Security policy matching method and device, storage medium and computing equipment

Abstract

The invention provides a security policy matching method and device, a storage medium and computing equipment, when any security policy tree is constructed, the node priority is set for each tree node, so that the node priority of each tree node can accurately reflect the highest policy priority of the subordinate sub-tree, and the security policy matching efficiency is improved. Therefore, a core basis is provided for low-priority node pruning during security policy matching, orderliness of node priority dynamic maintenance is guaranteed, and security policy matching efficiency is improved. Moreover, the early stop attribute is set for the security policy of the leaf node in the multi-security policy tree by stages, so that the fast marking of the security policy with the absolute high policy priority is realized, the accurate marking of the security policy with the non-absolute high policy priority but no intersection is realized, and the accurate setting of the early stop attribute of the security policy is realized by combining the fast marking and the accurate marking of the security policy with the non-absolute high policy priority. Therefore, the large-scale security policy matching efficiency is improved, the optimal matching result is guaranteed, the calculation overhead is reduced, and the matching performance of the security policy tree is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a security policy matching method and device, a storage medium and a computing device. BACKGROUND

[0002] In a cloud computing multi-tenant scenario, as the number of tenants increases, the number of firewall security policies for ensuring tenant access security also increases continuously, and even reaches the order of magnitude of hundreds of thousands or even millions of policies. While the number of security policies increases, higher and higher requirements are put forward for the memory occupation during security policy matching and the timeliness of security policy dynamic upgrading. In order to reduce the memory occupation of security policy matching and speed up dynamic upgrading, the storage structure of security policies gradually changes from a single security policy tree to multiple security policy trees.

[0003] However, when security policy matching is performed based on multiple security policy trees, the matching performance is still poor. Therefore, how to improve the matching performance under multiple security policy trees has become a technical difficulty worthy of attention. SUMMARY

[0004] Therefore, the present application provides a security policy matching method and device, a storage medium and a computing device, aiming to solve the problem of poor matching performance when security policy matching is performed based on multiple security policy trees.

[0005] Specifically, the present application is implemented through the following technical solutions: In the first aspect, the present application provides a security policy matching method, comprising: In the process of constructing any security policy tree in the multiple security policy trees, according to each to-be-assigned security policy, constructing each non-leaf node and each leaf node, and determining and storing the leaf node required for storing each security policy; setting the node priority of each non-leaf node as an invalid priority, and determining the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node; traversing the security policy tree by using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order according to the traversal order; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node; traversing the first node linked list, and for the tree node currently traversed, determining the latest node priority of the parent node according to the current node priority of the tree node and the current node priority of the parent node of the tree node; The matching module is configured to receive a to-be-matched packet, determine a security policy matching result matched with the to-be-matched packet from the plurality of constructed security policy trees according to packet information of the to-be-matched packet in each preset matching field, and node priorities of each tree node in each of the plurality of constructed security policy trees and policy priorities of each security policy stored in each leaf node.

[0006] In a second aspect, an embodiment of the present application provides a security policy matching device, comprising: The constructing module is configured to, in the process of constructing any security policy tree in the plurality of security policy trees, construct each non-leaf node and each leaf node according to each to-be-distributed security policy, and determine and store a leaf node required to store each security policy. The first determining module is configured to set a node priority of each non-leaf node as an invalid priority, and determine a node priority of each leaf node according to a policy priority of each security policy stored in each leaf node. The generating module is configured to traverse the security policy tree by using a breadth-first traversal manner to obtain a first node linked list; the first node linked list stores each tree node in a reverse order according to a traversal order; the tree node is a leaf node or a non-leaf node; a storage position of the leaf node is located before a storage position of the non-leaf node. The second determining module is configured to traverse the first node linked list, and determine a latest node priority of a parent node of a currently traversed tree node according to a current node priority of the tree node and a current node priority of the parent node. The matching module is configured to receive a to-be-matched packet, determine a security policy matching result matched with the to-be-matched packet from the plurality of constructed security policy trees according to packet information of the to-be-matched packet in each preset matching field, and node priorities of each tree node in each of the plurality of constructed security policy trees and policy priorities of each security policy stored in each leaf node.

[0007] In a third aspect, an embodiment of the present application provides a computer readable storage medium, a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the first aspect or any possible implementation manner of the first aspect when executing the program.

[0008] In a fourth aspect, an embodiment of the present application provides a computing device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the first aspect or any possible implementation manner of the first aspect when executing the program.

[0009] For the effect description of the above security policy matching device, computer readable storage medium and computing device, see the following description of the security policy matching method, which is not described here.

[0010] The security policy matching method, device, storage medium and computing device provided by the embodiments of the present application, compared with the prior art, use the size relationship between the priority of the security policy tree and the priority of the security policy for security policy matching in the multi-security policy tree scenario, which leads to the problems of insufficient fine-grained matching and poor matching performance. By constructing the first node linked list in front of the leaf node when constructing the security policy tree and setting the node priority of each non-leaf node using the first node linked list, the priority transmission rule that the node priority of the child node determines the node priority of the parent node can be implemented, so that not only the accurate priority of each tree node can be set, but also the priority of each tree node can accurately reflect the highest policy priority of its subordinate sub-tree, thereby providing a core basis for pruning low-priority nodes during security policy matching and guaranteeing the orderliness of dynamic maintenance of node priority. During security policy matching, the node priority of each tree node in the constructed security policy tree and the policy priority of each security policy stored in each leaf node are used, so that the sub-tree under the low node priority can be skipped, thereby avoiding invalid matching of security policies, improving the matching efficiency of large-scale security policies, guaranteeing the optimal matching result, and improving the matching performance of the multi-security policy tree.

[0011] Further, the security policy matching method, device, storage medium and computing device provided by the embodiments of the present application, when performing the addition and editing operations of the security policy, accurately locate the leaf node to which the security policy to be operated belongs and perform the corresponding operation first, then dynamically adjust the leaf node priority combined with the policy priority, and finally update the node priority of each parent node based on the node linked list, which not only strictly follows the core logic of the security policy tree that the node priority of the child node determines the node priority of the parent node, but also guarantees the accurate and efficient dynamic calibration of the whole tree priority information after the security policy changes, guarantees the accuracy of the node priority, provides reliable support for accurate pruning during subsequent security policy matching, and effectively adapts to the core needs of large-scale security policy dynamic management. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 A flowchart of a security policy matching method provided by the embodiments of the present application is shown; Figure 2 A structure diagram of a security policy tree provided by the embodiments of the present application is shown; Figure 3 A specific flowchart of a security policy tree construction and tree node priority setting method provided by the embodiments of the present application is shown; Figure 4This paper illustrates a detailed flowchart of a security policy matching method provided in an embodiment of this application. Figure 5 A schematic diagram of a security matching device provided in an embodiment of this application is shown; Figure 6 A schematic diagram of the structure of a computing device provided in an embodiment of this application is shown. Detailed Implementation

[0013] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0014] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0015] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0016] It is found through research that, in the scenario of applying firewall security policies to cloud computing multi-tenancy, with the increase of cloud computing tenants, the number of firewall security policies has increased from nearly ten thousand in the past to hundreds of thousands or even millions, which puts higher requirements on the matching performance of security policies. Therefore, the way of constructing a security policy tree for security matching has gradually emerged. In the application of security policy tree, to solve the problems of high memory occupation of policy matching in the security policy tree and low efficiency of dynamic upgrading of the security policy tree, the storage structure of the security policy tree has developed from a single policy tree to multiple policy trees. However, in the matching of security policies based on multiple policy trees, it is usually necessary to traverse multiple security policy trees to find matching security policies. The matching of multiple security policy trees is based on the matching of a single policy tree, which specifically traverses each security policy tree to find matching security policies in each security policy tree, and then compares the policy priorities of the matching security policies in each security policy tree to obtain an optimal matching security policy. This will result in poor matching performance due to the traversal time of each security policy tree. In order to reduce the traversal and matching time of each security policy tree, two types of solutions have been proposed in existing technologies. One type of solution sets a tree priority for each security policy tree, and determines whether to skip the traversal of the entire tree based on the tree priority. For example, when sequentially traversing multiple security policy trees for security policy matching, if the policy priority of the matched security policy is higher than the tree priority of the currently traversed security policy tree, the security policy tree is skipped; otherwise, all tree nodes in the security policy tree are traversed to find matching security policies, and the security policy with the highest policy priority is retained. This type of technical solution can only implement the extreme operation of skipping or completely traversing the entire tree, and lacks more fine-grained optimization for the middle level of the security policy tree, resulting in still a large number of invalid tree nodes being traversed. Another type of solution determines the early stop attribute of each security policy by judging the intersection relationship between security policies, and uses the early stop attribute of the security policy to improve the matching efficiency. However, in the judgment of the intersection relationship between security policies, for each security policy, intersection test needs to be performed with all security policies in the large-scale security policy set. If a low-priority security policy intersects with at least one high-priority security policy, the low-priority security policy is not early-stopped for matching; otherwise, if the low-priority security policy does not intersect with all high-priority security policies, the low-priority security policy has early-stopped matching property.This scheme needs n2 intersection tests when constructing a security policy tree (n is the number of security policies), and although it can ensure the timeliness of the construction of the security policy tree in the case of a small n or offline construction of the security policy tree, the calculation amount of the online construction of the security policy tree will surge in the case of large-scale security policy matching, greatly increasing the construction time of the security policy tree, resulting in the inability to meet the efficient online processing demand and reducing the efficiency of the security policy set used for matching, and affecting the dynamic upgrade effect of the security policy. Meanwhile, since the setting and dynamic maintenance logic of the node priority of the nodes under the multiple security policy trees are not considered, the traversal delay of the security policy tree still has optimization space, affecting the matching efficiency of the security policy matching and the matching performance of the security policy tree.

[0017] Based on the above research, to solve the above technical problems, the present application provides a security policy matching method, device, storage medium and computing equipment, by constructing a first node linked list in front of the leaf nodes when constructing a security policy tree and setting the node priority of each non-leaf node by using the first node linked list, the priority transmission rule that the node priority of the child node determines the node priority of the parent node can be realized, so that not only the accurate priority of each tree node can be set, but also the priority of each tree node can accurately reflect the highest policy priority of the subordinate subtree, thereby providing a core basis for pruning low-priority nodes during security policy matching and guaranteeing the orderliness of dynamic maintenance of the node priority. During security policy matching, by using the node priority of each tree node in the constructed security policy tree and the policy priority of each security policy stored in each leaf node, the subtree under the low node priority can be skipped, thereby avoiding the invalid matching of the security policy, improving the matching efficiency of the large-scale security policy, guaranteeing the optimal matching result, and realizing the improvement of the matching performance of the multiple security policy trees.

[0018] The above-mentioned defects are the results of the inventors after careful research and practice, and therefore, the discovery process of the above-mentioned problems and the solutions proposed by the present application to solve the above-mentioned problems belong to the contributions of the inventors to the present application.

[0019] It should be noted that similar reference numbers and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0020] It can be understood that before using the technical solutions disclosed in the embodiments of the present application, the type, use range, use scenario, etc. of the personal information involved in the present application should be informed to the user and the authorization of the user should be obtained through appropriate means in accordance with relevant laws and regulations.

