A security policy matching method, device, storage medium and computing device

Abstract

The application provides a security policy matching method and device, a storage medium and a computing device. When any security policy tree is constructed, a node priority is set for each tree node, which can accurately reflect the highest policy priority of the subordinate sub-tree of each tree node, thereby providing a core basis for pruning low-priority nodes during security policy matching, ensuring the order of dynamic maintenance of the node priority, and improving the security policy matching efficiency. Furthermore, the early stop attribute is set for the security policy of the leaf node in the multi-security policy tree in stages, which realizes the fast marking of the absolute high-priority security policy and the accurate marking of the non-absolute high-priority security policy without intersection, and the combination of the two realizes the accurate setting of the early stop attribute of the security policy. In this way, the large-scale security policy matching efficiency is improved, the optimal matching result is ensured, the computing cost is reduced, and the matching performance of the security policy tree is significantly improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a security policy matching method, apparatus, storage medium, and computing device. Background Technology

[0002] In multi-tenant cloud computing scenarios, as the number of tenants increases, the number of firewall security policies used to ensure tenant access security also increases continuously, sometimes reaching hundreds of thousands or even millions of policies. This increase in security policies places increasingly higher demands on memory usage during policy matching and the timeliness of dynamic policy upgrades. To reduce memory usage for security policy matching and accelerate dynamic upgrades, the storage structure of security policies has gradually shifted from a single security policy tree to multiple security policy trees.

[0003] However, current security policy matching based on multiple security policy trees still suffers from poor matching performance. Therefore, improving the matching performance under multiple security policy trees has become a noteworthy technical challenge. Summary of the Invention

[0004] In view of this, this application provides a security policy matching method, apparatus, storage medium, and computing device, aiming to solve the problem of poor matching performance when performing security policy matching based on multiple security policy trees.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] In a first aspect, embodiments of this application provide a security policy matching method, including:

[0007] In the process of constructing any one of the multiple security policy trees, each non-leaf node and each leaf node are constructed according to each security policy to be assigned, and the leaf nodes to be stored for each security policy are determined and stored.

[0008] Set the node priority of each non-leaf node to an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node;

[0009] The security policy tree is traversed using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order of traversal; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node;

[0010] Traverse the first node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0011] The system receives a message to be matched and, based on the message information of the message to be matched in each preset matching field, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node, determines the security policy matching result that matches the message to be matched from each constructed security policy tree.

[0012] Secondly, embodiments of this application provide a security policy matching device, comprising:

[0013] The construction module is used to construct each non-leaf node and each leaf node according to each security policy to be assigned during the construction of any security policy tree in multiple security policy trees, and to determine and store the leaf nodes that each security policy needs to be stored.

[0014] The first determining module is used to set the node priority of each non-leaf node to an invalid priority, and to determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node.

[0015] The generation module is used to traverse the security policy tree using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order of traversal; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node;

[0016] The second determining module traverses the first node linked list and, for the currently traversed tree node, determines the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0017] The matching module is used to receive the message to be matched, and determine the security policy matching result that matches the message to be matched from each of the constructed security policy trees based on the message information of the message to be matched under each preset matching domain, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

[0018] Thirdly, an optional implementation of this application also provides a computer-readable storage medium, a processor, and a memory, on which a computer program is stored, wherein when the program is executed by the processor, it implements the steps of the first aspect above, or any possible implementation of the first aspect.

[0019] Fourthly, an optional implementation of this application also provides a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps as described in the first aspect above, or any possible implementation of the first aspect.

[0020] For a description of the effects of the aforementioned security policy matching device, computer-readable storage medium, and computing device, please refer to the following explanation of the security policy matching method; it will not be repeated here.

[0021] The security policy matching method, apparatus, storage medium, and computing device provided in this application, compared with existing technologies that use the priority of the security policy tree and the size relationship of the security policy priority in a multi-security policy tree scenario for security policy matching, resulting in insufficient matching granularity and poor matching performance, address these issues. By constructing a first node linked list with leaf nodes first during the construction of the security policy tree and using this first node linked list to set the node priority of each non-leaf node, a priority propagation rule can be implemented where the node priority of a child node determines the node priority of its parent node. This not only allows for accurate priority settings for each tree node but also ensures that the priority of each tree node accurately reflects the highest policy priority of its subordinate subtrees. This provides a core basis for pruning low-priority nodes during security policy matching, ensuring the orderly dynamic maintenance of node priorities. During security policy matching, by utilizing the node priorities of each tree node in the constructed security policy tree and the policy priorities of each security policy stored in each leaf node, subtrees with low node priorities can be skipped, thereby avoiding invalid security policy matching, improving the matching efficiency of large-scale security policies, ensuring optimal matching results, and improving the matching performance of multi-security policy trees.

[0022] Furthermore, the security policy matching method, apparatus, storage medium, and computing device provided in this application, when performing security policy addition and editing operations, first accurately locate the leaf node to which the security policy to be operated belongs and perform the corresponding operation, then dynamically adjust the priority of the leaf node in combination with the policy priority, and finally update the node priority of each level of parent node based on the node linked list. This achieves both strict adherence to the core logic of the security policy tree that "the node priority of the child node determines the node priority of the parent node" and ensures accurate and efficient dynamic calibration of the priority information of the entire tree after the security policy changes. This ensures the accuracy of the node priority and provides reliable support for accurate pruning during subsequent security policy matching, effectively adapting to the core needs of large-scale dynamic management of security policies. Attached Figure Description

[0023] Figure 1 A flowchart of a security policy matching method provided in an embodiment of this application is shown;

[0024] Figure 2 This illustration shows a structural diagram of a security policy tree provided in an embodiment of this application;

[0025] Figure 3 This paper illustrates a flowchart of a method for constructing a security policy tree and setting the priority of tree nodes, as provided in an embodiment of this application.

[0026] Figure 4 This paper illustrates a detailed flowchart of a security policy matching method provided in an embodiment of this application.

[0027] Figure 5 A schematic diagram of a security matching device provided in an embodiment of this application is shown;

[0028] Figure 6 A schematic diagram of the structure of a computing device provided in an embodiment of this application is shown. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0031] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0032] Research has revealed that in multi-tenant cloud computing scenarios where firewall security policies are applied, the number of firewall security policies has surged from tens of thousands to hundreds of thousands or even millions as the number of cloud computing tenants increases. This places higher demands on the matching performance of security policies, leading to the rise of security policy tree-based matching. To address the issues of high memory consumption and low efficiency in dynamic upgrades of security policy trees caused by large-scale security policies, the storage structure of security policy trees has evolved from a single tree to multiple trees. However, matching security policies based on multiple trees typically requires traversing all trees to find a matching policy. Matching across multiple trees is based on the matching of a single tree, specifically by traversing each tree separately to find a matching policy, and then comparing the policy priorities of the matching policies in each tree to obtain the optimal match. This process results in poor matching performance due to the traversal time of each tree. To reduce the traversal and matching time when visiting each security policy tree, two types of solutions have been proposed in existing technologies. One type assigns a tree priority to each security policy tree and determines whether to skip the entire tree based on this priority. For example, when sequentially traversing multiple security policy trees for security policy matching, if the policy priority of a matched security policy is higher than the tree priority of the currently traversed security policy tree, that security policy tree is skipped; otherwise, all tree nodes in that security policy tree are traversed to find a matching security policy, and the security policy with the highest matching priority is retained, until the last security policy tree is reached. This type of solution can only achieve extreme operations such as skipping the entire tree or fully traversing the entire tree, lacking finer-grained optimizations for the intermediate levels of the security policy tree, resulting in a large number of invalid tree node traversals. The other type of solution determines the early stopping attribute of each security policy by judging the intersection relationship between security policies, thereby improving matching efficiency. However, when determining the intersection relationship between security policies, for each security policy, it is necessary to perform an intersection test with all security policies in the large-scale security policy set. If a security policy with a lower policy priority intersects with at least one security policy with a higher policy priority, then the security policy with the lower policy priority is not an early stopping match; otherwise, if a security policy with a lower policy priority does not intersect with any of the security policies with a higher policy priority, then the security policy with the lower policy priority has an early stopping match.This approach requires n² intersection tests (where n is the number of security policies) when constructing the security policy tree. While this ensures timely construction of the security policy tree in scenarios with a small n or offline construction, the computational load increases dramatically in large-scale security policy matching scenarios. This significantly increases the construction time, failing to meet the demands of efficient online processing and reducing the efficiency of using the security policy set for matching, thus impacting the dynamic upgrade effectiveness of security policies. Furthermore, the lack of consideration for node priority settings and dynamic maintenance logic across multiple security policy trees leaves room for optimization in the traversal delay of the security policy tree, affecting the matching efficiency and performance of the security policy tree.

[0033] Based on the above research, to solve the aforementioned technical problems, this application provides a security policy matching method, apparatus, storage medium, and computing device. By constructing a first node linked list with leaf nodes at the beginning during the security policy tree construction and using this list to set the node priorities of each non-leaf node, a priority propagation rule can be implemented where the node priority of a child node determines the node priority of its parent node. This not only allows for accurate priority settings for each tree node but also ensures that the priority of each tree node precisely reflects the highest policy priority of its subordinate subtrees. This provides a core basis for pruning low-priority nodes during security policy matching, ensuring the orderly dynamic maintenance of node priorities. During security policy matching, by utilizing the node priorities of each tree node in the constructed security policy tree and the policy priorities of each security policy stored in each leaf node, subtrees with low node priorities can be skipped, thus avoiding invalid security policy matching, improving the matching efficiency of large-scale security policies, ensuring optimal matching results, and improving the matching performance of multiple security policy trees.

[0034] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this application below are all contributions made by the inventor to this application.

[0035] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0036] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0037] It should be noted that the specific terms mentioned in the embodiments of this application include:

[0038] ClassBench: A toolset for testing the performance of message classification algorithms and classification devices, which includes parameter files, rule set generators, and message generators;

[0039] ACL_100k: refers to the 100,000-rule set of an Access Control List. ACL rules mainly rely on information such as the five-tuple of a data packet (source IP address, destination IP address, source port, destination port, and protocol number) to control whether the data packet is allowed or blocked. It is a basic rule type for network security and traffic management.

[0040] FW_100k: refers to the 100,000 rule set of the firewall (FW). Firewall rules, based on ACLs, further integrate more complex logic such as traffic filtering and security policy control. They can not only achieve basic access control, but also accurately identify and process specific application layer protocols and malicious traffic characteristics.

[0041] IPC_100k: refers to the 100,000 rule set of the IP chain. IP chain rules are often used in scenarios such as link-layer forwarding control of network packets and traffic routing planning. The rule design focuses more on defining the transmission path and forwarding strategy of data packets between different network links.

[0042] To facilitate understanding of this embodiment, a detailed description of the security policy matching method disclosed in this application embodiment will be provided first. The execution subject of the security policy matching method provided in this application embodiment is generally a terminal device or other processing device with certain computing capabilities. The terminal device can be a user equipment (UE), mobile device, user terminal, terminal, personal digital assistant device (PDA), handheld device, computing device, etc. In some possible implementations, the security policy matching method can be implemented by the processor calling computer-readable instructions stored in the memory.

