on the bit value of each security policy to be assigned under each target bit, determine whether there exists a first security policy with a target bit value under any target bit among the security policies to be assigned; If so, for each of the second security policies other than the first security policy in the security policies to be allocated, the child node corresponding to the second security policy is determined according to the bit value of the second security policy under each target bit; After constructing the leaf nodes of the security policy tree, the method further includes: If the first security policy exists, then the first security policy will be used as the security policy to be assigned corresponding to the root node of the next security policy tree to be constructed. Continue building the next security policy tree and use the next security policy tree as the currently built security policy tree. Return to the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until the first security policy does not exist, and obtain each security policy tree.

8. The method according to claim 1, characterized in that, The step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node includes: The target policy threshold is determined based on the application requirements of the security policy; the application requirements include at least one of the following: matching latency requirements, memory limits, and build time requirements. Based on the target number of each security policy to be assigned to the current node and the relationship between the target number and the threshold of the target policy, it is determined whether the current node is a leaf node.

9. The method according to claim 7, characterized in that, After obtaining the various security policy trees, the method further includes: In response to receiving a message to be matched, determine the message field information of the message to be matched under each attribute field; Each security policy tree is traversed sequentially, and for the currently traversed security policy tree, the target leaf node in the security policy tree that matches the message to be matched is determined according to the hierarchical order of each node in the security policy tree, the target bit corresponding to each node, and the message value of the message field information under the target bit. Based on the message field information and the policy attributes of each security policy stored in the target leaf node under each attribute field, determine the matching security policy in the target leaf node that matches the message to be matched, and use the matching security policy as the candidate security policy corresponding to the security policy tree. Based on the policy priority of each candidate security policy corresponding to the security policy tree, the target security policy that matches the message to be matched is determined.

10. A security policy tree construction device, characterized in that, The device includes: The first determining module is used to determine whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node in the currently constructed security policy tree. The filtering module is used to determine, if not, from a plurality of preset bits, including at least one bit to be selected based on the selected bits of the parent nodes already constructed at each level of the current node in the security policy tree; The second determining module is used to determine the number of policies for each selected bit under different bit values ​​based on the bit value of each security policy to be assigned under each selected bit. A construction module is configured to determine the target bit selected by the current node from among the candidate bits based on the number of policies, the number of targets, and the current depth of the security policy tree, and to construct each child node corresponding to the current node based on the number of target bits; wherein, when determining the target bit selected by the current node from among the candidate bits based on the number of policies, the number of targets, and the current depth of the security policy tree, the construction module is configured to: determine the policy similarity / similarity parameter corresponding to each candidate bit based on the number of policies for each candidate bit under different bit values; the policy similarity / similarity parameter is calculated according to the following formula: ； in, This represents the strategy similarity / similarity parameter of the i-th candidate bit b_i in the first bit set; the first bit set is the set of all candidate bits corresponding to the current node. This represents the number of policies in P where b_i has a value of 0; P is the set of all security policies to be assigned to the current node. This represents the number of strategies in P where b_i has a value of 1; This represents the absolute value of the difference between the number of policies in P where b_i is 0 and the number of policies in P where b_i is 1. This indicates that the value of b_i in P is... The number of strategies, This represents either "any" or "not concerned"; m is a preset influence factor. Based on the target number, the current depth, and the number of bits of the preset bit, a first number is determined; based on the ascending sorting order of the various strategy similarity parameters and the first number, a first number of candidate bits are selected from the bits to be selected; based on each of the candidate bits, the target bit is determined. The third determining module is used to determine the security policy to be assigned to each child node based on the bit value of each security policy to be assigned under each target bit. The loop module is used to return the step of determining whether the current node is a leaf node based on the target number of each security policy to be assigned corresponding to the current node, until each leaf node of the security policy tree is constructed.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 9.

12. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 9.

Images