[0021] It should be noted that the specific terms mentioned in the embodiments of the present application include: ClassBench: a tool set for testing packet classification algorithm and classification device performance, including parameter file, rule set generator and packet generator; ACL_100k: refers to 100,000 rules set of Access Control List (Access Control List), ACL rules mainly based on five-tuple (source IP address, destination IP address, source port, destination port, protocol number) and other information of data packet, realize the release or intercept control of data packet, is the basic rule type of network security and traffic control; FW_100k: refers to 100,000 rules set of Firewall (Firewall, referred to as FW), firewall rules further integrate traffic filtering, security policy control and other more complex logic based on ACL, not only can realize basic access control, but also can accurately identify and process specific application layer protocol, malicious traffic characteristics and the like; IPC_100k: refers to 100,000 rules set of IP chain (IP chain), IP chain rules are often applied to link layer forwarding control, traffic routing planning and other scenarios of network data packet, and the rule design is more focused on the transmission path and forwarding strategy definition of data packet between different network links.

[0022] In order to facilitate the understanding of the present application, first, a kind of security policy matching method disclosed in the embodiments of the present application will be described in detail, the execution subject of the security policy matching method provided by the present application is generally terminal device or other processing device with certain computing capacity, wherein the terminal device can be user equipment (User Equipment, UE), mobile device, user terminal, terminal, personal digital assistant device (Personal Digital Assistant, PDA), handheld device, computing device, etc.;In some possible implementation ways, the security policy matching method can be realized by the way of processor calling computer readable instructions stored in memory.

[0023] Next, taking the execution subject as a computing device as an example, the security policy matching method provided by the present application is introduced.

[0024] As Figure 1 shown, the flow chart of the security policy matching method provided by the present application can include the following steps: S101: in the process of constructing any security policy tree in multiple security policy trees, according to each security policy to be allocated, each non-leaf node and each leaf node are constructed, and each security policy required to store the leaf node is determined and stored.

[0025] Here, the security policy matching method provided by the embodiments of the present application can be applied to the scenario of firewall security policy matching based on a security policy tree, and the matching performance of the security policy tree will be significantly improved as the size of the security policy set increases. Therefore, the security policy matching method provided by the embodiments of the present application is particularly suitable for security policy matching based on a security policy tree in a large-scale security policy set. For example, security policy matching in a cloud computing multi-tenant scenario, security policy matching in a complex network environment scenario, security policy matching in a terminal-intensive network scenario, and the like.

[0026] A security policy is a preset rule set for network security management and control, and can be divided into various types such as physical security, access control, information encryption, and security management. A security policy can be used for network security devices to implement traffic control and access permission management. The security policy in the present application may, for example, include various firewall security policies. In a security policy, policy information related to preset matching domains such as source IP address, destination IP address, source port number, destination port number, and transmission protocol, a policy priority parameter for distinguishing execution priority, and access rules such as allowed access and denied access can be included. Each security policy can be divided according to relevant dimensions (such as matching domains, multi-bit attributes, etc.) and managed by a security policy tree organization.

[0027] The security policy to be allocated can be in a security policy set, which is a security policy that has not yet been allocated to any security policy tree that has been constructed. Where a security policy is allocated to a security policy tree, it can be understood that the security policy is stored in a certain leaf node in the security policy tree. When the security policy set is obtained, each security policy in the security policy set needs to be allocated to different security policy trees for storage by constructing multiple security policy trees. The same security policy will only be allocated to one security policy tree, so there is no duplication of security policies among the various security policy trees in the present application. The number of security policies allocated in different security policy trees can be different. For example, there are 100,000 security policies in a security policy set, and in the construction of the first security policy tree, the 100,000 security policies are all allocated as the security policies to be allocated corresponding to the first security policy tree. Assuming that 1000 security policies are allocated in the first security policy tree, then the security policies to be allocated corresponding to the second security policy tree are the remaining 99,000 security policies. As the number of security policy trees that have been constructed increases, the security policies to be allocated corresponding to the new security policy trees to be constructed will become fewer and fewer.

[0028] Generally, when constructing any one of the security policy trees, the root node of the security policy tree can be constructed first, then the various child nodes under the root node can be constructed, then the child nodes of the child nodes can be constructed, and finally the various leaf nodes can be constructed. Therefore, the non-leaf node can be a tree node in the security policy tree, other than the leaf node, and various tree nodes at the intermediate level. The non-leaf node does not directly store the security policy, but is only used to organize the hierarchical structure of the security policy tree, so as to facilitate positioning to the leaf node based on the search of the different hierarchical non-leaf nodes during the security policy matching. When constructing the non-leaf node, the non-leaf node can be provided with a child node linked list and a parent node pointer. The child node linked list can include various direct child nodes of the current non-leaf node (i.e., various child nodes of the current non-leaf node at the next level), node priorities of the various child nodes, parent nodes of the various child nodes, and the like. The parent nodes of the various child nodes in the same child node linked list are the same. The parent node pointer is used to indicate the parent node of the non-leaf node. When the non-leaf node is the root node, since the root node does not have a parent node, the parent node pointer of the root node can be empty.

[0029] Specifically, the non-leaf node can be a tree node in the security policy tree, other than the leaf node, such as the root node and the intermediate node at the intermediate level. The non-leaf node is mainly used to indicate and organize the hierarchical logical structure of the security policy tree, and is configured with a child node linked list and a parent node pointer.

[0030] The security policy tree can be a multi-way tree. Each leaf node and non-leaf node in the tree can be referred to as a tree node of the security policy tree. The leaf node is a tree node in the security policy tree without a child node, that is, a tree node at the lowest level of the security policy tree. The leaf node can be used to store various security policies allocated to the security policy tree, and can be configured with a parent node linked list storing pointers of the parent nodes of the leaf node at various higher levels. For example, a security policy tree has a total of 5 levels from top to bottom. The leaf node can be a tree node at the lowest level. The parent node linked list of the leaf node can store, in sequence, the pointers of the parent nodes of the leaf node at the next level, the parent nodes at the level above,..., and the parent node at the highest level (i.e., the pointer of the root node).

[0031] The various to-be-allocated security policies corresponding to one security policy tree will be determined by a specific allocation algorithm. For example, all of the to-be-allocated security policies can be allocated to the security policy tree, or part of the to-be-allocated security policies can be allocated to the security policy tree. The remaining security policies that are not allocated to the security policy tree will be used as the to-be-allocated security policies corresponding to the next security policy tree. The allocation algorithm can use any one of the policy allocation algorithms in the prior art when constructing the security policy tree, such as the continuous multi-bit allocation algorithm, the discrete multi-bit allocation algorithm, and the like.

[0032] The security policies required to be stored in different leaf nodes are different. The number of security policies required to be stored in different leaf nodes has no strict quantitative relationship, and can be the same or different, which is determined by the allocation algorithm and the specific security policy.

[0033] In specific implementation, in the process of constructing any security policy tree in the plurality of security policy trees, the respective to-be-allocated security policies corresponding to the security policy tree can be determined, and then the allocation algorithm and the policy information of the respective to-be-allocated security policies under each preset matching field are used to construct the non-leaf nodes under each level and the respective leaf nodes under the leaf level, and the security policy required to be stored in each leaf node is determined from the respective to-be-allocated security policies and stored. In this way, the tree structure with clear logic is formed by constructing the tree nodes of different levels, and the level guidance for accurately positioning the leaf node to which each security policy belongs is provided; the leaf node is accurately positioned based on the matching field characteristics of the respective to-be-allocated security policies, and serves as the final carrier of policy storage to undertake the specific security policy, thereby providing bottom data support for the derivation and transmission of the priority of the subsequent non-leaf node.

[0034] S102: Set the node priority of each non-leaf node as an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in the leaf node.

[0035] Here, the policy priority is a core attribute of the security policy itself, and is used to explicitly indicate the importance of different security policies. For example, the higher the execution priority of the more important security policy is, and when the security policies matched by a to-be-matched packet have different policy priorities, the security policy with the highest policy priority is taken as the security policy corresponding to the to-be-matched packet that needs to be executed. The high and low of the policy priority can be represented by the size of the priority value, for example, "the smaller the value, the higher the priority". Assuming that the priority value of security policy A is 2, the priority value of security policy B is 5, and the priority value of security policy C is 3, then the priority of security policy A is the highest, followed by security policy C, and the priority of security policy B is the lowest. When multiple security policies all meet the matching condition, the security policy with the smallest priority value is taken as the optimal matching security policy.

[0036] The node priority is used to reflect the highest policy priority of the security policy stored in the subtree where the tree node is located. The high and low of the node priority can also be represented by the size of the priority value.

[0037] The invalid priority is used to indicate that the priority of the tree node is invalid. By setting the node priority of the non-leaf node as the invalid priority when constructing the security policy tree, and updating the node priority through S103 and S104, it can be obtained that the node priority of each non-leaf node can accurately represent the highest policy priority in the subtree where the non-leaf node is located.

[0038] For non-leaf nodes, according to the level to which they belong in the security policy tree, the non-leaf nodes can be divided into root nodes Node_Root under the root level and intermediate nodes Node_internal under the intermediate level, and the intermediate nodes can be represented as: Node_internal = { children: LinkedList <node>, parent: Node , priority: }. Wherein, children: LinkedList <node>each child node of the intermediate node, parent: Node the parent node of the child node, priority: represents the priority as invalid priority.

[0039] For a leaf node, the node priority can be determined according to the highest policy priority in each security policy stored by the leaf node. For example, the leaf node Node leaf can be represented as follows: Node leaf={parent: Node , priority: max(Policy_priority)}, where parent: Node represents the parent node of Node leaf. priority: max(Policy_priority) represents the node priority of the leaf node, and max(Policy_priority) represents the policy priority of the security policy with the highest policy priority among the security policies Policy stored by the leaf node.

[0040] In implementation, after each leaf node and each non-leaf node in the security policy tree is constructed, the node priority of each non-leaf node can be initialized as invalid priority, and the node priority of the parent node can be derived from the node priorities of its child nodes according to the transmission rule "the node priority of a child node determines the node priority of the parent node", and finally takes the highest node priority of all child nodes. At the same time, for each leaf node, the highest policy priority among the policy priorities of the security policies stored in the leaf node can be taken as the node priority of the leaf node. For example, a leaf node stores three security policies with policy priorities of 10, 8, and 15, respectively, and the node priority of the leaf node is 8.

[0041] S103: traverse the security policy tree using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order according to the traversal order; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is before the non-leaf node.

[0042] Here, the breadth-first traversal (BFS) is a traversal method that accesses all tree nodes layer by layer according to the levels of the security policy tree. In BFS traversal, the root node is often traversed first, then the non-leaf nodes at the intermediate level are traversed, and finally the leaf nodes at the lowest level are traversed. Through BFS traversal, each node that is traversed first in the security policy tree can be stored in reverse order, so in the first node linked list, the storage position of each leaf node is before the non-leaf node. For ease of understanding, reverse storage means that each tree node accessed when traversing the security policy tree is stored in the node linked list in the "first in last out" manner.

[0043] A first-node linked list is an ordered data structure used to store the nodes visited in the order they are traversed in a tree. For example, a first-node linked list can be a first-in, first-out (FIFO) stack linked list. For instance, a first-node linked list can first store the leaf nodes of the last level, then the intermediate nodes of each intermediate level, and finally the root node.

[0044] In practical implementation, for any security policy tree currently constructed, a breadth-first traversal can be used, following a preset direction, which can be from left to right or from right to left. First, the root node is traversed. Then, in order from higher-level intermediate levels to lower-level intermediate levels, all non-leaf nodes at each intermediate level are traversed layer by layer and stored in reverse order in the first node linked list. Finally, each leaf node at the lowest level of the security policy tree is traversed, and each leaf node encountered is stored in reverse order in the first node linked list. Leaf nodes are stored at the beginning of the first node linked list. After the leaf nodes are stored, the constructed first node linked list is obtained. For example, the first node linked list can be Stack = BFS(Tree_root); where Stack indicates that the first node linked list is a stack linked list, and BFS(Tree_root) indicates traversing from the root node to the leaf node. By constructing the first node linked list, it can be ensured that leaf nodes are visited before non-leaf nodes during subsequent traversals of the first node linked list.