[0043] The following section uses a computing device as an example to introduce the security policy matching method provided in the embodiments of this application.

[0044] like Figure 1 The flowchart shown is a security policy matching method provided in an embodiment of this application, which may include the following steps:

[0045] S101: In the process of constructing any security policy tree among multiple security policy trees, construct each non-leaf node and each leaf node according to each security policy to be assigned, and determine and store the leaf nodes required for each security policy.

[0046] Here, the security policy matching method provided in this application embodiment can be applied to scenarios where firewall security policies are matched based on security policy trees, and the matching performance of security policy trees will significantly improve with the increase in the size of the security policy set. Therefore, the security policy matching method provided in this application embodiment is particularly suitable for security policy matching based on security policy trees under large-scale security policy sets. For example, security policy matching in cloud computing multi-tenant scenarios, security policy matching in complex network environments, and security policy matching in terminal-intensive network scenarios.

[0047] A security policy is a set of pre-defined rules for network security management, which can be categorized into various types such as physical security, access control, information encryption, and security management. Security policies can be used by network security devices to implement traffic control and access permission management. For example, the security policies in this application may include various firewall security policies. A security policy may include policy information related to pre-defined matching fields such as source IP address, destination IP address, source port number, destination port number, and transport protocol; policy priority parameters used to distinguish execution priorities; and access rules such as allow access and deny access. Various security policies can be divided according to relevant dimensions (such as matching fields, multi-bit attributes, etc.) and managed through a security policy tree.

[0048] The security policies to be assigned can be those in a security policy set that have not yet been assigned to any of the existing security policy trees. Assigning a security policy to a security policy tree can be understood as storing it in a leaf node of that tree. When obtaining the security policy set, multiple security policy trees are constructed to distribute each security policy in the set to different trees. The same security policy is assigned to only one security policy tree; therefore, there is no copying of security policies between the various security policy trees in this application. The number of security policies assigned to different security policy trees can vary. For example, if the security policy set contains 100,000 security policies, in constructing the first security policy tree, all 100,000 policies are considered as the security policies to be assigned to that tree. If 1,000 security policies are assigned to the first tree, then the remaining 99,000 policies are the security policies to be assigned to the second tree. As the number of existing security policy trees increases, the number of security policies to be assigned to the new security policy trees that need to be constructed decreases.

[0049] Generally, when constructing any security policy tree, the root node is built first, followed by the child nodes under the root node, and then the child nodes of those child nodes, and so on, until the leaf nodes are constructed. Therefore, non-leaf nodes can be any intermediate-level tree node in the security policy tree, excluding the leaf nodes. Non-leaf nodes do not directly store security policies; they are only used to organize the hierarchical structure of the security policy tree, facilitating the location of leaf nodes during security policy matching by searching through non-leaf nodes at different levels. When constructing a non-leaf node, a child node linked list and a parent node pointer can be set. The child node linked list can include all direct child nodes of the current non-leaf node (i.e., all child nodes of the current non-leaf node at the next level), the node priority of each child node, and the parent node of each child node. Child nodes within the same child node linked list share the same parent node. The parent node pointer indicates the parent node of the non-leaf node. When the non-leaf node is the root node, since the root node has no parent node, the parent node pointer of the root node can be null.

[0050] Specifically, non-leaf nodes can be any other tree node in the security policy tree besides the leaf nodes, such as the root node or intermediate nodes in the intermediate level. Non-leaf nodes are mainly used to indicate and organize the hierarchical logical structure of the security policy tree, and they are configured with a child node linked list and a parent node pointer.

[0051] A security policy tree can be a multi-way tree, where each leaf node and non-leaf node can be called a node in the security policy tree. A leaf node is a node in the security policy tree that has no children, i.e., a node at the lowest level of the security policy tree. Leaf nodes can be used to store the various security policies assigned to them in the security policy tree. They can be configured with a parent node linked list, which stores pointers to the parent nodes of the leaf nodes at higher levels. For example, in a security policy tree with 5 levels from top to bottom, the leaf node can be a node at the lowest level. The parent node linked list of the leaf node can sequentially store pointers to the parent nodes of the leaf node at the next higher level, the parent nodes at the level before that, and so on, up to a pointer to the parent node at the highest level (i.e., the root node).

[0052] The allocation of each security policy to be assigned within a security policy tree is determined by a specific allocation algorithm. For example, all policies may be allocated to a security policy tree, or only some may be allocated. The remaining security policies not allocated to a security policy tree will become the security policies to be assigned to the next security policy tree. The allocation algorithm can use any existing policy allocation algorithm used when constructing a security policy tree, such as continuous multi-bit allocation algorithms or discrete multi-bit allocation algorithms.

[0053] The security policies allocated to the required storage differ across leaf nodes. There is no strict numerical relationship between the number of security policies allocated to the required storage in different leaf nodes; they can be the same or different, depending on the allocation algorithm and the specific security policy.

[0054] In practical implementation, during the construction of any security policy tree among multiple security policy trees, the various security policies to be assigned corresponding to that security policy tree can be determined. Then, using the allocation algorithm and the policy information of each security policy to be assigned under each preset matching domain, non-leaf nodes at each level and leaf nodes at the leaf level are constructed. Furthermore, the security policy to be stored in each leaf node is determined from the various security policies to be assigned and stored. In this way, by constructing tree nodes at different levels to form a logically clear tree structure, hierarchical guidance is provided for accurately locating the leaf node to which each security policy belongs. The leaf nodes are then accurately located based on the matching domain characteristics of each security policy to be assigned, serving as the final carrier for policy storage and providing underlying data support for the subsequent derivation and transmission of non-leaf node priorities.

[0055] S102: Set the node priority of each non-leaf node to an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node.

[0056] Here, policy priority is a core attribute of the security policy itself, used to clarify the importance of different security policies. For example, the more important the security policy, the higher its execution priority. When a packet to be matched is matched with security policies of different priorities, the security policy with the highest priority is selected as the security policy to be executed for the packet. The level of policy priority can be represented by the magnitude of the priority value, for example, "the smaller the value, the higher the priority". Suppose that for any three security policies, security policy A has a priority value of 2, security policy B has a priority value of 5, and security policy C has a priority value of 3. Then security policy A has the highest priority, followed by security policy C, and security policy B has the lowest priority. When multiple security policies meet the matching conditions, the security policy with the lowest priority value is selected as the optimal matching security policy.

[0057] Node priority reflects the highest priority of the security policies stored in the subtree where the node resides. Node priority can also be represented by a numerical priority value.

[0058] Invalid priority is used to indicate that the priority of a tree node is invalid. By setting the node priority of non-leaf nodes to invalid priority when constructing the security policy tree, and updating the node priority through subsequent steps S103 and S104, it can be obtained that the node priority of each non-leaf node can accurately represent the highest policy priority in its subtree.

[0059] For non-leaf nodes, based on their level in the security policy tree, they can be divided into root nodes (Node_Root) at the root level and intermediate nodes (Node_internal) at the intermediate level. An intermediate node can be represented as: Node_internal = {children: LinkedList} <node>, parent: Node , priority: }。Among them, children: LinkedList <node>Represents the child nodes of the intermediate node, parent: Node This indicates the parent node of the child node. The priority: ⊥ indicates that the priority is invalid.

[0060] For leaf nodes, their priority can be determined based on the highest priority of the various security policies stored within the leaf node. For example, a leaf node (Node_leaf) can be represented as follows: Node_leaf = {parent: Node...} , priority: max(Policy_priority)}, where, parent: Node This indicates the parent node of Node_leaf. `priority`: `max(Policy_priority)` represents the node priority of the leaf node, specifically the policy priority of the security policy with the highest priority among all the security policies stored in the leaf node.

[0061] In practice, after constructing the leaf nodes and non-leaf nodes in the security policy tree, the node priorities of each non-leaf node can be initialized to invalid priorities. Subsequently, following the propagation rule that "the node priority of a child node determines the node priority of its parent node," the priority will be derived from the node priorities of its subordinate child nodes, ultimately set to the highest priority among all its subordinate child nodes. Simultaneously, for each leaf node, the highest priority among the security policies stored within that leaf node can be used as its node priority. For example, if a leaf node stores three security policies with priorities of 10, 8, and 15, then the node priority of that leaf node is 8.

[0062] S103: Traverse the security policy tree using a breadth-first traversal to obtain the first node linked list; the first node linked list stores each tree node in reverse order of traversal; tree nodes are either leaf nodes or non-leaf nodes; the storage location of leaf nodes is before that of non-leaf nodes.

[0063] Breadth-First Search (BFS) is a traversal method that visits all tree nodes level by level in the security policy tree. During BFS traversal, the root node is typically traversed first, followed by the non-leaf nodes at intermediate levels, and finally the leaf nodes at the lowest level. BFS traversal allows the nodes visited earlier in the security policy tree to be stored in reverse order. Therefore, in the first node list, the leaf nodes are stored before the non-leaf nodes. To put it simply, reverse order storage means storing the tree nodes visited during the security policy tree traversal into the node list in a "last-in, first-out" (LIFO) manner.

[0064] A first-node linked list is an ordered data structure used to store the nodes visited in the order they are traversed in a tree. For example, a first-node linked list can be a first-in, first-out (FIFO) stack linked list. For instance, a first-node linked list can first store the leaf nodes of the last level, then the intermediate nodes of each intermediate level, and finally the root node.

[0065] In practical implementation, for any security policy tree currently constructed, a breadth-first traversal can be used, following a preset direction, which can be from left to right or from right to left. First, the root node is traversed. Then, in order from higher-level intermediate levels to lower-level intermediate levels, all non-leaf nodes at each intermediate level are traversed layer by layer and stored in reverse order in the first node linked list. Finally, each leaf node at the lowest level of the security policy tree is traversed, and each leaf node encountered is stored in reverse order in the first node linked list. Leaf nodes are stored at the beginning of the first node linked list. After the leaf nodes are stored, the constructed first node linked list is obtained. For example, the first node linked list can be Stack = BFS(Tree_root); where Stack indicates that the first node linked list is a stack linked list, and BFS(Tree_root) indicates traversing from the root node to the leaf node. By constructing the first node linked list, it can be ensured that leaf nodes are visited before non-leaf nodes during subsequent traversals of the first node linked list.

[0066] like Figure 2 The diagram shown is a structural schematic of a security policy tree provided in an embodiment of this application. The tree has 4 levels and 21 nodes. Node 1 is the root node, nodes 2-10 are intermediate nodes, and nodes 11-21 are leaf nodes, storing security policies in the leaf nodes. When traversing according to BFS and from left to right, the first node linked list constructed sequentially stores nodes 11-21, nodes 5-10, nodes 2-4, and node 1.

[0067] S104: Traverse the first node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node.

[0068] Here, when updating the priority of a parent node, the parent node of a tree node can be the direct parent node of the tree node at the next higher level, or the parent node of the tree node at each higher level. To reduce the computational cost of updating node priorities, when updating the priority of the parent node of the currently traversed tree node, the priority of its direct parent node can be updated by comparing the priority of the currently traversed tree node with the priority of its direct parent node.