[0045] like Figure 2 The diagram shown is a structural schematic of a security policy tree provided in an embodiment of this application. The tree has 4 levels and 21 nodes. Node 1 is the root node, nodes 2-10 are intermediate nodes, and nodes 11-21 are leaf nodes, storing security policies in the leaf nodes. When traversing according to BFS and from left to right, the first node linked list constructed sequentially stores nodes 11-21, nodes 5-10, nodes 2-4, and node 1.

[0046] S104: Traverse the first node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node.

[0047] Here, when updating the priority of a parent node, the parent node of a tree node can be the direct parent node of the tree node at the next higher level, or the parent node of the tree node at each higher level. To reduce the computational cost of updating node priorities, when updating the priority of the parent node of the currently traversed tree node, the priority of its direct parent node can be updated by comparing the priority of the currently traversed tree node with the priority of its direct parent node.

[0048] The current node priority of a tree node is a node priority currently set for the tree node. The current node priority of a parent node of the tree node is a node priority currently set for the parent node, which can be an invalid priority or a node priority at a certain value. Since the root node has no parent node, when the root node is reached in the traversal, there is no need to perform the operation of comparing and updating the node priority of the parent node. The node priority of the root node can be determined according to the highest node priority of each direct child node thereof. The latest node priority can be a node priority newly set for the parent node.

[0049] In a specific implementation, the first node linked list can be sequentially traversed. For a tree node currently traversed, the current node priority of the tree node can be obtained first (wherein, when the tree node is a leaf node, the current node priority of the tree node can be the highest policy priority in the security policy stored by the tree node; when the tree node is a non-leaf node, the current node priority of the tree node can be an invalid priority or a valid priority newly determined). Then, the direct parent node of the tree node can be determined according to the parent node linked list and the parent node pointer of the tree node. The current node priority of the tree node is compared with the current node priority of the direct parent node. If the current node priority of the tree node is higher than the current node priority of the direct parent node or the node priority of the direct parent node is an invalid priority, the current node priority of the tree node can be used as the latest node priority of the direct parent node, realizing the ordered transmission of the node priority from the child node to the parent node and completing the update of the node priority of the direct parent node. If the current node priority of the tree node is lower than or equal to the current node priority of the direct parent node, the current node priority of the direct parent node can be used as the latest node priority of the direct parent node, so that the node priority of the direct parent node does not need to be updated. With the continuous traversal of the first node linked list, the node priority of each level parent node can be dynamically updated to the highest node priority in all the child nodes thereof, finally guaranteeing the accuracy and consistency of the node priority of the entire security policy tree, and providing a reliable basis for the accurate pruning and early stopping judgment in the subsequent security policy matching.

[0050] For example, the process of updating the node priority can be implemented by the following code: : / / the tree node currently traversed belongs to the stack linked list if(node.parent.priority== ) (node.parent.priority<node.priority) / / if the parent node priority is invalid or the parent node priority is lower than the node priority of the tree node currently traversed then node.parent.priority:=node.priority / / Update the priority of the parent node to the priority of the currently traversed tree node.

[0051] Thus, based on the above S101~S104, it is possible to construct each of the multiple security policy trees and set the optimal node priority for each node of each security policy tree.

[0052] like Figure 3 The flowchart illustrates a method for constructing a security policy tree and setting tree node priorities, as provided in this application embodiment. During the construction of any security policy tree, based on the assigned security policies, non-leaf nodes and leaf nodes are constructed, and the leaf nodes required for each security policy are determined and stored. The priorities of non-leaf nodes are set to invalid priorities, and the priorities of leaf nodes are set to the highest priority among all stored security policies. Next, the security policy tree is traversed using BFS to construct a first node linked list, Stack. While traversing Stack, for each traversed tree node, it is determined whether the priority of its parent node is invalid or lower than the priority of its child nodes. If it is invalid or lower than the priority of its child nodes, the priority of the parent node is updated to the priority of its child nodes. If it is not invalid and is not lower than the priority of its child nodes, the update operation is skipped. Then, the process of traversing the next tree node in Stack and the priority judgment and update process continues until the traversal of Stack is completed, obtaining the latest node priorities of each tree node in the security policy tree. In this way, by constructing a stacked linked list using BFS, leaf nodes are accessed first, and the priority of a parent node is inherited from the maximum value of its child nodes.

[0053] S105: Receive the message to be matched, and determine the security policy matching result that matches the message to be matched from each of the pre-set matching fields based on the message information of the message to be matched in each preset matching field, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

[0054] Here, the security policy tree has been constructed, that is, a decision tree in which the node priorities of each tree node are set. The preset matching field is a field that is specified in advance, and the core dimension can be determined in advance according to various attributes corresponding to information included in the security policy and various attributes corresponding to information included in the to-be-matched packet. The preset matching field is a key judgment basis for accurate matching between the to-be-matched packet and the security policy stored in the leaf node in the security policy tree. The to-be-matched packet is a data packet carried by an access request initiated by a tenant, which needs to be verified by the security policy tree for security control. Each security policy can exist in the policy information under at least part of the preset matching field. For example, the preset matching field can include a source port field, a destination port field, a source Internet Protocol (IP) field, a destination IP field, a client identification field, a physical address field, a client attribute field, a client name field, and the like. According to the control requirements, optional matching fields such as packet types (data flow, control flow), network service types (such as HTTP, ) can also be supplemented. The to-be-matched packet is compared with the corresponding preset matching field conditions in the security policy through the specific packet information in these fields, and finally accurate matching with the target security policy is realized.

[0055] The security policy can include policy range information and corresponding policy rules under different preset matching fields. For example, a security policy allows or denies access of a to-be-matched packet in the source port range of 80-90 and the target port range of 100-120. A to-be-matched packet carries packet information such as a source port 85 and a target port 110.

[0056] For example, the preset matching field F can include m, where the number of m is not specifically limited in the present application, and can be set according to actual application scenarios and experience. That is, the domain dimension of the preset matching field F is m, and the policy matching field F={f1, f2, …, }, where f1 represents the first policy matching field, f2 represents the second policy matching field, f m represents the mth policy matching field, f1, f2, …, are all different.

[0057] The information carried by the to-be-matched packet covers packet information corresponding to different preset matching domains, and these information is the core basis for matching the security policy stored by the leaf node. For example, when a user accesses a business system on a company cloud server through an office computer, a data packet transmitted in the network is a to-be-matched packet, and the information corresponding to the preset matching domain covered by the to-be-matched packet is as follows: the source IP address is 192.168.1.XXX, the destination IP address is the public IP (10.2X.3X.XX) of the cloud server, the source port is a temporary port (56XXX) randomly allocated by the office computer, the destination port is a service port (such as 80) corresponding to the business system of the cloud server, and the transmission protocol is a Transmission Control Protocol (TCP) protocol. These specific information of the packet will completely present its transmission scenario and communication object, and will be compared with the security policy (such as the policy "allow 192.168.X.X / XX network segment to access 10.2X.3X.XX:80 port through Transmission Control Protocol (TCP) protocol") stored by the leaf node of the security policy tree one by one, to finally determine whether to match and the corresponding control action.

[0058] The packet information under the preset matching domain can be the specific value or characteristic data corresponding to the preset matching domain in the to-be-matched packet, is the objective attribute information carried by the packet itself, and is also the core actual basis for comparing the preset conditions of the corresponding matching domain in the security policy. For example, the packet information corresponding to the "source IP address" matching domain is the specific network address of the sending end of the to-be-matched packet, the packet information corresponding to the "destination IP address" matching domain is the specific network address of the receiving end, the packet information corresponding to the "source port number" and "destination port number" matching domains is the specific port value used by the sending end and the receiving end when communicating, and the packet information corresponding to the "transmission protocol type" matching domain is the specific protocol (such as TCP) followed by the packet transmission. These packet information completely presents the communication characteristics of the to-be-matched packet, and by accurately comparing the set conditions (such as IP network segment, port range, and protocol type) of each preset matching domain in the security policy, it can be determined whether the packet meets the matching requirements of the security policy.

[0059] In implementation, after receiving the to-be-matched message, message information of the to-be-matched message in each preset matching field can be extracted, and then each constructed security policy tree can be sequentially traversed. For the currently traversed constructed security policy tree, a matched tree node can be sequentially found from the constructed security policy tree according to the message information, the node priority of each tree node in the constructed security policy tree, and the policy priority of each security policy stored in each leaf node, until a matched leaf node is found. Then, the preset matching field information of the security policy stored in the leaf node is compared one by one to determine whether there is a matched security policy in the constructed security policy tree. Then, the security policy with the highest policy priority is selected from the security policies of each constructed security policy tree as the security policy matching result (for example, the to-be-matched message matches three related security policies, and the policy priorities are 2, 5, and 3 respectively, and the security policy with the priority 2 is the security policy matching result), and the security policy matching result is output. If a security policy has been matched in advance, when the matched tree node is sequentially found from the security policy tree, if the node priority of the currently found tree node is lower than the policy priority of the security policy matched in advance, the traversal of the security policy tree can be stopped, and the subsequent security policy tree can be traversed until the last security policy tree is traversed to determine the security policy matching result. The security policy matching result can be a specific optimal security policy, or a matching failure result indicating that there is no matched security policy.

[0060] The process of sequentially finding the tree node matched with the to-be-matched message from the security policy tree can use the tree node finding process in the prior art, such as the multi-bit matching process. By comparing the node priority of the tree node with the policy priority of the matched security policy, it is determined whether to continue to find the subsequent tree node, or to continue to match other security policies in the current security policy tree, or to start to traverse the next security policy tree.

[0061] If no preset matching field condition of any security policy matches the message information of the to-be-matched message after traversing all the security policy trees, the security policy matching result is that no security policy is matched. The whole process not only guarantees the accuracy of the matching, but also optimizes the matching efficiency through the guidance of the node priority, which completely meets the core needs of network security management and control.

[0062] After the security policy tree is constructed, the security policy stored in the security policy tree can be updated based on specific business needs, such as adding a security policy, modifying a security policy, deleting a security policy, and the like. Therefore, the embodiment of the present application also provides an updating method for the constructed security policy tree. Different updating processes are used to implement different updating operations, and the different updating processes will be described below. In one embodiment, the process of adding a security policy can be implemented according to the following steps A1 to A4: A1: In response to a policy addition operation for any existing security policy tree, determine the first leaf node to which the security policy to be added belongs from the existing security policy tree based on the policy information of the security policy to be added under each preset matching domain.

[0063] Here, adding a policy can be an operation where a user / network administrator adds a new security policy to an existing security policy tree based on network security management needs. The security policy to be added is a completely new security policy that needs to be added to the existing security policy tree; this policy is an extension of the existing security policy tree management system.

[0064] Policy information consists of the specific control conditions data corresponding to the preset matching domains in the security policy to be added. As the core basis for characterizing the applicable communication scenarios of the policy, it is crucial for matching the non-leaf node hierarchical classification features to locate the leaf node to which the security policy belongs in the security policy tree. One preset matching domain can correspond to one piece of policy information. Since the security policy to be added may control packets under some matching domains, specific policy information exists under some matching domains, while policy information under other matching domains is empty. For example, the policy information of the security policy to be added may include, but is not limited to, port ranges, IP address ranges, host identifier ranges, etc.

[0065] The first leaf node is a leaf node in the constructed security policy tree used to store security policies to be added.

[0066] In practice, in response to a policy addition operation for any existing security policy tree, the policy information of the security policy to be added can be extracted under each preset matching domain. Then, based on the hierarchical organization rules of the existing security policy tree and the classification characteristics of each level of tree node, a top-down layer-by-layer matching process is initiated, from the top-level non-leaf nodes to the bottom-level leaf nodes. By comparing the policy information under each preset matching domain of the security policy to be added with the classification conditions of the corresponding level nodes one by one, a suitable hierarchical path is selected until the first leaf node required to store the security policy to be added is determined from all the leaf nodes included in the existing security policy tree.

[0067] If no matching leaf node is found after traversing all tree node levels, the preset adaptation processing logic can be triggered (such as adding a new leaf node as the first leaf node). The entire process strictly follows the hierarchical logic of the security policy tree and the policy information matching rules to ensure the accuracy of the first leaf node location and the standardization of the process.

[0068] Optionally, the process of locating the first leaf node from the constructed security policy tree can refer to the process of finding the required leaf node of the security policy from the security policy tree in the prior art.

[0069] A2: store the to-be-added security policy to the first leaf node, and determine the latest node priority of the first leaf node according to the policy priority of the to-be-added security policy and the current node priority of the first leaf node.

[0070] In specific implementation, after determining the first leaf node to which the to-be-added security policy belongs, the to-be-added security policy can be stored in the first leaf node, so that the to-be-added security policy and other security policies stored in the leaf node constitute a security policy set of the node.

[0071] Then, the current node priority of the first leaf node is obtained, wherein if the first leaf node is a newly-added leaf node or the stored security policy is empty, the current node priority of the first leaf node can be an invalid priority, and then the policy priority of the to-be-added security policy can be directly determined as the latest node priority of the first leaf node. If the first leaf node has a current node priority, the high-low relationship between the current node priority of the first leaf node and the policy priority of the to-be-added security policy can be compared. If the current node priority of the first leaf node is higher than or equal to the policy priority of the to-be-added security policy, the current node priority of the first leaf node is determined as the latest node priority of the first leaf node, that is, the node priority of the first leaf node does not need to be updated. If the current node priority of the first leaf node is less than the policy priority of the to-be-added security policy, the policy priority of the to-be-added security policy is determined as the latest node priority of the first leaf node, thereby completing the dynamic update of the node priority. The whole process not only ensures the standard storage of the to-be-added security policy, but also maintains the accurate correspondence between the leaf node priority and the subordinate security policy priority, which is consistent with the hierarchical control logic of the security policy tree.

[0072] A3: in response to satisfying the node priority update condition, the security policy tree is traversed by using a breadth-first traversal manner to obtain a second node linked list.

[0073] Here, the node priority updating condition is used to indicate a condition for updating the priority of each tree node in the entire constructed security policy tree after adding the security policy. The node priority updating condition can be a preset condition, for example, 1, immediate updating, that is, after the added security policy is completed to the storage of the first leaf node and the latest node priority of the leaf node is determined, the updating process is triggered immediately; 2, full updating, that is, after all security policies in this time are added to the security policy tree, the updating process is triggered. Specifically, the node priority updating condition can be flexibly configured according to the real-time demand of network security management and control, system resources, and the like, and the core purpose is to ensure that the priority of each level node in the security policy tree can timely and accurately reflect the highest security policy priority of the subordinate subtree, and guarantee the effectiveness and accuracy of the node priority guidance in subsequent packet matching.

[0074] The second node linked list is an ordered data structure generated by breadth-first traversal of the security policy tree in which the added security policy is stored, and the generation logic is consistent with the logic of the first node linked list described above, which will not be repeated here.

[0075] In specific implementation, when the security policy is successfully added to the constructed security policy tree, the second node linked list can be obtained by re-traversing the constructed security policy tree in a BFS manner under the condition that the node priority updating condition is met.

[0076] A4: Traversing the second node linked list, and for the currently traversed tree node, determining the latest node priority of the parent node according to the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0077] It can be understood that the process of traversing the second node linked list and updating the node priority is similar to the process of traversing the first node linked list and updating the node priority described above, therefore, the specific implementation process of A4 can refer to the introduction of S104 described above, which will not be repeated here.

[0078] In another embodiment, for the process of adding a security policy, the following steps B1~B5 can be implemented: B1: In response to a policy editing operation for any constructed security policy tree, determining a second leaf node to which the edited security policy belongs from the constructed security policy tree.

[0079] Here, the policy editing operation refers to an adjustment operation performed by a user / network administrator on a stored security policy in the constructed security policy tree in response to network security management needs. The policy editing operation can specifically include two types. One is a policy deletion operation, i.e., removing a security policy in the security policy tree that is no longer needed (e.g., deleting an access control policy corresponding to a certain business after the business is offline). The other is a policy modification operation, i.e., adjusting a key attribute of a security policy in the security policy tree, including but not limited to modifying policy information under one or more preset matching domains (e.g., modifying a source IP address range, modifying a destination port number), modifying a policy rule (e.g., modifying from allowing access at all time periods to allowing access at specific time periods), and modifying a policy priority.

[0080] The security policy to be edited is a security policy indicated by the policy editing operation for editing. In the case of the policy editing operation being a policy deletion operation, the security policy to be edited is the security policy to be deleted, and the policy priority of the security policy to be edited is the policy priority of the security policy to be deleted. In the case of the policy editing operation being a policy modification operation, the security policy to be edited is the security policy to be modified, and the policy priority of the security policy to be edited refers to the policy priority of the modified security policy.

[0081] The second leaf node is a leaf node in the constructed security policy tree for storing the security policy to be edited.

[0082] In specific implementation, in response to a policy editing operation for any constructed security policy tree, a hierarchical traversal process of the security policy tree is started: taking the root node of the security policy tree as a traversal starting point, traversing the tree nodes of the security policy tree layer by layer in a top-down hierarchical order until a leaf node, and determining the second leaf node storing the security policy to be edited. When the second leaf node is traversed, all the security policies stored in the leaf node are checked one by one, the core features of each security policy (including but not limited to original policy information under a preset matching domain, original policy priority, etc.) are compared with the core features corresponding to the security policy to be edited, so as to locate the security policy to be edited stored in the second leaf node.

[0083] It can be understood that the operation of locating the second leaf node to which the security policy to be edited belongs from the constructed security policy tree can refer to the process of finding a security policy from a security policy tree in the prior art, such as continuous multi-bit finding and discrete multi-bit finding.

[0084] B2: performing the policy editing operation for the security policy to be edited in the second leaf node, and determining whether it is necessary to backtrack the parent nodes of each level of the second leaf node according to the policy priority of the security policy to be edited and the current node priority of the second leaf node.

[0085] In a specific implementation, when the policy editing operation is a policy deletion operation, the to-be-edited security policy in the second leaf node can be deleted, and then it is determined whether the security policy stored in the second leaf node after the deletion is empty or the policy priority of the to-be-edited security policy is equal to the current node priority of the second leaf node. If it is empty or the policy priority of the to-be-edited security policy is equal to the current node priority of the second leaf node, it is determined that the parent nodes at all levels of the second leaf node in the security policy tree need to be traced back. If it is not empty and the policy priority of the to-be-edited security policy is less than the current node priority of the second leaf node, it is determined that the parent nodes at all levels do not need to be traced back.

[0086] In a specific implementation, when the policy editing operation is a policy deletion operation, the to-be-edited security policy in the second leaf node can be deleted, and then it is determined whether the security policy stored in the second leaf node after the deletion is empty or the policy priority of the to-be-edited security policy is equal to the current node priority of the second leaf node. If it is empty or the policy priority of the to-be-edited security policy is equal to the current node priority of the second leaf node, it is determined that the parent nodes at all levels of the second leaf node in the security policy tree need to be traced back. If it is not empty and the policy priority of the to-be-edited security policy is less than the current node priority of the second leaf node, it is determined that the parent nodes at all levels do not need to be traced back.

[0087] B3: If yes, the latest node priority of the second leaf node is determined, and the to-be-modified parent node is determined according to the current node priority of the parent node at each level of the second leaf node and the policy priority of the to-be-edited security policy.

[0088] Here, the to-be-modified parent node can be a parent node whose node priority is less than the latest node priority of the second leaf node.

[0089] In a specific implementation, when the policy editing operation is a policy deletion operation, if the parent nodes at all levels of the second leaf node need to be traced back, the latest node priority of the second leaf node can be determined according to the trigger reason of the trace-back operation. If the trigger reason is that the security policy in the second leaf node is empty, the latest node priority of the second leaf node can be determined as an invalid priority. If the trigger reason is that the policy priority of the to-be-edited security policy is equal to the current node priority of the second leaf node, the latest node priority of the second leaf node can be determined according to the highest priority among the policy priorities of the remaining security policies stored in the second leaf node.

[0090] In a specific implementation, when the policy editing operation is a policy deletion operation, if the parent nodes at all levels of the second leaf node need to be traced back, the policy priority of the to-be-edited security policy after the modification can be used as the latest node priority of the second leaf node.

[0091] Further, after determining the latest node priority of the second leaf node, the parent nodes of the second leaf node can be traced back in order from low to high level of the security policy tree according to the parent node chain table of the second leaf node. For the currently traced parent node, if the current node priority of the parent node is not superior to the policy priority of the security policy to be edited, the parent node is taken as the modified parent node, and the next level of parent node is traced back. The tracing is continued until all levels of parent nodes are traced back or the current node priority of the traced parent node is superior to the latest node priority of the second leaf node. If the current node priority of the parent node is superior to the policy priority of the security policy to be edited, it is determined that the parent node is not the modified parent node and the tracing is stopped.

[0092] B4: setting the current node priority of the modified parent node as the invalid priority, and traversing the security policy tree by the breadth-first search method to obtain a third node chain table.

[0093] Here, the third node chain table is an ordered data structure generated by traversing the security policy tree after the execution of the policy editing operation (deletion or modification) by the breadth-first search method. The generation logic is consistent with the logic of the first node chain table, which will not be repeated here.

[0094] In specific implementation, after determining the modified parent node, the current node priority of each modified parent node can be uniformly set as the invalid priority. Subsequently, the constructed security policy tree is re-traversed by the BFS method until all non-leaf nodes and all leaf nodes are covered to obtain the third node chain table.

[0095] B5: traversing the third node chain table, and determining the latest node priority of the parent node according to the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0096] It can be understood that the process of traversing the third node chain table and updating the node priority is similar to the process of traversing the first node chain table and updating the node priority described above. Therefore, the specific implementation process of B4 can refer to the description of S104 above, which will not be repeated here.

[0097] In an embodiment, one purpose of constructing the multi-security decision tree is to avoid security policy duplication and to increase the speed of dynamic addition / deletion / modification of security policies. However, when the security policy tree is constructed, it is difficult to distribute the security policies in each security policy tree according to the priority of the security policies, that is, the priority of the security policies in each constructed security policy tree is different and unordered. Therefore, in order to further improve the efficiency of matching the security policies from the security policy tree, in addition to setting the node priority for the tree nodes in the security policy tree, the early stop attribute can also be set for each security policy stored in the leaf node. The early stop attribute is used to indicate that the security policy can be directly returned as the security policy matching result when it is matched, without continuing to match the subsequent security policies. Specifically, after the security policy tree is constructed, the early stop attribute can be set through the following steps C1-C4: C1: According to the tree construction order of each constructed security policy tree, a security policy table corresponding to each constructed security policy tree is constructed in sequence.