[0069] The current node priority of a tree node is the node priority currently set for the tree node. The current node priority of the parent node of a tree node is the node priority currently set for the parent node, which can be an invalid priority or a node priority for a certain value. Since the root node has no parent node, when traversing to the root node, there is no need to perform the operation of comparing and updating the node priority of its parent node. The node priority of the root node can be determined according to the highest node priority of its direct child nodes. The latest node priority can be the node priority recently set for the parent node.

[0070] During specific implementation, the first node list can be traversed sequentially. For the currently traversed tree node, its current node priority can be obtained first (where when the tree node is a leaf node, its current node priority can be the highest policy priority in the stored security policy; when the tree node is a non-leaf node, its current node priority can be the initially set invalid priority or the recently determined valid priority), and then the direct parent node of the tree node can be determined according to the parent node list and the parent node pointer of the tree node. Compare the current node priority of the tree node with the current node priority of the direct parent node. If the current node priority of the tree node is better than the current node priority of the direct parent node or the node priority of the direct parent node is an invalid priority, the current node priority of the tree node can be used as the latest node priority of the direct parent node to achieve the orderly transfer of the child node priority to the parent node priority and complete the update of the node priority of the direct parent node. If the current node priority of the tree node is lower than or equal to the current node priority of the direct parent node, the current node priority of the direct parent node is used as the latest node priority of the direct parent node, so there is no need to update the node priority of the direct parent node. As the first node list is continuously traversed, the node priorities of each level of parent nodes can always be dynamically updated to the highest node priority among all its subordinate child nodes, ultimately ensuring the accuracy and consistency of the full-node priorities of the security policy tree and providing a reliable basis for accurate pruning and early stopping judgment during subsequent security policy matching.

[0071] Exemplarily, the process of updating the node priority can be specifically implemented through the following code:

[0072] : / / The currently traversed tree node belongs to the stack list

[0073] if(node.parent.priority== ) (node.parent.priority<node.priority) / / If the parent node priority is invalid or the parent node priority is less than the node priority of the currently traversed tree node

[0074] then node.parent.priority:=node.priority / / Update the priority of the parent node to the priority of the currently traversed tree node.

[0075] Thus, based on the above S101~S104, it is possible to construct each of the multiple security policy trees and set the optimal node priority for each node of each security policy tree.

[0076] like Figure 3 The flowchart illustrates a method for constructing a security policy tree and setting tree node priorities, as provided in this application embodiment. During the construction of any security policy tree, based on the assigned security policies, non-leaf nodes and leaf nodes are constructed, and the leaf nodes required for each security policy are determined and stored. The priorities of non-leaf nodes are set to invalid priorities, and the priorities of leaf nodes are set to the highest priority among all stored security policies. Next, the security policy tree is traversed using BFS to construct a first node linked list, Stack. While traversing Stack, for each traversed tree node, it is determined whether the priority of its parent node is invalid or lower than the priority of its child nodes. If it is invalid or lower than the priority of its child nodes, the priority of the parent node is updated to the priority of its child nodes. If it is not invalid and is not lower than the priority of its child nodes, the update operation is skipped. Then, the process of traversing the next tree node in Stack and the priority judgment and update process continues until the traversal of Stack is completed, obtaining the latest node priorities of each tree node in the security policy tree. In this way, by constructing a stacked linked list using BFS, leaf nodes are accessed first, and the priority of a parent node is inherited from the maximum value of its child nodes.

[0077] S105: Receive the message to be matched, and determine the security policy matching result that matches the message to be matched from each of the pre-set matching fields based on the message information of the message to be matched in each preset matching field, as well as the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

[0078] Here, the constructed security policy tree is the decision tree with the node priorities of each node set. The preset matching domain is a pre-defined domain that is a core dimension determined in advance based on the various attributes corresponding to the information contained in the security policy and the various attributes corresponding to the information contained in the message to be matched. The preset matching domain is the key basis for accurately matching the message to be matched with the security policies stored in the leaf nodes of the security policy tree. The message to be matched is the data packet carried by the access request initiated by the tenant, which needs to be verified by the security policy tree for security control. Each security policy may contain policy information under at least some preset matching domains. For example, preset matching domains may include source port domain, destination port domain, source Internet Protocol (IP) domain, destination IP domain, client identifier domain, physical address domain, client attribute domain, client name domain, etc. Optional matching domains such as message type (data flow, control flow) and network service type (e.g., HTTP) can also be added according to control requirements. The message to be matched is compared one by one with the corresponding preset matching domain conditions in the security policy through the specific message information under these domains, ultimately achieving accurate matching with the target security policy.

[0079] Security policies can include policy range information and corresponding policy rules under different preset matching domains. For example, a security policy may allow or deny access to packets to be matched that have a source port range of 80-90 and a destination port range of 100-120. A packet to be matched may carry packet information such as a source port of 85 and a destination port of 110.

[0080] For example, the preset matching domain F may include m domains, where the number of m is not specifically limited in this application and can be set according to actual application scenarios and experience. That is, the domain dimension of the preset matching domain F is m, and the strategy matching domain F = {f1, f2, ..., }, where f1 represents the first policy matching domain and f2 represents the second policy matching domain. Let f1, f2, ..., represent the matching domain of the m-th strategy. They are all different.

[0081] The information carried in the message to be matched includes message information corresponding to different preset matching fields. This information is the core basis for matching with the security policies stored in the leaf nodes. For example, when a user accesses the business system on the company's cloud server through an office computer, a data packet transmitted in the network is the message to be matched. The specific information corresponding to the preset matching fields it covers is as follows: source IP address is 192.168.1.XXX, destination IP address is the public IP of the cloud server (10.2X.3X.XX), source port is a temporary port randomly assigned to the office computer (56XXX), destination port is the service port corresponding to the business system of the cloud server (e.g., 80), and the transmission protocol is Transmission Control Protocol (TCP). This specific information of the message will fully present its transmission scenario and communication object. As the core matching basis, it is compared one by one with the security policies stored in the leaf nodes of the security policy (such as the policy of "allowing the 192.168.XX / XX network segment to access 10.2X.3X.XX: 80 port through the Transmission Control Protocol TCP") to finally determine whether there is a match and the corresponding control action.

[0082] The message information under the preset matching fields can be the specific values ​​or feature data in the message to be matched that correspond to the preset matching fields. It is the objective attribute information carried by the message itself and the core practical basis for comparison with the preset conditions of the corresponding matching fields in the security policy. For example, the message information corresponding to the "source IP address" matching field is the specific network address of the sender of the message to be matched; the message information corresponding to the "destination IP address" matching field is the specific network address of the receiver; the message information corresponding to the "source port number" and "destination port number" matching fields is the specific port value used by the sender and receiver during communication; and the message information corresponding to the "transmission protocol type" matching field is the specific protocol followed by the message transmission (such as TCP). This message information fully presents the communication characteristics of the message to be matched. By accurately comparing it with the set conditions of each preset matching field in the security policy (such as IP network segment, port range, and protocol type), it can be determined whether the message meets the matching requirements of the security policy.

[0083] In practice, after receiving the message to be matched, the message information under each preset matching field can be extracted first. Then, each constructed security policy tree is traversed sequentially. For the currently traversed constructed security policy tree, matching tree nodes are searched sequentially based on the message information, the node priority of each tree node in the constructed security policy tree, and the policy priority of each security policy stored in each leaf node until a matching leaf node is found. Then, the matching policy is compared one by one with the preset matching field information of the security policy stored in the leaf node to determine whether a matching security policy exists in the constructed security policy tree. Then, from the security policies of each constructed security policy tree, the policy with the highest priority is selected as the security policy matching result (for example, if the message to be matched matches 3 related security policies with policy priorities of 2, 5, and 3, then the policy with priority 2 is the security policy matching result), and the matching result is output as the security policy. If a security policy has already been matched, when searching for matching tree nodes in the security policy tree, if the priority of the currently found tree node is lower than the priority of the previously matched security policy, the traversal of that security policy tree can be stopped, and the traversal of subsequent security policy trees can continue until the last security policy tree is traversed, thus determining the security policy matching result. The security policy matching result can be either an optimal matching security policy or a matching failure result indicating that no matching security policy exists.

[0084] Regarding the process of sequentially searching for tree nodes that match the message to be matched in the security policy tree, existing tree node search processes, such as multi-bit matching processes, can be used. For each matched tree node, the node priority is compared with the priority of already matched security policies to determine whether to continue searching for subsequent tree nodes, continue matching other security policies in the current security policy tree, or begin traversing the next security policy tree.

[0085] If, after traversing all security policy trees, no security policy's preset matching field conditions match the matching field information of the packet to be matched, then the security policy matching result is no matching of any security policy. The entire process ensures matching accuracy while optimizing matching efficiency through node priority guidance, perfectly meeting the core requirements of network security management.

[0086] After the security policy tree is constructed, the security policies stored in the security policy tree may be updated based on specific business needs, such as adding, modifying, or deleting security policies. Therefore, this application embodiment also provides a method for updating the constructed security policy tree. Different update processes will be used for different update operations, which will be described below:

[0087] In one embodiment, the process of adding a security policy can be implemented according to the following steps A1 to A4:

[0088] A1: In response to a policy addition operation for any existing security policy tree, determine the first leaf node to which the security policy to be added belongs from the existing security policy tree based on the policy information of the security policy to be added under each preset matching domain.

[0089] Here, adding a policy can be an operation where a user / network administrator adds a new security policy to an existing security policy tree based on network security management needs. The security policy to be added is a completely new security policy that needs to be added to the existing security policy tree; this policy is an extension of the existing security policy tree management system.

[0090] Policy information consists of the specific control conditions data corresponding to the preset matching domains in the security policy to be added. As the core basis for characterizing the applicable communication scenarios of the policy, it is crucial for matching the non-leaf node hierarchical classification features to locate the leaf node to which the security policy belongs in the security policy tree. One preset matching domain can correspond to one piece of policy information. Since the security policy to be added may control packets under some matching domains, specific policy information exists under some matching domains, while policy information under other matching domains is empty. For example, the policy information of the security policy to be added may include, but is not limited to, port ranges, IP address ranges, host identifier ranges, etc.

[0091] The first leaf node is a leaf node in the constructed security policy tree used to store security policies to be added.

[0092] In practice, in response to a policy addition operation for any existing security policy tree, the policy information of the security policy to be added can be extracted under each preset matching domain. Then, based on the hierarchical organization rules of the existing security policy tree and the classification characteristics of each level of tree node, a top-down layer-by-layer matching process is initiated, from the top-level non-leaf nodes to the bottom-level leaf nodes. By comparing the policy information under each preset matching domain of the security policy to be added with the classification conditions of the corresponding level nodes one by one, a suitable hierarchical path is selected until the first leaf node required to store the security policy to be added is determined from all the leaf nodes included in the existing security policy tree.

[0093] If no matching leaf node is found after traversing all tree node levels, the preset adaptation processing logic can be triggered (such as adding a new leaf node as the first leaf node). The entire process strictly follows the hierarchical logic of the security policy tree and the policy information matching rules to ensure the accuracy of the first leaf node location and the standardization of the process.

[0094] Optionally, the process of locating the first leaf node from the constructed security policy tree can refer to the process of finding the required leaf node of the security policy from the security policy tree in existing technologies.

[0095] A2: Store the security policy to be added to the first leaf node, and determine the latest node priority of the first leaf node based on the policy priority of the security policy to be added and the current node priority of the first leaf node.