[0098] Here, the tree construction order refers to the creation order of each security policy tree. A security policy tree is a security policy tree. The security policy table is used to store all security policies stored in each leaf node of the security policy tree. One security policy tree corresponds to one security policy table. For example, there are three security policy trees (Tree1-3), and the tree construction order is Tree1→Tree2→Tree3. The corresponding security policy table order is Table1 corresponding to Tree1→Table2 corresponding to Tree2→Table3 corresponding to Tree3.

[0099] In a specific implementation, a security policy table can be constructed for each security policy tree in sequence according to the tree construction order of the multiple security policy trees.

[0100] C2: For any constructed security policy tree, according to the priority of the security policies stored in each leaf node of the constructed security policy tree, each security policy is stored in the security policy table corresponding to the constructed security policy tree, and the highest priority in the priority of the security policies is set as the table priority of the security policy table.

[0101] Here, the table priority (Table.priority) is used to indicate the priority of the security policy table, and takes the highest policy priority of all the security policies stored in the leaf nodes of the corresponding security policy tree. The storage order of each security policy in the security policy table is consistent with the high-low order of the policy priority of each security policy. Since the security policy matching method provided by the embodiment of the present application can improve the matching efficiency by setting the node priority of the tree node, can improve the matching efficiency by setting the early stop attribute of the security policy, and can improve the matching efficiency by setting the node priority of the tree node and setting the early stop attribute of the security policy, the constructed security policy tree can be a security policy tree that has been constructed but does not have a node priority, or a security policy tree that has been constructed and has a node priority. Hereinafter, the constructed security policy tree is taken as an example of a security policy tree that has been constructed and has a node priority.

[0102] In a specific implementation, for any constructed security policy tree, all the security policies stored in each leaf node of the constructed security policy tree can be determined first. Subsequently, according to the policy priority of each security policy, the security policies are sorted in descending order of the policy priority, and each security policy is stored in the security policy table in turn according to the sorting. At the same time, the highest policy priority in the policy priority of each security policy can be taken as the table priority of the security policy table. That is, Table_i={policies: sorted(priority ), Table_i.priority: max(priority)}, where Table_i represents the i-th constructed security policy tree, policies: sorted(priority ) represents each security policy arranged in descending order of the policy priority, and Table_i.priority: max(priority) represents that the table priority of the i-th constructed security policy tree is the highest policy priority among the policy priorities of the security policies.

[0103] C3: setting the early stop attribute for each security policy in the last constructed security policy table; the early stop attribute of the security policy is used to take the security policy as the security policy matching result in the case that any to-be-matched packet matches the security policy.

[0104] Here, the early stop attribute is used to terminate the matching process of all subsequent security policies immediately when the to-be-matched packet matches the security policy with the attribute successfully, and directly takes the successfully matched security policy as the final security policy matching result, thereby optimizing the execution efficiency of the packet matching and avoiding unnecessary subsequent policy matching overhead.

[0105] In implementation, after the construction of all the security policy tables is completed, the early stop attribute is set for each security policy stored in the last constructed security policy table (i.e., the last security policy table), that is, each security policy in the last constructed security policy table is a security policy matched by early stop.

[0106] For example, whether to have the early stop attribute can be indicated by different early stop attribute values. If the early stop attribute value is a first preset early stop attribute value (e.g., 1), it indicates that the early stop attribute is present. If the early stop attribute value is a second preset early stop attribute value (e.g., 0), it indicates that the early stop attribute is not present.

[0107] C4: According to the table priority of the last constructed security policy table and the policy priority of the security policies in the other security policy tables, the early stop attribute is set for the security policies in the other security policy tables.

[0108] Here, the other security policy tables are each of the security policy tables except the last constructed security policy table among all the security policy tables.

[0109] In implementation, the other security policy tables can be traversed in the reverse order of the construction order of the security policy tables. Then, for each of the currently traversed remaining security policy tables, the security policies in the table that need to be set with the early stop attribute can be determined and set with the early stop attribute according to the policy priority of each security policy in the table and the table priority of the last constructed security policy table.

[0110] In an embodiment, for the above C4, the following steps C4-1 to C4-4 can also be implemented: C4-1: The table priority of the last constructed security policy table is set as the early stop priority.

[0111] Here, the early stop priority, as a key judgment basis for subsequently configuring the early stop attribute for the security policies in the other security policy tables, is a kind of priority that can be dynamically updated.

[0112] In implementation, after the last security policy table is constructed, the table priority of the security policy table can be set as the early stop priority, that is, current_priority = Table_last.priority, Table_last.priority is the table priority of the last constructed security policy table, and current_priority is the current early stop priority.

[0113] C4-2: The other security policy tables except the last constructed security policy table are traversed in the reverse order of the construction order of the security policy tables.

[0114] In implementation, the traversal operation can be performed on each of the security policy tables except the last constructed security policy table in the order opposite to the original construction order of the security policy tables. That is, the second last constructed security policy table is traversed first, then the third last constructed security policy table is traversed, and so on until the first constructed security policy table is traversed.

[0115] C4-3: For the security policy table currently being traversed, set the early stop attribute for the security policy in the security policy table currently being traversed whose policy priority is higher than or equal to the early stop priority.

[0116] In implementation, in the traversal process, for each of the security policy tables being traversed, each of the security policies can be accessed in the storage order of the security policies in the security policy table, and it is determined whether the policy priority of the security policy currently being accessed is higher than or equal to the current early stop priority. If yes, the early stop attribute is set for the security policy and the next security policy is accessed until all the security policies in the security policy table currently being traversed are accessed or the policy priority of the security policy currently being accessed is lower than the current early stop priority. If the policy priority of the security policy currently being accessed is lower than the current early stop priority, the early stop attribute is not set for the security policy, and the access to the security policies in the security policy table currently being traversed is stopped, and the next security policy table is traversed.

[0117] C4-4: In the case where the table priority of the security policy table currently being traversed is higher than the early stop priority, the table priority of the security policy table currently being traversed is set as the new early stop priority, and the next security policy table is traversed until the early stop attribute setting of the security policies in the first constructed security policy table is completed.

[0118] In implementation, in the traversal process, for each of the security policy tables being traversed, after the early stop attribute is set for the security policy whose policy priority is higher than or equal to the early stop priority, it can be determined whether the table priority of the security policy table currently being traversed is higher than the current early stop priority. If yes, the table priority of the security policy table currently being traversed is set as the new early stop priority, and the next security policy table is traversed, and the step C4-3 is returned until the first constructed security policy table is traversed and the early stop attribute setting of the security policies in the first constructed security policy table is completed. If the table priority of the security policy table currently being traversed is not higher than the current early stop priority, the current early stop priority is set as the new early stop priority (that is, the early stop priority is maintained), and the next security policy table is traversed, and the step C4-3 is returned.

[0119] For example, C4-2 to C4-4 above can be implemented using the following code: (Reverse order): / / Traverse the i-th security policy table in reverse order of its construction order. : / / For security policies belonging to Table_i if policy.priority≥current_priority: / / If the policy priority of the security policy is greater than the current early stop priority. policy.early_stop := True / / Sets the early stop attribute for the safety policy. if Table_i.priority>current_priority: / / If the table priority of Table_i is greater than the current early stop priority. current_priority := Table_i.priority / / Set the table priority of Table_i as the new early stop priority.

[0120] In this way, by dynamically updating the early stop priority, it is ensured that only security policies with a priority no lower than the latest early stop priority are configured with the early stop attribute in the security policy table that is subsequently traversed. This allows for precise control over the triggering range of the early stop mechanism, ensuring the effectiveness of triggering high-priority security policies while avoiding matching omissions caused by low-priority policies mistakenly triggering early stop.

[0121] Understandably, when priority comparisons are involved in this application, a priority a is superior to another priority b, which means that priority a is higher than / greater than priority b; similarly, a priority a is not superior to another priority b, which means that priority a is lower than / less than priority b.

[0122] In one embodiment, after setting the early stop attribute via C4 as described above, some security policies may not have the early stop attribute set. However, these security policies may still be able to perform early stop during matching. Therefore, to further improve the rationality of the early stop attribute setting, the following steps D1~D3 can be used to set early stop for security policies that have omitted the early stop attribute: D1: Following the construction order of each security policy table, access each security policy table in sequence, and for the currently accessed security policy table, determine the first security policy in that security policy table that does not have the early stop attribute set.

[0123] Here, the first security policy is the security policy in the security policy table that has not been set with the early stop attribute after steps C4-1 to C4-4.

[0124] In implementation, each security policy table can be accessed in turn according to the order of construction of the security policy tables. For the security policy table currently accessed, each security policy in the security policy table is traversed in turn according to the storage order of the security policies in the security policy table. For the security policy currently traversed, it is determined whether the security policy is configured with the early stop attribute. If yes, the next security policy is traversed. If no, the security policy is taken as the first security policy. In this way, by traversing each security policy stored in the security policy table currently accessed, each first security policy not configured with the early stop attribute can be determined from the security policy table currently accessed.

[0125] D2: For the first security policy currently determined, it is determined whether there is a target second security policy intersecting the first security policy in terms of the first policy information of the first security policy in each preset matching domain and the second policy information of the second security policy in each preset matching domain in the security policy table not accessed; the policy priority of the second security policy is higher than the policy priority of the first security policy.

[0126] Here, the first security policy currently determined is a security policy currently determined in the security policy table currently accessed. After each first security policy is determined, the early stop attribute of the first security policy can be set through steps D2 and D3.

[0127] The second security policy is a security policy in the security policy table not accessed and having a policy priority higher than that of the first security policy currently determined. For example, there are five security policy tables, the third security policy table is currently accessed, and a first security policy is determined from the first security policy table. Each second security policy having a policy priority higher than that of the first security policy can be determined from the fourth security policy table and the fifth security policy table not accessed.

[0128] The first policy information is specific configuration information of the first security policy corresponding to each preset matching domain (such as an IP address domain, a port domain, etc.). The second policy information is specific configuration information of the second security policy corresponding to each preset matching domain (such as an IP address domain, a port domain, etc.).

[0129] The policy information intersection refers to the first policy information of the first security policy and the second policy information of the second security policy, and the policy information under each preset matching field exists intersection, rather than single or partial preset matching field intersection. The policy information under a certain matching field "intersects" specifically can be that the configuration information of the two security policies under the matching field exists overlapping, containing or fitting relationship, for example, for the IP address field, the IP address segments of the two security policies partially or entirely coincide; for the port field, the port ranges of the two security policies exist intersection. Only when the policy information of the two security policies under each preset matching field meets the above intersection condition, it can be determined that the policy information of the two security policies intersects; if the policy information of the two security policies under any matching field does not intersect, it can be determined that the policy information of the two security policies does not intersect.

[0130] The target second security policy can be a security policy in the second security policy, which intersects with the policy information of the first security policy under each preset matching field.

[0131] In specific implementation, for any current first security policy, the first policy information of the first security policy under each preset matching field can be extracted, and each second security policy with a policy priority higher than the first security policy can be determined from the unvisited security policy table. Then, intersection test can be performed with each second security policy in turn. The intersection test specifically can be that for each second security policy, the second policy information of the second security policy under each preset matching field is extracted, and then for each preset matching field, whether the first security policy and the second security policy intersect under the preset matching field can be determined according to the first policy information of the first security policy under the preset matching field and the second policy information of the second security policy under the preset matching field. Further, if the first policy information of the first security policy and the second policy information of the second security policy exist intersection under each preset matching field, the second security policy can be determined as the target second security policy; if the first policy information of the first security policy and the second policy information of the second security policy do not exist intersection under at least one preset matching field, the second security policy can be determined as not the target second security policy.

[0132] In this way, by comparing the first policy information of the currently determined first security policy under each preset matching field and the second policy information of each second security policy under each preset matching field, whether there is a target second security policy in the second security policy can be accurately determined.

[0133] D3: If not, the first security policy is set with the early stop attribute.

[0134] In a specific implementation, when it is determined that there is no target second security policy, i.e., when the current first security policy and any second security policy do not have intersecting policy information, the early stop attribute can be set for the current first security policy. Conversely, if it is determined that there is any target second security policy, i.e., when the current first security policy and any second security policy have intersecting policy information, the early stop attribute can not be set for the current first security policy.

[0135] For example, for D1-D3 above, the following code can be used to implement the above: (Sequence): / / the ith security policy table accessed in the order of the construction of each security policy table (No early stop attribute set): / / for any security policy in Table_i that does not have the early stop attribute set with (policy_high.priority>policy.priority) (policy policy_high ): / / for the security policy in the jth security policy table (policy_high) where j is greater than i, if the policy priority of policy_high is greater than the policy priority of the security policy that does not have the early stop attribute set, and the intersection of the policy information of policy_high and the security policy that does not have the early stop attribute set in each preset matching field is not empty policy.early_stop: = False / / the security policy that does not have the early stop attribute set still does not have the early stop attribute continue; / / continue policy.early_stop: = True / / set the early stop attribute for the security policy that does not have the early stop attribute set.

[0136] Thus, by marking the high-policy-priority security policy in the reverse order phase, the two-stage early-stop attribute setting of the remaining security policies in the order phase can avoid redundant intersection test on the high-policy-priority security policy, and further determine the early-stop qualification of the security policies without the early-stop attribute set in the first phase by judging whether there is an intersection policy with higher policy priority. In this way, the fast marking of the security policy with absolute high policy priority and the accurate marking of the security policy without intersection but with non-absolute high policy priority are realized, and the accurate full coverage of the early-stop attribute of the security policy is realized by the combination of the two stages. In this way, by setting the node priority of each tree node of the multi-security policy tree and the early-stop attribute of the security policy in the leaf node, accurate pruning of the low-node-priority sub-tree and early-stop return of the security policy with high policy priority can be realized during security policy matching, which not only improves the efficiency of large-scale security policy matching and guarantees the optimal matching result, but also reduces the calculation overhead, thereby significantly improving the matching performance of the security policy tree.

[0137] In an embodiment, for S105 described above, the following steps E1-E4 can be implemented: E1: sequentially traverse each constructed security policy tree, and for the currently traversed constructed security policy tree, determine whether there is a matching leaf node in the constructed security policy tree according to the target matching domain associated with each tree node in the constructed security policy tree, the target packet information in the packet information related to the target matching domain, the policy priority of the matched candidate security policy, and the node priority of each tree node.

[0138] Here, the target matching domain refers to a specific matching domain pre-associated with the tree node for packet matching determination, and the target matching domain can be at least one matching domain in the preset matching domain.

[0139] The target packet information is the specific packet information under the target matching domain among all the packet information included in the to-be-matched packet. For example, when the target matching domain is the source IP address domain, the target packet information is the actual source IP address of the to-be-matched packet; when the target matching domain is the target port domain, the target packet information is the target port of the to-be-matched packet.

[0140] The candidate security policy can be a security policy found from the traversed security policy tree that matches the packet to be matched. In the process of traversing the security policy tree, if the first built security policy tree is traversed or there is no matching security policy in each built security policy tree that has been traversed, the policy priority of the matched candidate security policy can be empty; if a matching security policy has been determined in advance when traversing a certain built security policy tree, and the security policy does not have the early stop attribute, the security policy can be used as a candidate security policy. If multiple matching security policies have been determined in advance when traversing a certain built security policy tree, and the multiple security policies do not have the early stop attribute, the security policy with the highest policy priority among the multiple security policies can be used as a candidate security policy.

[0141] The matching leaf node is a leaf node in the built security policy tree that can have a matching security policy and has a node priority higher than the policy priority of the matched candidate security policy.

[0142] In specific implementation, each built security policy tree can be traversed in the order of tree construction. For the currently traversed security policy tree, the node level comprehensive matching verification can be performed according to the target packet information in the packet information of the packet to be matched, the policy priority of the matched candidate security policy, and the node priority of the tree node, to determine whether there is a matching leaf node in the currently traversed security policy tree, which has a leaf node type and a node priority higher than the policy priority of the candidate security policy.

[0143] If not, it can be determined that there is no matching leaf node in the currently traversed built security policy tree, and then if there is a built security policy tree that has not been traversed, the next built security policy tree can be traversed; if there is no built security policy tree that has not been traversed, the security policy matching result can be determined according to the matched candidate security policy. For example, if the candidate security policy is not empty, the specific candidate security policy can be used as the security policy matching result and returned, and if the candidate security policy is empty, the security policy matching result indicating a matching failure can be determined.

[0144] E2: If yes, it is determined whether there is a matching security policy in the matching leaf node according to the security policies and the packet information stored in the matching leaf node.

[0145] In implementation, in the case that there is a matching leaf node in the currently traversed constructed security policy tree, each security policy stored in the matching leaf node can be traversed in turn, and the security policy matching is performed according to the policy information of the security policy under each preset matching field and the message information of the to-be-matched message, to determine whether there is a matching security policy. The process of the security policy matching can use a security policy matching manner in the prior art, such as continuous / discrete multi-bit matching. If there are multiple matching security policies in the matching leaf node, the finally determined matching security policy can be the security policy with the highest policy priority and without the early stop attribute. If there is only one matching security policy in the matching leaf node, the security policy can be taken as the matching security policy.

[0146] If there is no matching security policy in the matching leaf node, the next constructed security policy tree can be continuously traversed.

[0147] E3: If yes, it is determined whether the currently matching security policy has the early stop attribute.

[0148] In implementation, in the case that there is a matching security policy in the matching leaf node, the security policy can be taken as the currently matching security policy, and it is determined whether the security policy is assigned with the early stop attribute. If yes, that is, if the security policy is assigned with the early stop attribute, the traversal and matching can be directly stopped, the security policy is taken as the security policy matching result, and the security policy matching result is returned.

[0149] E4: If no, in the case that the policy priority of the currently matching security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy is taken as a new candidate security policy, and the next security policy tree is continuously traversed until a security policy with the early stop attribute is matched or the last security policy tree is traversed, to obtain the security policy matching result.

[0150] In a specific implementation, in a case that it is determined that the currently matched security policy does not have the early stop attribute, the security policy currently matched is further compared with the policy priority of the matched candidate security policy. If the policy priority of the security policy currently matched is higher than the policy priority of the matched candidate security policy, the security policy currently matched is updated as a new candidate security policy, and the next security policy tree is continued to be traversed until a security policy with the early stop attribute is matched or the last security policy tree is traversed. If the policy priority of the security policy currently matched is not higher than the policy priority of the matched candidate security policy, the current candidate security policy is still kept as the matched candidate security policy. Then, the next constructed security policy tree is continued to be traversed, and the cycle is repeated until a security policy with the early stop attribute is matched in a constructed security policy tree, and the security policy with the early stop attribute is taken as a security policy matching result, or until all the constructed security policy trees are traversed, and the security policy matching result is determined according to the candidate security policy.

[0151] In an embodiment, for the above-mentioned E1, the following steps E1-1 to E1-4 can be implemented: E1-1: taking the root node of the constructed security policy tree as a current tree node to be matched.

[0152] In the process of searching for a matching leaf node from any constructed security policy tree, the root node of the tree is often taken as an initial entry for node matching by layer-by-layer searching downward. In a specific implementation, for the constructed security policy tree currently traversed, the root node thereof can be determined as the current tree node to be matched when starting node matching for the security policy tree.

[0153] E1-2: determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy.

[0154] In a specific implementation, if the candidate security policy is empty, the following E1-3 can be directly executed; if the candidate security policy is not empty, whether the node priority of the current tree node to be matched is lower than the policy priority of the candidate security policy can be determined. If lower, it is directly determined that there is no matching leaf node in the constructed security policy tree currently traversed, and the next security policy tree is directly traversed.

[0155] E1-3: if not, in a case that the current tree node to be matched is a non-leaf node, whether there is a target child node matching the packet to be matched is determined from each child node of the current tree node to be matched according to the target matching domain associated with the current tree node to be matched and the target packet information related to the target matching domain in the packet information.

[0156] Here, the target child node can be one of all child nodes of the current tree node to be matched, and the sub-tree corresponding to the target child node can have a matching security policy.

[0157] In implementation, when the node priority of the current tree node to be matched is not lower than the policy priority of the matched candidate security policy, it can be determined whether the current tree node to be matched is a non-leaf node. If not, the current tree node to be matched can be directly taken as a matching leaf node. If yes, target packet information corresponding to the target matching domain can be extracted from the packet information according to the target matching domain pre-associated with the current tree node to be matched. Based on the target packet information, all child nodes of the current tree node to be matched are compared one by one to determine whether there is a target child node matching the packet to be matched.

[0158] Optionally, the process of layer-by-layer searching for a tree node matching the packet to be matched from the constructed security policy tree can refer to a node matching process in the prior art, such as multi-bit matching.

[0159] If there is no target child node, the next security policy tree can be directly traversed. If there is a target child node, the following E1-4 can be performed.

[0160] E1-4: If yes, the target child node is taken as a new current tree node to be matched, and the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy is returned until there is no target child node matching the packet to be matched or the target child node matching the packet to be matched is a leaf node, and the leaf node is taken as a matching leaf node.

[0161] In implementation, in the case where there is a target child node, the target child node can be updated as a new current tree node to be matched, and then the step E1-2 is returned to determine whether the newly found current tree node to be matched satisfies the matching condition. In this way, the process of cyclically searching for a tree node is continuously performed until one of the following two situations occurs to stop the cycle: one is that the target child node matching the packet to be matched cannot be found in the child nodes of the current tree node to be matched, and in this case, the next constructed security policy tree can be directly traversed. The other is that the determined target child node is a leaf node, and the leaf node can be taken as a matching leaf node in the currently traversed constructed security policy tree.

[0162] In an embodiment, for the above E2, the following steps E2-1 to E2-3 can be implemented: E2-1: Each security policy stored in the matching leaf node is traversed in turn, and for the currently traversed security policy, it is determined whether the security policy matches the packet to be matched according to the packet information and the third policy information of the security policy under each preset matching domain.

[0163] Here, the third policy information can be specific configuration information corresponding to each preset matching field respectively for the security policy stored in the matching leaf node.

[0164] In specific implementation, after determining that the matching leaf node exists, each security policy stored in the matching leaf node can be traversed in sequence, and policy matching verification can be performed on the security policy currently traversed. The policy matching verification can specifically be obtaining the third policy information of the security policy currently traversed in each preset matching field, judging whether the message information of the to-be-matched message matches the third policy information, if yes, determining that the security policy currently traversed matches the to-be-matched message, if no, determining that the security policy currently traversed does not match the to-be-matched message, and if there is an untraversed security policy, continuing to traverse the next security policy; if there is no untraversed security policy, determining that the policy matching for the matching leaf node is completed, and obtaining the matching result corresponding to the matching leaf node. The matching result can be a result indicating that there is no matching security policy, or a specific matched security policy.

[0165] E2-2: if yes, in the case that the security policy currently traversed does not have the early stop attribute, judging whether there is an untraversed security policy in the matching leaf node, the policy priority of which is higher than the policy priority of the candidate security policy.