[0096] In practice, after determining the first leaf node to which the security policy to be added belongs, the security policy to be added can be stored in the first leaf node, so that the security policy to be added and other security policies already stored in the leaf node together constitute the security policy set of the node.

[0097] Then, the current priority of the first leaf node is obtained. If the first leaf node is a newly added leaf node or the stored security policy is empty, its current priority can be an invalid priority. Therefore, the policy priority of the security policy to be added can be directly determined as the latest priority of the first leaf node. If the first leaf node has a current priority, its current priority is compared with the policy priority of the security policy to be added. If the current priority of the first leaf node is greater than or equal to the policy priority of the security policy to be added, then the current priority of the first leaf node is determined as the latest priority, meaning there is no need to update the node priority of the first leaf node. If the current priority of the first leaf node is less than the policy priority of the security policy to be added, then the policy priority of the security policy to be added is determined as the latest priority of the first leaf node, thus completing the dynamic update of node priorities. The entire process ensures the standardized storage of the security policy to be added and maintains the precise correspondence between leaf node priorities and subordinate security policy priorities, conforming to the hierarchical control logic of the security policy tree.

[0098] A3: In response to the condition of satisfying the node priority update, the security policy tree is traversed using a breadth-first traversal to obtain the second node linked list.

[0099] Here, the node priority update condition is used to indicate the conditions for updating the priority of each node in the entire constructed security policy tree after adding a security policy. The node priority update condition can be a preset condition, such as: 1. Immediate update, meaning the update process is triggered immediately after the added security policy is stored in the first leaf node and the latest node priority of that leaf node is determined; 2. Full update, meaning the update process is triggered after all security policies have been added to the security policy tree. Specifically, the node priority update condition can be flexibly configured according to the real-time requirements of network security management and system resources. Its core purpose is to ensure that the priority of each level of nodes in the security policy tree can reflect the highest security policy priority of its subordinate subtrees in a timely and accurate manner, ensuring the effectiveness and accuracy of node priority guidance during subsequent packet matching.

[0100] The second node linked list is an ordered data structure generated by traversing the security policy tree containing the security policies to be added using a breadth-first traversal method. Its generation logic is the same as that of the first node linked list mentioned above, and will not be repeated here.

[0101] In practice, once a security policy is successfully added to the existing security policy tree, the existing security policy tree can be retraced using BFS, provided that the node priority update condition is met, to obtain the second node linked list.

[0102] A4: Traverse the second node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node.

[0103] Understandably, the process of traversing the second node linked list and updating the node priority is similar to the process of traversing the first node linked list and updating the node priority described above. Therefore, the specific implementation process of A4 can be referred to the above introduction of S104, and will not be repeated here.

[0104] In another embodiment, the process of adding a security policy can be implemented according to the following steps B1 to B5:

[0105] B1: In response to a policy edit operation for any built security policy tree, determine the second leaf node to which the security policy to be edited belongs from the built security policy tree.

[0106] Here, policy editing operations refer to the adjustments performed by users / network administrators on security policies already stored in a constructed security policy tree in response to network security management requirements. Policy editing operations can specifically include two types: first, policy deletion operations, which remove security policies that are no longer needed from the security policy tree (e.g., deleting the access control policy corresponding to a service after it is taken offline); and second, policy modification operations, which adjust the key attributes of security policies in the security policy tree, including but not limited to modifying policy information under one or more preset matching domains (e.g., modifying the source IP address range, modifying the destination port number), modifying policy rules (e.g., changing from allowing access at all times to allowing access during specific times), and modifying policy priorities.

[0107] The security policy to be edited is the security policy that the policy editing operation indicates to be edited. When the policy editing operation is a policy deletion operation, the security policy to be edited is the security policy to be deleted, and the policy priority of the security policy to be edited is the policy priority of the security policy to be deleted; when the policy editing operation is a policy modification operation, the security policy to be edited is the security policy to be modified, and the policy priority of the security policy to be edited refers to the policy priority of the modified security policy.

[0108] The second leaf node is a leaf node in the constructed security policy tree used to store the security policy to be edited.

[0109] In practice, in response to any policy editing operation on an existing security policy tree, a hierarchical traversal process of the security policy tree is initiated: starting from the root node of the security policy tree, the tree nodes are traversed layer by layer in a top-down hierarchical order until the leaf node is identified, thus determining the second leaf node that stores the security policy to be edited. When the second leaf node is found, all security policies stored in the leaf node are checked one by one. The core features of each security policy (including but not limited to the original policy information under the preset matching domain, the original policy priority, etc.) are comprehensively compared with the core features corresponding to the security policy to be edited, thereby locating the security policy to be edited stored in the second leaf node.

[0110] Understandably, the operation of locating the second leaf node to which the security policy to be edited belongs from the constructed security policy tree can refer to the process of searching for security policies in the security policy tree in existing technologies, such as continuous multi-bit search, discrete multi-bit search, etc.

[0111] B2: Execute the policy editing operation for the security policy to be edited in the second leaf node, and determine whether it is necessary to backtrack the parent nodes of the second leaf node according to the policy priority of the security policy to be edited and the current node priority of the second leaf node.

[0112] In practice, when the policy editing operation is a policy deletion operation, the security policy to be edited can be deleted from the second leaf node. Then, it is determined whether the security policy stored in the second leaf node after the policy deletion is empty or whether the policy priority of the deleted security policy to be edited is equal to the current node priority of the second leaf node. If it is empty or the policy priority of the security policy to be edited is equal to the current node priority of the second leaf node, it is determined that it is necessary to backtrack the second leaf node to all levels of parent nodes in the security policy tree. If it is not empty and the policy priority of the deleted security policy to be edited is less than the current node priority of the second leaf node, it is determined that it is not necessary to backtrack the parent nodes.

[0113] When the policy editing operation is a policy modification operation, since it modifies the security policies already stored in the second leaf node, the number of security policies in the second leaf node will not be empty after the modification. Therefore, we can first determine whether the policy priority of the security policy to be edited is consistent before and after the modification. If it is consistent, we can determine that there is no need to backtrack to each level of parent nodes; if it is inconsistent, we can determine whether the policy priority of the security policy to be edited before the modification is equal to the priority of the current node of the second leaf node. If it is equal, we can determine that there is no need to backtrack to each level of parent nodes; if it is not equal, we can determine whether the policy priority of the security policy to be edited after the modification is superior to the priority of the current node of the second leaf node. If it is superior, we can determine that it is necessary to backtrack to each level of parent nodes; if it is not superior, there is no need to backtrack to each level of parent nodes.

[0114] B3: If so, determine the latest node priority of the second leaf node, and determine the parent node to be modified based on the current node priority of each level of the parent nodes of the second leaf node and the policy priority of the security policy to be edited.

[0115] Here, the parent node to be modified can be a parent node with a node priority lower than the latest node priority of the second leaf node.

[0116] In practice, when the policy editing operation is a policy deletion operation, if it is necessary to backtrack through all levels of parent nodes of the second leaf node, the latest node priority of the second leaf node can be determined based on the triggering reason of the backtracking operation. If the triggering reason is that the security policy in the second leaf node is empty, the latest node priority of the second leaf node can be determined as an invalid priority; if the triggering reason is that the policy priority of the security policy to be edited is equal to the current node priority of the second leaf node, the latest node priority of the second leaf node can be determined based on the highest priority among the remaining security policies stored in the second leaf node.

[0117] When the policy editing operation is a policy deletion operation, if it is necessary to trace back to the parent nodes of the second leaf node, the policy priority of the modified security policy to be edited can be used as the latest node priority of the second leaf node.

[0118] Furthermore, after determining the latest priority of the second leaf node, the parent nodes of the second leaf node can be backtracked sequentially according to the hierarchical order of the security policy tree, from low to high, based on the parent node list of the second leaf node. For the currently backtracked parent node, if the current priority of the parent node is not higher than the policy priority of the security policy to be edited, then the parent node is designated as the parent node to be modified, and the backtracking continues to the next level of parent nodes until all levels of parent nodes have been backtracked or the current priority of the backtracked parent node is higher than the latest priority of the second leaf node; if the current priority of the parent node is higher than the policy priority of the security policy to be edited, then the parent node is determined not to be the parent node to be modified, and the backtracking stops.

[0119] B4: Set the current node priority of the modified parent node to an invalid priority, and traverse the security policy tree using a breadth-first traversal to obtain the third node linked list.

[0120] Here, the third node linked list is an ordered data structure generated by traversing the security policy tree after performing policy editing operations (deletion or modification) using a breadth-first traversal method. Its generation logic is the same as that of the first node linked list mentioned above, and will not be repeated here.

[0121] In practice, after determining the parent node to be modified, the current node priority of each parent node to be modified can be uniformly set to invalid priority. Then, the constructed security policy tree is retraced using BFS until all non-leaf nodes and all leaf nodes are covered, resulting in the third node linked list.

[0122] B5: Traverse the linked list of the third node, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node.

[0123] Understandably, the process of traversing the third node linked list and updating the node priority is similar to the process of traversing the first node linked list and updating the node priority described above. Therefore, the specific implementation process of B4 can be referred to the above introduction of S104, and will not be repeated here.

[0124] In one embodiment, one purpose of constructing multiple security decision trees is to prevent security policies from being copied and to accelerate the dynamic addition, deletion, and modification of security policies. However, when constructing the security policy tree, it is difficult to distribute the security policies in each security policy tree according to their policy priorities; that is, the policy priorities of the security policies in the constructed security policy trees are different and unordered. Therefore, to further improve the efficiency of matching security policies from the security policy tree, in addition to setting node priorities for the tree nodes in the security policy tree, an early stop attribute can also be set for each security policy stored in the leaf nodes. The early stop attribute indicates that when a security policy is matched, it can be directly returned as a security policy matching result without continuing to match subsequent security policies. Specifically, after constructing the security policy tree, the early stop attribute can be set through the following steps C1~C4:

[0125] C1: Construct the security policy table corresponding to each existing security policy tree in the order of tree construction.

[0126] Here, the tree construction order refers to the order in which the security policy trees are created. A security policy tree is simply a single security policy tree. The security policy table stores all the security policies stored in each leaf node of the security policy tree. One security policy tree corresponds to one security policy table. For example, if there are three security policy trees (Tree1~3), and the tree construction order is Tree1→Tree2→Tree3, then the corresponding security policy table order is Table1 for Tree1→Table2 for Tree2→Table3 for Tree3.

[0127] In practice, a security policy table can be built for each security policy tree in the order in which they are constructed.

[0128] C2: For any existing security policy tree, according to the policy priority of the security policies stored in each leaf node of the existing security policy tree, store each security policy in the security policy table corresponding to the existing security policy tree, and set the highest priority among the policy priorities of the security policies as the table priority of the security policy table.

[0129] Here, `Table.priority` indicates the priority of the security policy table, and its value is the highest policy priority among all security policies stored in the leaf nodes of the corresponding security policy tree. The storage order of each security policy in the security policy table is consistent with the order of their policy priorities. Since the security policy matching method provided in this application embodiment can improve matching efficiency by setting node priorities for tree nodes, by setting early stop attributes for security policies, or by setting both node priorities and early stop attributes for security policies, the constructed security policy tree can be either a completed security policy tree without node priorities or a completed security policy tree with node priorities. The following description will use a completed security policy tree with node priorities as an example.

[0130] In practice, for any constructed security policy tree, first determine all security policies stored in each leaf node of the constructed security policy tree. Then, based on the policy priority of each security policy, sort them in descending order of policy priority, and store each security policy sequentially in the security policy table according to this order. Simultaneously, the highest policy priority among all security policies can be used as the table priority of the security policy table. That is, Table_i = {policies: sorted(priorit...} ), Table_i.priority: max(priority)}, where Table_i represents the i-th security policy tree that has been constructed, policies: sorted(priority) ) represents the security policies arranged in descending order of policy priority. Table_i.priority: max(priority) indicates that the priority of the i-th security policy tree is the highest policy priority among all security policies.

[0131] C3: Set the early stop attribute for each security policy in the last constructed security policy table; the early stop attribute of a security policy is used to treat the security policy as the security policy matching result if any unmatched packet matches the security policy.

[0132] Here, the early stop attribute is used to immediately terminate the matching process of all subsequent security policies once the packet to be matched successfully matches the security policy configured with this attribute. The successfully matched security policy is directly used as the final security policy matching result, thereby optimizing the execution efficiency of packet matching and avoiding unnecessary subsequent policy matching overhead.

[0133] In practice, after all security policy tables are constructed, the early stop attribute is set for each security policy stored in the last constructed security policy table (i.e., the final security policy table). This means that each security policy in the last constructed security policy table is a policy that matches early stop.

[0134] For example, whether or not an early stop attribute is present can be indicated by different early stop attribute values. If the early stop attribute value is the first preset early stop attribute value (e.g., 1), it means that the early stop attribute is present; if the early stop attribute value is the second preset early stop attribute value (e.g., 0), it means that the early stop attribute is not present.

[0135] C4: Based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables, set the early stop attribute for security policies in other security policy tables.

[0136] Here, "other security policy tables" refers to all security policy tables except for the last one constructed.

[0137] In practice, other security policy tables can be traversed in reverse order of their construction. Then, for each of the remaining security policy tables being traversed, the security policies that need to be set with the early stop attribute can be determined based on the policy priority of each security policy in the table and the table priority of the last security policy table constructed, and the early stop attribute can be set accordingly.

[0138] In one embodiment, C4 can also be implemented according to the following steps C4-1 to C4-4:

[0139] C4-1: Set the table priority of the last security policy table built to the early stop priority.

[0140] Here, the early stop priority serves as a key criterion for configuring the early stop attribute for security policies in other security policy tables, and it is a dynamically updatable priority.

[0141] In practice, after the last security policy table is built, the table priority of the security policy table can be used as the early stop priority, that is, current_priority=Table_last.priority, where Table_last.priority is the table priority of the last security policy table built, and current_priority is the current early stop priority.

[0142] C4-2: Traverse each security policy table in reverse order of its construction, except for the last security policy table that was constructed.

[0143] In practice, the traversal operation can be performed sequentially on each security policy table except for the last one constructed, following the reverse order of their original construction. That is, the second-to-last constructed security policy table is traversed first, followed by the third-to-last constructed security policy table, and so on, until the first constructed security policy table is reached.

[0144] C4-3: For the security policy table currently being traversed, set the early stop attribute for the security policies in the table whose policy priority is higher than or equal to the early stop priority.

[0145] In practice, during the traversal process, for each security policy table encountered, each security policy is accessed sequentially according to its storage order. For the currently accessed security policy, its policy priority is checked against the current early stop priority. If so, the early stop attribute is set for that security policy, and the process continues to access the next security policy, until all security policies in the currently traversed security policy table have been accessed, or until the policy priority of an accessed security policy is no higher than the current early stop priority. If the policy priority of that security policy is lower than the current early stop priority, the early stop attribute is not set for that security policy, and further access to the security policies in the currently traversed security policy table is stopped, and the process continues to traverse the next security policy table.

[0146] C4-4: If the priority of the security policy table being traversed is higher than the early stop priority, the priority of the security policy table being traversed is used as the new early stop priority, and the traversal continues to the next security policy table until the early stop attribute settings of each security policy in the first constructed security policy table are completed.

[0147] In practice, during the traversal process, for each security policy table encountered, after setting the early stop attribute for security policies with a policy priority greater than or equal to the early stop priority, the table priority of the currently traversed security policy table can be compared to see if it is greater than the current early stop priority. If so, the table priority of the currently traversed security policy table is used as the new early stop priority, and the traversal continues to the next other security policy table, returning to step C4-3, until the first constructed security policy table is traversed and the early stop attribute of the security policies in it is set. If the table priority of the currently traversed security policy table is not greater than the current early stop priority, the current early stop priority can be used as the new early stop priority (i.e., the early stop priority remains unchanged), and the traversal continues to the next other security policy table, returning to step C4-3.

[0148] For example, C4-2 to C4-4 above can be implemented using the following code:

[0149] (Reverse order): / / Traverse the i-th security policy table in reverse order of its construction order.

[0150] : / / For security policies belonging to Table_i

[0151] if policy.priority≥current_priority: / / If the policy priority of the security policy is greater than the current early stop priority.

[0152] policy.early_stop := True / / Sets the early stop attribute for the safety policy.

[0153] if Table_i.priority>current_priority: / / If the table priority of Table_i is greater than the current early stop priority.

[0154] current_priority := Table_i.priority / / Set the table priority of Table_i as the new early stop priority.

[0155] In this way, by dynamically updating the early stop priority, it is ensured that only security policies with a priority no lower than the latest early stop priority are configured with the early stop attribute in the security policy table that is subsequently traversed. This allows for precise control over the triggering range of the early stop mechanism, ensuring the effectiveness of triggering high-priority security policies while avoiding matching omissions caused by low-priority policies mistakenly triggering early stop.

[0156] Understandably, when priority comparisons are involved in this application, a priority a is superior to another priority b, which means that priority a is higher than / greater than priority b; similarly, a priority a is not superior to another priority b, which means that priority a is lower than / less than priority b.

[0157] In one embodiment, after setting the early stop attribute via C4 as described above, some security policies may not have the early stop attribute set. However, these security policies may still be able to perform early stop during matching. Therefore, to further improve the rationality of the early stop attribute setting, the following steps D1~D3 can be used to set early stop for security policies that have omitted the early stop attribute:

[0158] D1: Following the construction order of each security policy table, access each security policy table in sequence, and for the currently accessed security policy table, determine the first security policy in that security policy table that does not have the early stop attribute set.

[0159] Here, the first security policy is the security policy in the security policy table that has not been set with the early stop attribute after steps C4-1 to C4-4.

[0160] In practice, each security policy table can be accessed sequentially according to the order in which they were constructed. For the currently accessed security policy table, each security policy is traversed one by one according to its storage order. For the currently traversed security policy, it is determined whether the security policy is configured with the early stop attribute. If yes, the traversal continues to the next security policy. If not, this security policy is taken as the first security policy. In this way, by traversing the security policies stored in the currently accessed security policy table one by one, the first security policies that are not configured with the early stop attribute can be identified from the currently accessed security policy table.

[0161] D2: For the currently determined first security policy, based on the first policy information of the first security policy under each preset matching domain and the second policy information of the second security policy in the unaccessed security policy table under each preset matching domain, determine whether there is a target second security policy whose policy information intersects with the first security policy; the policy priority of the second security policy is higher than the policy priority of the first security policy.

[0162] Here, the first security policy currently determined is the security policy currently identified in the currently accessed security policy table. Once a first security policy is determined, its early stop attribute can be set through steps D2 and D3.

[0163] The second security policy is a security policy that is located in an unaccessed security policy table and has a higher policy priority than the currently determined first security policy. For example, if there are 5 security policy tables, and the third security policy table is accessed and a current first security policy is determined from the first security policy table, then each second security policy with a higher policy priority than the first security policy can be determined from the unaccessed fourth and fifth security policy tables.

[0164] The first policy information is the specific configuration information of the first security policy under each preset matching domain (such as IP address domain, port domain, etc.). The second policy information is the specific configuration information of the second security policy under each preset matching domain (such as IP address domain, port domain, etc.).

[0165] Policy information intersection refers to the intersection of the first policy information of the first security policy and the second policy information of the second security policy across all preset matching domains, rather than intersection only in a single or partial preset matching domain. Specifically, "intersection" of policy information within a matching domain can mean that the configuration information of the two security policies overlaps, contains, or matches within that domain. For example, in the IP address domain, the IP address ranges of the two security policies partially or completely overlap; in the port domain, the port ranges of the two security policies overlap. Only when the policy information of the two security policies meets the above intersection conditions across all preset matching domains can it be determined that the policy information of the two security policies intersects. If the policy information of the two security policies does not intersect in any matching domain, then it can be determined that the policy information of the two security policies does not intersect.

[0166] The target second security policy can be a security policy in the second security policy whose policy information intersects with that of the first security policy in each preset matching domain.

[0167] In specific implementation, for any given first security policy, the first policy information of that first security policy under each preset matching domain can be extracted. Then, in an inaccessible security policy table, each second security policy with a higher policy priority than the first security policy can be identified. Next, an intersection test can be performed sequentially with each second security policy. Specifically, for each second security policy, the second policy information under each preset matching domain can be extracted. Then, for each preset matching domain, based on the first policy information of the first security policy and the second policy information of the second security policy under that preset matching domain, it can be determined whether the first and second security policies intersect within that preset matching domain. Furthermore, if the first policy information of the first security policy and the second policy information of the second security policy intersect in each preset matching domain, then the second security policy can be determined to be the target second security policy; if the first policy information of the first security policy and the second policy information of the second security policy do not intersect in at least one preset matching domain, then the second security policy can be determined not to be the target second security policy.

[0168] Thus, by comparing the first policy information of the currently determined first security policy under each preset matching domain with the second policy information of each second security policy under each preset matching domain, it is possible to accurately determine whether the target second security policy exists in the second security policy.

[0169] D3: If not, then the first safety policy is adopted, and the early stop attribute is set.

[0170] In practice, if it is determined that there is no target second security policy, that is, if the current first security policy and any second security policy have no policy information overlap, an early stop attribute can be set for the current first security policy. Conversely, if it is determined that there is any target second security policy, that is, if the current first security policy and any second security policy have policy information overlap, then an early stop attribute can be left unset for the current first security policy.

[0171] For example, D1~D3 above can be implemented using the following code:

[0172] (Sequence): / / The i-th security policy table accessed according to the order in which the various security policy tables were constructed.

[0173] (No early stop attribute set): / / For any security policy in Table_i where the early stop attribute is not set.

[0174] with (policy_high.priority>policy.priority) (policy policy_high / / For the security policy located in the j-th security policy table (policy_high) where j is greater than i, if the policy priority of policy_high is greater than the policy priority of the security policy without the early stop attribute, and the intersection of the policy information of policy_high and the security policy without the early stop attribute in each preset matching domain is not an empty set.

[0175] policy.early_stop := False / / A security policy that does not set the early stop attribute still does not have the early stop attribute.