[0166] In specific implementation, if the security policy currently traversed matches the to-be-matched message, it is further judged whether the security policy currently traversed has the early stop attribute, if yes, the security policy can be directly taken as the security policy matching result and returned, if no, it is further judged whether there is an untraversed security policy in the matching leaf node, the policy priority of which is higher than the policy priority of the candidate security policy, that is, whether there is an untraversed security policy with a higher policy priority. If there is no untraversed security policy with a higher policy priority, the candidate security policy can be updated according to the policy priority of the security policy currently traversed and the policy priority of the candidate security policy. The process of updating the candidate security policy is: in the case that the policy priority of the security policy currently traversed is higher than the policy priority of the candidate security policy, the security policy currently traversed is taken as a new candidate security policy and the next constructed security policy tree is continued to be traversed; in the case that the policy priority of the security policy currently traversed is not higher than the policy priority of the candidate security policy, the security policy currently traversed can be ignored, the original candidate security policy is continued to be maintained, and the next constructed security policy tree is continued to be traversed.

[0167] E2-3: If yes, continue to traverse the untraversed security policies, and return to the step of determining whether the security policy matches the packet to be matched according to the packet information and the third policy information of the security policy under each preset matching field of the current traversed security policy, until a security policy with an early stop attribute is matched or an untraversed security policy with a policy priority higher than the candidate security policy does not exist in the matching leaf node.

[0168] In a specific implementation, in the case that there exists an untraversed security policy with a higher policy priority, the candidate security policy can be updated according to the policy priority of the current traversed security policy and the policy priority of the candidate security policy. Then, the untraversed security policies are continuously traversed to obtain a new current traversed security policy, and the packet matching step in E2-1 is executed to determine whether the new current traversed security policy matches the packet to be matched. If yes, in the case that the new current traversed security policy has an early stop attribute and is updated as the candidate security policy, the new current traversed security policy is directly taken as the security policy matching result; in the case that the new current traversed security policy does not have an early stop attribute, it is continuously determined whether there exists an untraversed security policy with a higher policy priority. In this way, the process of cyclically searching for a matched security policy in the matching leaf node is continuously executed until a security policy with an early stop attribute and capable of being taken as a candidate security policy is matched, and the security policy is taken as the security policy matching result; or until the security policies in the matching leaf node are traversed, it is determined that the policy matching for the matching leaf node is completed, and the matching result corresponding to the matching leaf node is obtained; or until there does not exist an untraversed security policy with a policy priority higher than the policy priority of the candidate security policy in the matching leaf node, it is determined that the policy matching for the matching leaf node is completed, and the matching result corresponding to the matching leaf node is obtained.

[0169] The security policy traversal completion in the matching leaf node can include that all the security policies in the matching leaf node are completely traversed, or that there does not exist an untraversed complete security policy with a higher policy priority than the policy priority of the candidate security policy in the matching leaf node.

[0170] For example, S105 can be implemented by the following code: Input: packet / / input is the packet information of the packet to be matched in each preset matching field Output: security policy matching result (18) / / output is the security policy matching result For each Tree in Tree_list: / / for each constructed security policy tree in the security policy tree list If not match_leaf(Tree, packet): / / if no matching leaf node exists according to the packet information Continue / / continue traversing the next constructed security policy tree else: / / otherwise If matched_policy.early_stop=True: / / if the matched security policy in the constructed security policy tree has an early stop attribute Return matched_policy / / early stop and return the matched security policy as the security policy matching result else: / / otherwise best_policy=matched_policy / / set the matched security policy as the optimal candidate security policy while (there exists untraversed nodes) (if the node priority > best_policy.priority): / / if there exists untraversed tree nodes and the node priority of the untraversed tree nodes is greater than the policy priority of the candidate security policy if the leaf node matches the new policy new_policy: / / if there exists a policy priority highest matched new security policy in the untraversed security policy of the matching leaf node best_policy=max(best_policy, new_policy) / / set the new security policy as the optimal candidate security policy if best_policy is updated: / / if the optimal candidate security policy is updated return best_policy / / return the optimal candidate security policy return no_match / / return the security policy matching result indicating that there is no matched security policy.

[0171] For example Figure 4 As shown, the specific flowchart of the security policy matching method provided by the embodiment of the application first traverses all the security policy trees in turn according to the message information of the to-be-matched message in each preset matching field, judges whether a security policy is matched in the security policy tree currently traversed, if not, continues to traverse the next security policy tree; if yes, judges whether the early stop attribute of the security policy is a true value True. If yes, directly returns the security policy; if not, records the security policy as a candidate security policy, and then judges whether there is an untraversed tree node and the node priority of the untraversed tree node is higher than the strategy priority of the candidate security policy, if yes, traverses to a leaf node for policy matching, and judges whether a new security policy is matched. If a new security policy is matched, according to the strategy priority of the new security policy and the strategy priority of the candidate security policy, the candidate security policy is updated to a security policy with a higher strategy priority, and the step of judging whether the early stop attribute of the security policy is a true value True is returned. If a new security policy is not matched, the step of judging whether there is an untraversed tree node and the node priority of the untraversed tree node is higher than the strategy priority of the candidate security policy is returned. If there is no untraversed tree node or the node priority of the untraversed tree node is not higher than the strategy priority of the candidate security policy, the next security policy tree is continued to be traversed. Then it is judged whether all the security policy trees are traversed, if not, the step of traversing all the security policy trees in turn is returned, if yes, no matching result or the latest candidate security policy is returned.

[0172] The improved security policy matching method provided by the application is for the scene that the number of firewall security policies is up to hundreds of thousands or millions of levels, and when the security policy is added, modified and deleted, the priority attribute of the intermediate node of the multi-security policy tree and the early stop attribute of the security policy of the leaf node of the multi-security policy tree are constructed. When the multi-security policy tree is matched, if the matched security policy has the early stop attribute, the security policy is directly returned, and the subsequent security policy tree matching is skipped; otherwise, the tree nodes of the to-be-matched security policy tree are traversed, the priority of the matched security policy and the node priority are compared, and if the node priority is lower than the matched security policy, the subsequent nodes of the to-be-matched security policy tree are skipped. Through the above multi-security policy tree matching, the multi-security policy tree can efficiently match the security policy while reducing the memory occupation, and the matching performance exceeds that of a single security policy tree.

[0173] The priority construction method for intermediate nodes of the security policy tree and the method for setting early stop attributes of security policies in leaf nodes of the security policy tree provided in this application embodiment are both used to improve the matching performance of the security policy tree. Therefore, in specific implementation, priority construction and early stop attribute setting can be used simultaneously or selectively. By using priority construction and early stop attribute setting together, the optimal matching performance can be achieved. If priority construction and early stop attribute setting are used selectively, there is also a significant improvement in matching performance compared to the security policy trees constructed in the prior art. The process for setting the early stop attribute of security policies includes two stages, where the implementation of the second stage involves more security policy intersection tests, which may cause its setting time to be longer than that of the first stage. In order to balance the setting time of the early stop attribute of security policies with the matching performance of multiple security policy trees, in actual implementation, the first stage is a mandatory implementation step, and the second stage is an optional implementation step. It can be decided whether to execute the relevant operations of the second stage according to different needs for setting efficiency and performance improvement.

[0174] To further verify the effectiveness and superiority of the security policy matching method proposed in this application, three typical large-scale security policy test datasets—ACL_100k, FW_100k, and IPC_100k—were selected in the standard testing environment of the ClassBench packet classification benchmark tool, and comparative tests were conducted with existing security policy matching schemes. Test results show that in large-scale security policy matching application scenarios, the security policy matching performance of this application is significantly improved compared to existing solutions, with matching efficiency increased to 1.2 to 1.5 times. Therefore, based on the comparative experiments, the adaptability and efficiency of the proposed solution in large-scale security policy matching scenarios can be fully demonstrated.

[0175] Based on the same inventive concept, this application also provides a security policy matching device corresponding to the security policy matching method. Since the principle of the device in this application is similar to the security policy matching method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0176] like Figure 5 The diagram shown is a schematic of a security policy matching device provided in an embodiment of this application, comprising: The construction module 501 is used to construct each non-leaf node and each leaf node according to each security policy to be assigned during the construction of any security policy tree in multiple security policy trees, and to determine and store the leaf nodes to be stored for each security policy. The first determining module 502 is configured to set the node priority of each non-leaf node as an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in the leaf node; The generating module 503 is configured to traverse the security policy tree in a breadth-first manner to obtain a first node linked list; the first node linked list stores tree nodes in reverse order of the traversal order; the tree nodes are leaf nodes or non-leaf nodes; the leaf nodes are stored before the non-leaf nodes; The second determining module 504 is configured to traverse the first node linked list, and determine the latest node priority of a parent node of a current tree node according to the current node priority of the tree node and the current node priority of the parent node of the tree node. The matching module 505 is configured to receive a to-be-matched packet, determine a security policy matching result matched with the to-be-matched packet from each constructed security policy tree according to the packet information of the to-be-matched packet in each preset matching domain, and the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

[0177] In a possible implementation, the apparatus further includes an adding module 506, configured to: In response to a policy adding operation on any constructed security policy tree, determine a first leaf node to which a to-be-added security policy belongs from the constructed security policy tree according to the policy information of the to-be-added security policy in each preset matching domain; store the to-be-added security policy to the first leaf node, and determine the latest node priority of the first leaf node according to the policy priority of the to-be-added security policy and the current node priority of the first leaf node; In response to a node priority updating condition being met, traverse the security policy tree in a breadth-first manner to obtain a second node linked list; traverse the second node linked list, and determine the latest node priority of a parent node of a current tree node according to the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0178] In a possible implementation, the apparatus further includes an editing module 507, configured to: In response to a policy editing operation on any constructed security policy tree, determine a second leaf node to which a to-be-edited security policy belongs from the constructed security policy tree; performing a policy editing operation on the to-be-edited security policy in the second leaf node, and determining whether to backtrack to parent nodes of the second leaf node according to a policy priority of the to-be-edited security policy and a current node priority of the second leaf node; if yes, determining a latest node priority of the second leaf node, and determining a to-be-modified parent node according to the current node priority of the parent node of the second leaf node and the policy priority of the to-be-edited security policy; setting the current node priority of the modified parent node as an invalid priority, and traversing the security policy tree by using a breadth-first traversal manner to obtain a third node chain table; traversing the third node chain table, and determining a latest node priority of a parent node of a current traversed tree node according to the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0179] In a possible implementation, the apparatus further includes a third determining module 508 configured to: constructing each security policy table corresponding to each constructed security policy tree in sequence according to a tree construction order of the security policy tree; storing each security policy in the security policy table corresponding to the constructed security policy tree according to a policy priority of the security policy stored in each leaf node of the constructed security policy tree, and setting a highest priority in the policy priority of the security policy as a table priority of the security policy table; setting an early stop attribute for each security policy in the last constructed security policy table; the early stop attribute of the security policy is used to take the security policy as a security policy matching result in a case where any to-be-matched packet matches the security policy; setting an early stop attribute for a security policy in another security policy table according to the table priority of the last constructed security policy table and the policy priority of the security policy in the another security policy table.

[0180] In a possible implementation, the third determining module 508, when setting the early stop attribute for the security policy in the another security policy table according to the table priority of the last constructed security policy table and the policy priority of the security policy in the another security policy table, is configured to: set the table priority of the last constructed security policy table as an early stop priority; traverse each other security policy table except the last constructed security policy table in sequence according to a reverse order of a construction order of each security policy table; setting an early-stop attribute for a security policy in the current security policy table whose policy priority is higher than or equal to the early-stop priority; In a case where the table priority of the current security policy table is higher than the early-stop priority, setting the table priority of the current security policy table as a new early-stop priority and continuing to traverse a next security policy table until the early-stop attribute setting of each security policy in the first constructed security policy table is completed.