[0176] continue; / / Continue

[0177] policy.early_stop := True / / Sets the early stop attribute for security policies that do not have it set.

[0178] This two-stage approach, which marks high-priority security policies in the reverse phase and processes the remaining security policies in the sequential phase, avoids redundant intersection tests on high-priority security policies. Furthermore, for security policies without early-stop attributes in the first phase, intersection tests determine if they have intersecting policies with higher priorities, thus confirming their eligibility for early stopping. This achieves both rapid marking of absolutely high-priority security policies and accurate marking of non-absolutely high-priority but non-intersecting security policies. The combined two-stage approach provides precise and comprehensive coverage of early-stop attributes. By setting node priorities for each node in a multi-security-policy-tree and early-stop attributes for security policies in leaf nodes, precise pruning of low-priority subtrees and early-stop return of high-priority security policies can be achieved during security policy matching. This improves the efficiency of large-scale security policy matching, ensures optimal matching results, and reduces computational overhead, thereby significantly enhancing the matching performance of the security policy tree.

[0179] In one embodiment, S105 described above can be implemented according to the following steps E1 to E4:

[0180] E1: Iterate through each constructed security policy tree in sequence, and for the currently traversed constructed security policy tree, determine whether there is a matching leaf node in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target message information related to the target matching domain in the message information, the policy priority of the matched candidate security policy, and the node priority of each tree node.

[0181] Here, the target matching field refers to a specific matching field that is pre-associated with the tree node and used for message matching determination. Specifically, the target matching field can be at least one of the preset matching fields.

[0182] The target message information is the specific message information under the target matching field among all the message information included in the message to be matched. For example, when the target matching field is the source IP address field, the target message information is the actual source IP address of the message to be matched; when the target matching field is the target port field, the target message information is the target port of the message to be matched.

[0183] Candidate security policies can be security policies found in the traversed security policy trees that match the packet to be matched. Specifically, during the traversal of the security policy trees, if the first constructed security policy tree is reached, or if no matching security policy is found in any of the traversed constructed security policy trees, the policy priority of the matched candidate security policy can be empty. If a matching security policy has already been determined during the traversal of a constructed security policy tree, and that security policy does not have the early stop attribute, then that security policy can be used as a candidate security policy. If multiple matching security policies have already been determined during the traversal of a constructed security policy tree, and none of these multiple security policies have the early stop attribute, then the security policy with the highest policy priority among these multiple security policies can be used as a candidate security policy.

[0184] A matching leaf node is a leaf node in the constructed security policy tree that may contain a matching security policy and whose node priority is higher than that of the matched candidate security policy.

[0185] In practice, each security policy tree can be traversed sequentially according to its construction order. For the currently traversed security policy tree, a comprehensive matching verification at the node level can be performed based on the message information of the message to be matched, the target message information under the target matching domain associated with the tree node, the policy priority of the matched candidate security policy, and the node priority of the tree node. This will determine whether there exists a matching leaf node in the currently traversed security policy tree that is a leaf node and has a higher priority than the policy priority of the candidate security policy.

[0186] If not, it can be determined that there is no matching leaf node in the currently traversed constructed security policy tree. Then, if there is an untraversed constructed security policy tree, the traversal can continue to the next constructed security policy tree; if there is no untraversed constructed security policy tree, the security policy matching result can be determined based on the matched candidate security policies. For example, if the candidate security policy is not empty, the specific candidate security policy can be returned as the security policy matching result; if the candidate security policy is empty, the security policy matching result indicating a failed match can be determined.

[0187] E2: If yes, then determine whether a matching security policy exists in the matching leaf node based on the various security policies and message information stored in the matching leaf node.

[0188] In practice, if a matching leaf node exists in the currently traversed constructed security policy tree, each security policy stored in the matching leaf node can be traversed sequentially. The security policy is then matched based on its policy information under each preset matching field and the message information of the packet to be matched to determine if a matching security policy exists. The security policy matching process can utilize existing security policy matching methods, such as continuous / discrete multi-bit matching. If multiple matching security policies exist in the matching leaf node, the final determined matching security policy can be the one with the highest policy priority and without the early stopping attribute. If only one matching security policy exists in the matching leaf node, that security policy can be used as the matching security policy.

[0189] If no matching security policy exists in the matching leaf node, the process can continue traversing the next constructed security policy tree.

[0190] E3: If yes, then determine whether the currently matched security policy has the early stop attribute.

[0191] In practice, if a matching security policy exists in the matching leaf node, that security policy can be used as the current matching security policy, and it can be determined whether the security policy has been given the early stopping attribute. If so, that is, if it has been given the early stopping attribute, the traversal and matching can be stopped directly, and the security policy can be used as the security policy matching result and returned.

[0192] E4: If not, if the policy priority of the currently matched security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy will be used as the new candidate security policy, and the process will continue to traverse the next security policy tree until a security policy with the early stopping attribute is matched or the last security policy tree is traversed, and the security policy matching result is obtained.

[0193] In practice, if the currently matched security policy is determined not to have the early stopping attribute, the policy priority of the currently matched security policy is further compared with that of the matched candidate security policies. If the policy priority of the currently matched security policy is higher than that of the matched candidate security policy, the currently matched security policy is updated to a new candidate security policy, and the process continues to traverse the next security policy tree until a security policy with the early stopping attribute is matched or the last security policy tree is traversed. If the policy priority of the currently matched security policy is not higher than that of the matched candidate security policy, the current candidate security policy is retained as a matched candidate security policy. Subsequently, the process continues to traverse the next constructed security policy tree; this cycle repeats until a security policy with the early stopping attribute is matched in a constructed security policy tree, and the security policy with the early stopping attribute is taken as the security policy matching result; or until all constructed security policy trees have been traversed, and the security policy matching result is determined based on the candidate security policies.

[0194] In one embodiment, E1 can be implemented according to the following steps E1-1 to E1-4:

[0195] E1-1: Use the root node of the existing security policy tree as the current node to be matched.

[0196] When searching for a matching leaf node in any existing security policy tree, the search typically begins from the root node and proceeds downwards layer by layer. Therefore, the root node of the security policy tree serves as the initial entry point for node matching. In practice, for the currently traversed existing security policy tree, when starting node matching for that tree, its root node can be determined as the current node to be matched.

[0197] E1-2: Determine whether the priority of the current tree node to be matched is lower than the priority of the matched candidate security policy.

[0198] In practice, if the candidate security policy is empty, E1-3 below can be executed directly; if the candidate security policy is not empty, the priority of the current node to be matched in the tree can be determined to be lower than the priority of the candidate security policy. If it is lower, it can be determined that there is no matching leaf node in the currently traversed constructed security policy tree, and the next security policy tree can be traversed directly.

[0199] E1-3: If not, then if the current tree node to be matched is a non-leaf node, based on the target matching domain associated with the current tree node to be matched and the target message information related to the target matching domain in the message information, determine from each child node of the current tree node to be matched whether there is a target child node that matches the message to be matched.

[0200] Here, the target child node can be one of the child nodes of the current tree node to be matched, and the subtree corresponding to this child node may contain a matching security policy.

[0201] In practice, if the priority of the current tree node to be matched is not lower than the policy priority of the matched candidate security policy, it can be determined whether the current tree node to be matched is a non-leaf node. If it is not a non-leaf node, it can be directly used as a matching leaf node. If it is a non-leaf node, the target packet information corresponding to the target matching field can be extracted from the packet information based on the target matching field pre-associated with the current tree node to be matched. Based on the target packet information, all child nodes of the current tree node to be matched are compared one by one to determine whether there is a target child node that matches the packet to be matched.

[0202] Optionally, the process of searching for tree nodes that match the message to be matched layer by layer from the constructed security policy tree can refer to the node matching process in existing technologies, such as multi-bit matching.

[0203] If the target child node does not exist, the next security policy tree can be traversed directly. If the target child node exists, E1-4 below can be executed.

[0204] E1-4: If yes, then the target child node is taken as the new current tree node to be matched, and the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy is returned, until there is no target child node to match the message to be matched or the target child node to match the message to be matched is a leaf node, and the leaf node is taken as the matching leaf node.

[0205] In practice, if a target child node exists, it can be updated to the new current matching tree node. Then, return to step E1-2 to determine if the newly found current matching tree node meets the matching conditions. This process of searching for tree nodes continues until one of the following two situations occurs: 1. No target child node matching the message is found among the child nodes of the current matching tree node; in this case, the next constructed security policy tree can be directly traversed. 2. The identified target child node is a leaf node; this leaf node can be used as the matching leaf node in the currently traversed constructed security policy tree.

[0206] In one embodiment, E2 can be implemented according to the following steps E2-1 to E2-3:

[0207] E2-1: Iterate through each security policy stored in the matching leaf node in turn, and for the security policy currently being traversed, determine whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field.

[0208] Here, the third policy information can be the specific configuration information of the security policy stored in the matching leaf node under each preset matching domain.

[0209] In practice, after determining that a matching leaf node exists, each security policy stored in the matching leaf node can be traversed sequentially, and a policy matching verification can be performed on the currently traversed security policy. Specifically, the policy matching verification involves obtaining the third policy information for each preset matching field of the currently traversed security policy, determining whether the packet information of the packet to be matched matches the third policy information. If it does, it can be determined that the currently traversed security policy matches the packet to be matched; if not, it can be determined that the currently traversed security policy does not match the packet to be matched, and if there is an untraversed security policy, the traversal continues to the next security policy. If there is no untraversed security policy, it is determined that the policy matching for the matching leaf node is complete, and the matching result corresponding to the matching leaf node is obtained. This matching result can indicate that no matching security policy exists, or it can be a specific matching security policy.

[0210] E2-2: If so, then if the security policy currently being traversed does not have the early stopping attribute, determine whether there is an untraversed security policy in the matching leaf node whose policy priority is higher than that of the candidate security policy.

[0211] In practice, if the currently traversed security policy matches the packet to be matched, it is further determined whether the currently traversed security policy has an early stop attribute. If so, this security policy can be directly used as the security policy matching result and returned. If not, it is further matched against the leaf nodes to see if there is an untraversed security policy with a higher policy priority than the candidate security policy. In other words, it is determined whether there is an untraversed security policy with a higher policy priority. If there is no untraversed security policy with a higher policy priority, the candidate security policy can be updated based on the policy priority of the currently traversed security policy and the policy priority of the candidate security policy. The process of updating the candidate security policy is as follows: if the policy priority of the currently traversed security policy is higher than the policy priority of the candidate security policy, the currently traversed security policy will be used as the new candidate security policy and the traversal of the next constructed security policy tree will continue; if the policy priority of the currently traversed security policy is not higher than the policy priority of the candidate security policy, the currently traversed security policy can be ignored, the original candidate security policy will be maintained, and the traversal of the next constructed security policy tree will continue.

[0212] E2-3: If yes, continue traversing the untraversed security policies and return the step of determining whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field, until a security policy with the early stop attribute is matched or an untraversed security policy with a policy priority higher than the candidate security policy does not exist in the matching leaf node.