[0181] In a possible implementation, the third determining module 508 is further configured to: sequentially accessing each security policy table according to the construction order of the security policy tables, and sequentially determining a first security policy in the current accessed security policy table which does not have an early-stop attribute set; determining, for the first security policy currently determined, whether there is a target second security policy which has policy information intersecting with the first security policy according to first policy information of the first security policy in each preset matching domain and second policy information of a second security policy in each preset matching domain, the policy priority of the second security policy being higher than the policy priority of the first security policy; if not, setting an early-stop attribute for the first security policy.

[0182] In a possible implementation, when the matching module 505 determines the security policy result matching the to-be-matched packet from each constructed security policy tree according to the packet information of the to-be-matched packet in each preset matching domain, the node priority of each tree node in each constructed security policy tree, and the policy priority of each security policy stored in each leaf node, the matching module 505 is configured to: sequentially traversing each constructed security policy tree, and for the current traversed constructed security policy tree, determining whether there is a matching leaf node in the constructed security policy tree according to a target matching domain associated with each tree node in the constructed security policy tree, target packet information related to the target matching domain in the packet information, the policy priority of the matched candidate security policy, and the node priority of each tree node; if yes, determining whether there is a matched security policy in the matching leaf node according to each security policy stored in the matching leaf node and the packet information; if yes, determining whether the current matched security policy has an early-stop attribute; If not, the current matched security policy is taken as a new candidate security policy in the case that the policy priority of the current matched security policy is higher than the policy priority of the matched candidate security policy, and the next security policy tree is continuously traversed until a security policy with the early stop attribute is matched or the last security policy tree is traversed, and a security policy matching result is obtained.

[0183] In a possible implementation, the matching module 505, when determining whether there is a matched leaf node in the constructed security policy tree according to the target matching domain associated with each tree node in the constructed security policy tree, the target packet information in the packet information related to the target matching domain, the policy priority of the matched candidate security policy, and the node priority of each tree node, is configured to: take the root node of the constructed security policy tree as a current tree node to be matched; determine whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy; if not, in the case that the current tree node to be matched is a non-leaf node, determine whether there is a target child node matching the packet to be matched from each child node of the current tree node to be matched according to the target matching domain associated with the current tree node to be matched and the target packet information in the packet information related to the target matching domain; if yes, take the target child node as a new current tree node to be matched, and return to the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy, until there is no target child node matching the packet to be matched or the target child node matching the packet to be matched is a leaf node, and the leaf node is taken as a matched leaf node.

[0184] In a possible implementation, the matching module 505, when determining whether there is a matched security policy in the matched leaf node according to each security policy stored in the matched leaf node and the packet information, is configured to: traverse each security policy stored in the matched leaf node in sequence, and for the current traversed security policy, determine whether the security policy matches the packet to be matched according to the packet information and the third policy information of the security policy in each preset matching domain; if yes, in the case that the current traversed security policy does not have the early stop attribute, determine whether there is an untraversed security policy with a policy priority higher than the policy priority of the candidate security policy in the matched leaf node; If so, continue traversing the untraversed security policies and return to the step of determining whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field, until a security policy with the early stop attribute is matched or the matching leaf node does not have an untraversed security policy with a policy priority higher than the candidate security policy.

[0185] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0186] Based on the same technical concept, embodiments of this application also provide a computing device. (Refer to...) Figure 6 The diagram shown is a structural schematic of a computing device provided in an embodiment of this application, comprising: The processor 601, memory 602, and bus 603 are included. Memory 602 stores machine-readable instructions executable by the processor 601. The processor 601 executes the machine-readable instructions stored in memory 602. When the machine-readable instructions are executed by the processor 601, the processor 601 executes the above-described S101 to S105.

[0187] The aforementioned memory 602 includes a main memory 6021 and an external memory 6022. The main memory 6021, also known as internal memory, is used to temporarily store the computational data in the processor 601, as well as the data exchanged with external memory such as a hard disk 6022. The processor 601 exchanges data with the external memory 6022 through the main memory 6021. When the computing device is running, the processor 601 and the memory 602 communicate through the bus 603, so that the processor 601 executes the execution instructions mentioned in the above method embodiments.

[0188] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the security policy matching method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0189] This application also provides a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the security policy matching method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0190] The computer program product can be implemented by hardware, software or a combination thereof. In an optional embodiment, the computer program product is embodied in a computer storage medium. In another optional embodiment, the computer program product is embodied in a software product, such as a software development kit (SDK) or the like.

[0191] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here. In several embodiments provided in the present application, it can be understood that the disclosed system and method can be implemented in other ways. The system embodiments described above are only schematic. For example, the division of the units is only a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interface, and can be electrical, mechanical or other forms.

[0192] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0193] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0194] The above is only a preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.< / node> < / node>

Claims

1. A security policy matching method, characterized in that, The method includes: In the process of constructing any one of the multiple security policy trees, each non-leaf node and each leaf node are constructed according to each security policy to be assigned, and the leaf nodes to be stored for each security policy are determined and stored. Set the node priority of each non-leaf node to an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node; The security policy tree is traversed using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order of traversal; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node; Traverse the first node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node. The system receives a message to be matched and, based on the message information of the message to be matched in each preset matching field, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node, determines the security policy matching result that matches the message to be matched from each constructed security policy tree.

2. The method according to claim 1, characterized in that, The method further includes: In response to a policy addition operation for any existing security policy tree, the first leaf node to which the security policy to be added belongs is determined from the existing security policy tree based on the policy information of the security policy to be added under each preset matching domain. The security policy to be added is stored in the first leaf node, and the latest node priority of the first leaf node is determined according to the policy priority of the security policy to be added and the current node priority of the first leaf node. In response to the condition of meeting the node priority update, the security policy tree is traversed using a breadth-first traversal method to obtain the second node linked list; Traverse the second node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

3. The method according to claim 1, characterized in that, The method further includes: In response to a policy editing operation for any constructed security policy tree, the second leaf node to which the security policy to be edited belongs is determined from the constructed security policy tree; In the second leaf node, perform policy editing operations on the security policy to be edited, and determine whether it is necessary to backtrack the parent nodes of the second leaf node according to the policy priority of the security policy to be edited and the current node priority of the second leaf node. If so, determine the latest node priority of the second leaf node, and determine the parent node to be modified based on the current node priority of each level of the parent nodes of the second leaf node and the policy priority of the security policy to be edited. Set the current node priority of the modified parent node to an invalid priority, and traverse the security policy tree using a breadth-first traversal method to obtain the third node linked list; Traverse the third node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

4. The method according to claim 1, characterized in that, The method further includes: Following the tree construction order of each constructed security policy tree, construct the security policy table corresponding to each constructed security policy tree in sequence; For any constructed security policy tree, according to the policy priority of the security policies stored in each leaf node of the constructed security policy tree, each security policy is stored in the security policy table corresponding to the constructed security policy tree, and the highest priority among the policy priorities of the security policies is set as the table priority of the security policy table. For each security policy in the last constructed security policy table, set an early stop attribute; the early stop attribute of the security policy is used to use the security policy as the security policy matching result when any unmatched packet matches the security policy. Based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables, set the early stop attribute for the security policies in the other security policy tables.

5. The method according to claim 4, characterized in that, The step of setting the early stop attribute for security policies in other security policy tables based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables includes: Set the priority of the last security policy table to the early stop priority; Following the reverse order of the construction order of each security policy table, traverse each other security policy table except for the last one constructed. For the security policy table currently being traversed, set the early stop attribute for the security policies in the current security policy table whose policy priority is higher than or equal to the early stop priority; If the priority of the security policy table being traversed is higher than the early stop priority, the priority of the security policy table being traversed is taken as the new early stop priority and the traversal continues to the next security policy table until the early stop attribute settings of each security policy in the first constructed security policy table are completed.

6. The method according to claim 4, characterized in that, The method further includes: According to the construction order of each security policy table, each security policy table is accessed in turn, and for the security policy table currently accessed, the first security policy that does not have the early stop attribute set in that security policy table is determined in turn. For the currently determined first security policy, based on the first policy information of the first security policy under each preset matching domain and the second policy information of the second security policy in the unaccessed security policy table under each preset matching domain, it is determined whether there is a target second security policy whose policy information intersects with the first security policy; the policy priority of the second security policy is higher than the policy priority of the first security policy. If not, then the first security policy is used, and the early stop attribute is set.

7. The method according to claim 4, characterized in that, The step of determining the security policy result that matches the message to be matched from each of the constructed security policy trees, based on the message information of the message to be matched under each preset matching domain, the node priority of each tree node in each constructed security policy tree, and the policy priority of each security policy stored in each leaf node, includes: Each of the constructed security policy trees is traversed sequentially, and for the currently traversed constructed security policy tree, the presence of a matching leaf node is determined based on the target matching domain associated with each tree node in the constructed security policy tree, the target message information related to the target matching domain in the message information, the policy priority of the matched candidate security policy, and the node priority of each tree node. If so, then based on the various security policies stored in the matching leaf node and the message information, determine whether there is a matching security policy in the matching leaf node; If so, determine whether the currently matched security policy has the early stop attribute; If not, then if the policy priority of the currently matched security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy will be used as the new candidate security policy, and the process will continue to traverse the next security policy tree until a security policy with the early stopping attribute is matched or the last security policy tree is traversed, thus obtaining the security policy matching result.

8. The method according to claim 7, characterized in that, The step of determining whether a matching leaf node exists in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target packet information related to the target matching domain in the packet information, the policy priority of the matched candidate security policies, and the node priority of each tree node includes: The root node of the constructed security policy tree is taken as the current node to be matched. Determine whether the priority of the current tree node to be matched is lower than the priority of the matched candidate security policy; If not, then if the current tree node to be matched is a non-leaf node, then based on the target matching domain associated with the current tree node to be matched and the target message information related to the target matching domain in the message information, determine from each child node of the current tree node to be matched whether there is a target child node that matches the message to be matched. If so, the target child node is taken as the new current tree node to be matched, and the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy is returned, until there is no target child node that matches the message to be matched or the target child node that matches the message to be matched is a leaf node, and the leaf node is taken as the matching leaf node.

9. The method according to claim 7, characterized in that, The step of determining whether a matching security policy exists in the matching leaf node based on the various security policies stored in the matching leaf node and the message information includes: The system sequentially traverses each security policy stored in the matching leaf node, and for the currently traversed security policy, determines whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching domain. If so, then if the security policy currently being traversed does not have the early stop attribute, determine whether there is an untraversed security policy in the matching leaf node whose policy priority is higher than that of the candidate security policy. If so, continue traversing the untraversed security policies and return to the step of determining whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field, until a security policy with the early stop attribute is matched or the matching leaf node does not have an untraversed security policy with a policy priority higher than the candidate security policy.

10. A security policy matching device, characterized in that, include: The construction module is used to construct each non-leaf node and each leaf node according to each security policy to be assigned during the construction of any security policy tree in multiple security policy trees, and to determine and store the leaf nodes that each security policy needs to be stored. The first determining module is used to set the node priority of each non-leaf node to an invalid priority, and to determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node. The generation module is used to traverse the security policy tree using a breadth-first traversal method to obtain the first node linked list; The first node linked list stores each tree node in reverse order according to the traversal order; The tree node can be a leaf node or a non-leaf node; the storage location of the leaf node is located before the non-leaf node; The second determining module is used to traverse the first node linked list and, for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node. The matching module is used to receive the message to be matched, and determine the security policy matching result that matches the message to be matched from each of the constructed security policy trees based on the message information of the message to be matched under each preset matching domain, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the security policy matching method as described in any one of claims 1 to 9.

12. A computing device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the security policy matching method as described in any one of claims 1 to 9.

Images