[0213] In practice, if a higher-priority untraveled security policy exists, the candidate security policy can be updated based on the policy priority of the currently traversed security policy and the policy priority of the candidate security policy. Then, the untraveled security policies are traversed again to obtain a new currently traversed security policy. The process then returns to the packet matching step in E2-1 to determine if the new currently traversed security policy matches the packet to be matched. If so, and if the new currently traversed security policy has the early-stop attribute and has been updated to a candidate security policy, it is directly used as the security policy matching result; otherwise, the process continues to determine if a higher-priority untraveled security policy exists. Thus, the process of searching for matching security policies in the matching leaf nodes is continuously executed until a security policy with the early stopping attribute that can be used as a candidate security policy is matched, and this security policy is taken as the security policy matching result; or, until the security policies in the matching leaf nodes are traversed, and it is determined that the policy matching for the matching leaf node is complete, and the matching result corresponding to the matching leaf node is obtained; or, until there is no untraversed security policy in the matching leaf node with a policy priority higher than the candidate security policy, and it is determined that the policy matching for the matching leaf node is complete, and the matching result corresponding to the matching leaf node is obtained.

[0214] The completion of security policy traversal in the matching leaf node can include the completion of traversal of all security policies in the matching leaf node, or the absence of any untraversed policies with a higher policy priority than the candidate security policy in the matching leaf node.

[0215] For example, S105 can be implemented using the following code:

[0216] Input: Packet information / / The input is the packet information of the packet to be matched under each preset matching field.

[0217] Output: Security policy matching result (18) / / Output is the security policy matching result

[0218] For each Tree in Tree_list: / / For each built security policy tree in the list of security policy trees

[0219] If not match_leaf(Tree, packet): / / If, based on the packet information, it is determined that no matching leaf node exists in the constructed security policy tree.

[0220] Continue / / Continue traversing the next constructed security policy tree

[0221] else: / / otherwise

[0222] If matched_policy.early_stop=True: / / If the matched security policy in the constructed security policy tree has the early stop attribute.

[0223] Return matched_policy / / Early stop return, that is, return the matched security policy as the security policy matching result.

[0224] else: / / otherwise

[0225] best_policy=matched_policy / / Select the matching security policy as the optimal candidate security policy.

[0226] while (there are untraversed nodes) (Node priority > best_policy.priority): / / If there are untraversed tree nodes, and the priority of the untraversed tree nodes is greater than the priority of the candidate security policy.

[0227] if leaf node matches new_policy: / / If among the untraversed security policies matching the leaf node, there exists a new security policy with the highest policy priority that matches.

[0228] best_policy=max(best_policy,new_policy) / / Select the new security policy as the optimal candidate security policy.

[0229] if best_policy updated: / / If the best candidate security policy has been updated

[0230] return best_policy / / Returns the best candidate security policy

[0231] return no_match / / Returns a security policy match result indicating that no matching security policy exists.

[0232] like Figure 4 As shown in the flowchart of a security policy matching method provided in this application embodiment, the method first traverses all security policy trees sequentially based on the message information under each preset matching domain of the message to be matched. It determines whether a security policy is matched in the currently traversed security policy tree. If no match is found, the method continues traversing the next security policy tree. If a match is found, it determines whether the early stop attribute of the security policy is True. If True, the security policy is returned directly. If not True, the security policy is recorded as a candidate security policy. Then, it determines whether there are any untraversed tree nodes with a higher priority than the candidate security policy. If so, it traverses to the leaf node for policy matching and determines whether a new security policy is matched. If a new security policy is matched, the candidate security policy is updated to a higher priority security policy based on the new security policy's priority and the candidate security policy's priority. The method then returns to the step of determining whether the early stop attribute of the security policy is True. If no new security policy is found, the process returns to the step of determining if there are any untraversed tree nodes with a priority higher than the priority of the candidate security policy. If there are no untraversed tree nodes or the priority of untraversed tree nodes is not higher than the priority of the candidate security policy, the process continues traversing the next security policy tree. Then, it checks if all security policy trees have been traversed. If not, the process returns to the step of traversing all security policy trees sequentially. If so, the process returns either no matching result or the latest candidate security policy.

[0233] This application improves the security policy matching method for scenarios where the number of firewall security policies reaches hundreds of thousands or millions. When adding, modifying, or deleting security policies, it constructs the priority attributes of intermediate nodes in a multi-security policy tree and the early-stop attributes of security policies in leaf nodes of the multi-security policy tree. During multi-security policy tree matching, if a matched security policy has an early-stop attribute, it is directly returned, skipping subsequent security policy tree matching; otherwise, the tree nodes of the security policy tree to be matched are traversed, comparing the priority of matched security policies with the node priority. If the node priority is lower than that of a matched security policy, subsequent nodes in the security policy tree to be matched are skipped. This multi-security policy tree matching method reduces memory usage while efficiently matching security policies, achieving matching performance superior to a single security policy tree.

[0234] The priority construction method for intermediate nodes of the security policy tree and the method for setting early stop attributes of security policies in leaf nodes of the security policy tree provided in this application embodiment are both used to improve the matching performance of the security policy tree. Therefore, in specific implementation, priority construction and early stop attribute setting can be used simultaneously or selectively. By using priority construction and early stop attribute setting together, the optimal matching performance can be achieved. If priority construction and early stop attribute setting are used selectively, there is also a significant improvement in matching performance compared to the security policy trees constructed in the prior art. The process for setting the early stop attribute of security policies includes two stages, where the implementation of the second stage involves more security policy intersection tests, which may cause its setting time to be longer than that of the first stage. In order to balance the setting time of the early stop attribute of security policies with the matching performance of multiple security policy trees, in actual implementation, the first stage is a mandatory implementation step, and the second stage is an optional implementation step. It can be decided whether to execute the relevant operations of the second stage according to different needs for setting efficiency and performance improvement.

[0235] To further verify the effectiveness and superiority of the security policy matching method proposed in this application, three typical large-scale security policy test datasets—ACL_100k, FW_100k, and IPC_100k—were selected in the standard testing environment of the ClassBench packet classification benchmark tool, and comparative tests were conducted with existing security policy matching schemes. Test results show that in large-scale security policy matching application scenarios, the security policy matching performance of this application is significantly improved compared to existing solutions, with matching efficiency increased to 1.2 to 1.5 times. Therefore, based on the comparative experiments, the adaptability and efficiency of the proposed solution in large-scale security policy matching scenarios can be fully demonstrated.

[0236] Based on the same inventive concept, this application also provides a security policy matching device corresponding to the security policy matching method. Since the principle of the device in this application is similar to the security policy matching method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0237] like Figure 5 The diagram shown is a schematic of a security policy matching device provided in an embodiment of this application, comprising:

[0238] The construction module 501 is used to construct each non-leaf node and each leaf node according to each security policy to be assigned during the construction of any security policy tree in multiple security policy trees, and to determine and store the leaf nodes to be stored for each security policy.

[0239] The first determining module 502 is used to set the node priority of each non-leaf node to an invalid priority, and to determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node.

[0240] The generation module 503 is used to traverse the security policy tree using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order of traversal; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node;

[0241] The second determining module 504 is used to traverse the first node linked list and, for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0242] The matching module 505 is used to receive the message to be matched, and determine the security policy matching result that matches the message to be matched from each of the constructed security policy trees based on the message information of the message to be matched under each preset matching domain, the node priority of each tree node in each constructed security policy tree and the policy priority of each security policy stored in each leaf node.

[0243] In one possible implementation, the device further includes an adding module 506, for:

[0244] In response to a policy addition operation for any existing security policy tree, the first leaf node to which the security policy to be added belongs is determined from the existing security policy tree based on the policy information of the security policy to be added under each preset matching domain.

[0245] The security policy to be added is stored in the first leaf node, and the latest node priority of the first leaf node is determined according to the policy priority of the security policy to be added and the current node priority of the first leaf node.

[0246] In response to the condition of meeting the node priority update, the security policy tree is traversed using a breadth-first traversal method to obtain the second node linked list;

[0247] Traverse the second node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0248] In one possible implementation, the device further includes an editing module 507, for:

[0249] In response to a policy editing operation for any constructed security policy tree, the second leaf node to which the security policy to be edited belongs is determined from the constructed security policy tree;

[0250] In the second leaf node, perform policy editing operations on the security policy to be edited, and determine whether it is necessary to backtrack the parent nodes of the second leaf node according to the policy priority of the security policy to be edited and the current node priority of the second leaf node.

[0251] If so, determine the latest node priority of the second leaf node, and determine the parent node to be modified based on the current node priority of each level of the parent nodes of the second leaf node and the policy priority of the security policy to be edited.

[0252] Set the current node priority of the modified parent node to an invalid priority, and traverse the security policy tree using a breadth-first traversal method to obtain the third node linked list;

[0253] Traverse the third node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

[0254] In one possible implementation, the device further includes a third determining module 508, configured to:

[0255] Following the tree construction order of each constructed security policy tree, construct the security policy table corresponding to each constructed security policy tree in sequence;

[0256] For any constructed security policy tree, according to the policy priority of the security policies stored in each leaf node of the constructed security policy tree, each security policy is stored in the security policy table corresponding to the constructed security policy tree, and the highest priority among the policy priorities of the security policies is set as the table priority of the security policy table.

[0257] For each security policy in the last constructed security policy table, set an early stop attribute; the early stop attribute of the security policy is used to use the security policy as the security policy matching result when any unmatched packet matches the security policy.

[0258] Based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables, set the early stop attribute for the security policies in the other security policy tables.

[0259] In one possible implementation, the third determining module 508, when setting the early stop attribute for security policies in other security policy tables based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables, is used to:

[0260] Set the priority of the last security policy table to the early stop priority;

[0261] Following the reverse order of the construction order of each security policy table, traverse each other security policy table except for the last one constructed.

[0262] For the security policy table currently being traversed, set the early stop attribute for the security policies in the current security policy table whose policy priority is higher than or equal to the early stop priority;

[0263] If the priority of the security policy table being traversed is higher than the early stop priority, the priority of the security policy table being traversed is taken as the new early stop priority and the traversal continues to the next security policy table until the early stop attribute settings of each security policy in the first constructed security policy table are completed.

[0264] In one possible implementation, the third determining module 508 is further configured to:

[0265] According to the construction order of each security policy table, each security policy table is accessed in turn, and for the security policy table currently accessed, the first security policy that does not have the early stop attribute set in that security policy table is determined in turn.

[0266] For the currently determined first security policy, based on the first policy information of the first security policy under each preset matching domain and the second policy information of the second security policy in the unaccessed security policy table under each preset matching domain, it is determined whether there is a target second security policy whose policy information intersects with the first security policy; the policy priority of the second security policy is higher than the policy priority of the first security policy.

[0267] If not, then the first security policy is used, and the early stop attribute is set.

[0268] In one possible implementation, the matching module 505, when determining the security policy result matching the message to be matched from each of the constructed security policy trees based on the message information of the message to be matched under each preset matching domain, and the node priority of each tree node and the policy priority of each security policy stored in each leaf node of each constructed security policy tree, is configured to:

[0269] Each of the constructed security policy trees is traversed sequentially, and for the currently traversed constructed security policy tree, the presence of a matching leaf node is determined based on the target matching domain associated with each tree node in the constructed security policy tree, the target message information related to the target matching domain in the message information, the policy priority of the matched candidate security policy, and the node priority of each tree node.

[0270] If so, then based on the various security policies stored in the matching leaf node and the message information, determine whether there is a matching security policy in the matching leaf node;

[0271] If so, determine whether the currently matched security policy has the early stop attribute;

[0272] If not, then if the policy priority of the currently matched security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy will be used as the new candidate security policy, and the process will continue to traverse the next security policy tree until a security policy with the early stopping attribute is matched or the last security policy tree is traversed, thus obtaining the security policy matching result.

[0273] In one possible implementation, the matching module 505, when determining whether a matching leaf node exists in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target packet information related to the target matching domain in the packet information, the policy priority of the matched candidate security policies, and the node priority of each tree node, is configured to:

[0274] The root node of the constructed security policy tree is taken as the current node to be matched.

[0275] Determine whether the priority of the current tree node to be matched is lower than the priority of the matched candidate security policy;

[0276] If not, then if the current tree node to be matched is a non-leaf node, then based on the target matching domain associated with the current tree node to be matched and the target message information related to the target matching domain in the message information, determine from each child node of the current tree node to be matched whether there is a target child node that matches the message to be matched.

[0277] If so, the target child node is taken as the new current tree node to be matched, and the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy is returned, until there is no target child node that matches the message to be matched or the target child node that matches the message to be matched is a leaf node, and the leaf node is taken as the matching leaf node.

[0278] In one possible implementation, the matching module 505, when determining whether a matching security policy exists in the matching leaf node based on the various security policies stored in the matching leaf node and the message information, is configured to:

[0279] The system sequentially traverses each security policy stored in the matching leaf node, and for the currently traversed security policy, determines whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching domain.

[0280] If so, then if the security policy currently being traversed does not have the early stop attribute, determine whether there is an untraversed security policy in the matching leaf node whose policy priority is higher than that of the candidate security policy.

[0281] If so, continue traversing the untraversed security policies and return to the step of determining whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field, until a security policy with the early stop attribute is matched or the matching leaf node does not have an untraversed security policy with a policy priority higher than the candidate security policy.

[0282] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0283] Based on the same technical concept, embodiments of this application also provide a computing device. (Refer to...) Figure 6 The diagram shown is a structural schematic of a computing device provided in an embodiment of this application, comprising:

[0284] The processor 601, memory 602, and bus 603 are included. Memory 602 stores machine-readable instructions executable by the processor 601. The processor 601 executes the machine-readable instructions stored in memory 602. When the machine-readable instructions are executed by the processor 601, the processor 601 executes the above-described S101 to S105.

[0285] The aforementioned memory 602 includes a main memory 6021 and an external memory 6022. The main memory 6021, also known as internal memory, is used to temporarily store the computational data in the processor 601, as well as the data exchanged with external memory such as a hard disk 6022. The processor 601 exchanges data with the external memory 6022 through the main memory 6021. When the computing device is running, the processor 601 and the memory 602 communicate through the bus 603, so that the processor 601 executes the execution instructions mentioned in the above method embodiments.

[0286] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the security policy matching method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0287] This application also provides a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the security policy matching method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0288] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0289] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it can be understood that the disclosed system and method can be implemented in other ways. The system embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of the system or units may be electrical, mechanical, or other forms.

[0290] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0291] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0292] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.< / node> < / node>

Claims

1. A security policy matching method, characterized in that, The method includes: In the process of constructing any one of the multiple security policy trees, each non-leaf node and each leaf node are constructed according to each security policy to be assigned, and the leaf nodes to be stored for each security policy are determined and stored. Set the node priority of each non-leaf node to an invalid priority, and determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node; The security policy tree is traversed using a breadth-first traversal method to obtain a first node linked list; the first node linked list stores each tree node in reverse order of traversal; the tree node is a leaf node or a non-leaf node; the storage position of the leaf node is located before the non-leaf node; Traverse the first node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node. Receive the message to be matched, traverse each constructed security policy tree in turn, and for the currently traversed constructed security policy tree, determine whether there is a matching leaf node in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target message information related to the target matching domain in the message information, the policy priority of the matched candidate security policy, and the node priority of each tree node. If so, then based on the various security policies stored in the matching leaf node and the message information, determine whether there is a matching security policy in the matching leaf node; If so, determine whether the currently matched security policy has the early stop attribute; the early stop attribute is used to indicate that when a security policy is matched, the matching is stopped and the security policy is taken as the security policy matching result. If not, then if the policy priority of the currently matched security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy will be used as the new candidate security policy, and the process will continue to traverse the next security policy tree until a security policy with the early stopping attribute is matched or the last security policy tree is traversed, thus obtaining the security policy matching result.

2. The method according to claim 1, characterized in that, The method further includes: In response to a policy addition operation for any existing security policy tree, the first leaf node to which the security policy to be added belongs is determined from the existing security policy tree based on the policy information of the security policy to be added under each preset matching domain. The security policy to be added is stored in the first leaf node, and the latest node priority of the first leaf node is determined according to the policy priority of the security policy to be added and the current node priority of the first leaf node. In response to the condition of meeting the node priority update, the security policy tree is traversed using a breadth-first traversal method to obtain the second node linked list; Traverse the second node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

3. The method according to claim 1, characterized in that, The method further includes: In response to a policy editing operation for any constructed security policy tree, the second leaf node to which the security policy to be edited belongs is determined from the constructed security policy tree; In the second leaf node, perform policy editing operations on the security policy to be edited, and determine whether it is necessary to backtrack the parent nodes of the second leaf node according to the policy priority of the security policy to be edited and the current node priority of the second leaf node. If so, determine the latest node priority of the second leaf node, and determine the parent node to be modified based on the current node priority of each level of the parent nodes of the second leaf node and the policy priority of the security policy to be edited. Set the current node priority of the modified parent node to an invalid priority, and traverse the security policy tree using a breadth-first traversal method to obtain the third node linked list; Traverse the third node linked list, and for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node.

4. The method according to claim 1, characterized in that, The method further includes: Following the tree construction order of each constructed security policy tree, construct the security policy table corresponding to each constructed security policy tree in sequence; For any constructed security policy tree, according to the policy priority of the security policies stored in each leaf node of the constructed security policy tree, each security policy is stored in the security policy table corresponding to the constructed security policy tree, and the highest priority among the policy priorities of the security policies is set as the table priority of the security policy table. For each security policy in the last constructed security policy table, set an early stop attribute; the early stop attribute of the security policy is used to use the security policy as the security policy matching result when any unmatched packet matches the security policy. Based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables, set the early stop attribute for the security policies in the other security policy tables.

5. The method according to claim 4, characterized in that, The step of setting the early stop attribute for security policies in other security policy tables based on the table priority of the last constructed security policy table and the policy priorities of security policies in other security policy tables includes: Set the priority of the last security policy table to the early stop priority; Following the reverse order of the construction order of each security policy table, traverse each other security policy table except for the last one constructed. For the security policy table currently being traversed, set the early stop attribute for the security policies in the current security policy table whose policy priority is higher than or equal to the early stop priority; If the priority of the security policy table being traversed is higher than the early stop priority, the priority of the security policy table being traversed is taken as the new early stop priority and the traversal continues to the next security policy table until the early stop attribute settings of each security policy in the first constructed security policy table are completed.

6. The method according to claim 4, characterized in that, The method further includes: According to the construction order of each security policy table, each security policy table is accessed in turn, and for the security policy table currently accessed, the first security policy that does not have the early stop attribute set in that security policy table is determined in turn. For the currently determined first security policy, based on the first policy information of the first security policy under each preset matching domain and the second policy information of the second security policy in the unaccessed security policy table under each preset matching domain, it is determined whether there is a target second security policy whose policy information intersects with the first security policy; the policy priority of the second security policy is higher than the policy priority of the first security policy. If not, then the first security policy is used, and the early stop attribute is set.

7. The method according to claim 1, characterized in that, The step of determining whether a matching leaf node exists in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target packet information related to the target matching domain in the packet information, the policy priority of the matched candidate security policies, and the node priority of each tree node includes: The root node of the constructed security policy tree is taken as the current node to be matched. Determine whether the priority of the current tree node to be matched is lower than the priority of the matched candidate security policy; If not, then if the current tree node to be matched is a non-leaf node, then based on the target matching domain associated with the current tree node to be matched and the target message information related to the target matching domain in the message information, determine from each child node of the current tree node to be matched whether there is a target child node that matches the message to be matched. If so, the target child node is taken as the new current tree node to be matched, and the step of determining whether the node priority of the current tree node to be matched is lower than the policy priority of the matched candidate security policy is returned, until there is no target child node that matches the message to be matched or the target child node that matches the message to be matched is a leaf node, and the leaf node is taken as the matching leaf node.

8. The method according to claim 1, characterized in that, The step of determining whether a matching security policy exists in the matching leaf node based on the various security policies stored in the matching leaf node and the message information includes: The system sequentially traverses each security policy stored in the matching leaf node, and for the currently traversed security policy, determines whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching domain. If so, then if the security policy currently being traversed does not have the early stop attribute, determine whether there is an untraversed security policy in the matching leaf node whose policy priority is higher than that of the candidate security policy. If so, continue traversing the untraversed security policies and return to the step of determining whether the security policy matches the message to be matched based on the message information and the third policy information of the security policy under each preset matching field, until a security policy with the early stop attribute is matched or the matching leaf node does not have an untraversed security policy with a policy priority higher than the candidate security policy.

9. A security policy matching device, characterized in that, include: The construction module is used to construct each non-leaf node and each leaf node according to each security policy to be assigned during the construction of any security policy tree in multiple security policy trees, and to determine and store the leaf nodes that each security policy needs to be stored. The first determining module is used to set the node priority of each non-leaf node to an invalid priority, and to determine the node priority of each leaf node according to the policy priority of each security policy stored in each leaf node. The generation module is used to traverse the security policy tree using a breadth-first traversal method to obtain the first node linked list; The first node linked list stores each tree node in reverse order according to the traversal order; The tree node can be a leaf node or a non-leaf node; the storage location of the leaf node is located before the non-leaf node; The second determining module is used to traverse the first node linked list and, for the currently traversed tree node, determine the latest node priority of the parent node based on the current node priority of the tree node and the current node priority of the parent node of the tree node. The matching module is used to receive the message to be matched, traverse each constructed security policy tree in sequence, and for the currently traversed constructed security policy tree, determine whether there is a matching leaf node in the constructed security policy tree based on the target matching domain associated with each tree node in the constructed security policy tree, the target message information related to the target matching domain in the message information, the policy priority of the matched candidate security policy, and the node priority of each tree node. If yes, then based on the security policies stored in the matching leaf node and the message information, determine whether there is a matching security policy in the matching leaf node; if yes, determine whether the currently matched security policy has an early stop attribute; the early stop attribute is used to indicate that when a security policy is matched, the matching stops and the security policy is taken as the security policy matching result; if no, if the policy priority of the currently matched security policy is higher than the policy priority of the matched candidate security policy, the currently matched security policy is taken as a new candidate security policy, and the next security policy tree is traversed until a security policy with an early stop attribute is matched or the last security policy tree is traversed to obtain the security policy matching result.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the security policy matching method as described in any one of claims 1 to 8.

11. A computing device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the security policy matching method as described in any one of claims 1 to 8.

Images