Firewall path determination method and device

Abstract

The invention discloses a firewall path determination method and device, and relates to the technical field of network security. A specific embodiment of the method comprises the following steps: acquiring an access request comprising an access source address and an access destination address; determining a first address set corresponding to the access source address and a second address set corresponding to the access destination address from a plurality of pieces of pre-configured address set information; according to configuration elements included in the address set information, determining a source address set different from the second address set from the first address set, and determining a destination address set different from the first address set from the second address set; and determining a firewall path corresponding to the access request according to the configuration elements respectively corresponding to the source address set and the destination address set. According to the embodiment, automatic analysis of the firewall path is realized, the path analysis efficiency is improved, and the probability of configuration errors and missed configuration caused by manual errors can be reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for determining firewall paths. Background Technology

[0002] During network planning, firewalls need to be deployed between various business areas and functional areas within the data center for access control. Therefore, the activation of policies involves a large amount of firewall path analysis work.

[0003] Existing firewall path analysis is often performed manually. However, as networks grow larger and firewall paths often traverse multiple firewalls, manual path analysis is labor-intensive, inefficient, and prone to configuration errors and omissions. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a firewall path determination method and apparatus. After obtaining an access request, a first set of address sets corresponding to the source address in the access request and a second set of address sets corresponding to the destination address in the access request are determined. Then, based on the configuration elements included in the address set information in the first and second set of address sets, a source address set different from the second set of address sets is determined from the first set of address sets, and a destination address set different from the first set of address sets is determined from the second set of address sets. Finally, based on the configuration elements corresponding to the address set information in the source and destination set of address sets, the firewall path corresponding to the access request is determined. This achieves automatic firewall path analysis, improves path analysis efficiency, and reduces the probability of configuration errors and omissions due to human error.

[0005] To achieve the above objectives, according to one aspect of the present invention, a firewall path determination method is provided, the method comprising:

[0006] Obtain the access request, which includes the source address and the destination address.

[0007] From a plurality of pre-configured address sets, one or more address sets corresponding to the access source address are determined to form a first address set, and one or more address sets corresponding to the access destination address are determined to form a second address set; each address set includes an address range and configuration elements.

[0008] Based on the configuration elements, a source address set set that is different from the second address set set is determined from the first address set set, and a destination address set set that is different from the first address set set is determined from the second address set set set.

[0009] Based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set, determine the firewall path corresponding to the access request.

[0010] Optionally, based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set, the firewall path corresponding to the access request is determined, including:

[0011] Based on the configuration elements corresponding to one or more address sets in the source address set, determine one or more source firewall identifiers in the source address set; and based on the configuration elements corresponding to one or more address sets in the destination address set, determine one or more destination firewall identifiers in the destination address set.

[0012] When one or more source firewall identifiers are not completely identical to one or more destination firewall identifiers, the target topology information corresponding to the source firewall identifiers and destination firewall identifiers is obtained from the pre-configured topology information; the pre-configured topology information indicates the mapping relationship between multiple firewall identifiers and the security domain information corresponding to each firewall identifier.

[0013] The firewall path is determined based on the target topology information. The firewall path includes: source firewall identifier, source firewall source security domain, source firewall destination security domain, destination firewall identifier, destination firewall source security domain, and destination firewall destination security domain.

[0014] Optionally, determining the firewall path based on the target topology information includes: calculating the Cartesian product of the address set information in the source address set and the address set information in the destination address set to obtain one or more data pairs; obtaining the target topology information corresponding to each data pair based on the source firewall identifier and the destination firewall identifier in each data pair; determining the firewall node information corresponding to each data pair based on the target topology information corresponding to each data pair; and determining the firewall path corresponding to the access request based on the union of the firewall node information.

[0015] Optionally, the firewall path corresponding to each data pair is determined based on the target topology information corresponding to each data pair, including:

[0016] The security domain information of the source firewall identifier in the data pair is used as the source firewall source security domain information, and the security domain information corresponding to the source firewall identifier is determined from the target topology information. The determined security domain information is used as the source firewall destination security domain information.

[0017] The security domain information of the destination firewall identifier in the data pair is used as the destination firewall's destination security domain information, and the security domain information corresponding to the destination firewall identifier is determined from the target topology information. The determined security domain information is used as the destination firewall's source security domain information.

[0018] Optionally, in the case of multiple data pairs, before obtaining the target topology information based on the source firewall identifier and destination firewall identifier in each data pair, the method further includes: determining that the source firewall identifier and destination firewall identifier in the data pair are different.

[0019] Optionally, the firewall node information corresponding to each data pair is determined based on the target topology information corresponding to each data pair, including: determining the source firewall node information corresponding to the source firewall identifier in the data pair, and the destination firewall node information corresponding to the destination firewall identifier in the data pair; the source firewall node information includes: source firewall identifier, source firewall source security domain information, and source firewall destination security domain information; the destination firewall node information includes: destination firewall identifier, destination firewall source security domain information, and destination firewall destination security domain information.

[0020] Optionally, the configuration elements also include: protection distance information; the source firewall node information also includes a first protection distance corresponding to the source firewall identifier, and the destination firewall node information also includes a second protection distance corresponding to the destination firewall identifier;

[0021] The firewall path corresponding to the access request is determined based on the union of the information of each firewall node, including: calculating the first union of the information of each source firewall node, and sorting the source firewall node information in the first union in ascending order according to the first protection distance; calculating the second union of the information of each destination firewall node, and sorting the destination firewall node information in the second union in descending order according to the second protection distance; and obtaining the firewall path based on the sorting result.

[0022] Optionally, obtaining the firewall path based on the sorting result includes: deleting the first protection distance and the second protection distance from the sorted first union and second union respectively; calculating the union of the first union and the second union based on the deletion result, and using the calculated union as the firewall path.

[0023] Optionally, determining the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set, further includes:

[0024] If the source firewall identifier in the source address set is the same as the destination firewall identifier in the destination address set, the source firewall identifier or the destination firewall identifier is used as the firewall identifier in the firewall path, the security domain information in the source address set is used as the firewall source security domain information in the firewall path, and the security domain information in the destination address set is used as the firewall destination security domain information in the firewall path to form a firewall path.

[0025] Optionally, the configuration elements include: firewall identifier and security domain information, switch VPN instance information and protection distance information; determining a source address set different from the second address set from the first address set based on the configuration elements, and determining a destination address set different from the first address set from the second address set, including: calculating the intersection of the first address set and the second address set based on the configuration elements, and calculating the first difference between the first address set and the intersection, and the second difference between the second address set and the intersection; using the first difference as the source address set and the second difference as the destination address set.

[0026] To achieve the above objectives, according to another aspect of the present invention, a firewall path determination apparatus is provided, the apparatus comprising: a request acquisition module, an address set determination module, and a path determination module; wherein,

[0027] The request retrieval module is configured to retrieve access requests, which include the source address and the destination address.

[0028] The address set determination module is configured to: determine one or more address sets corresponding to the access source address from a pre-configured set of address sets to form a first address set; and determine one or more address sets corresponding to the access destination address to form a second address set. Each address set includes an address range and configuration elements. Based on the configuration elements, the module determines a source address set that is different from the second address set from the first address set, and determines a destination address set that is different from the first address set from the second address set.

[0029] The path determination module is configured to determine the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set.

[0030] To achieve the above objectives, according to another aspect of the present invention, an electronic device for determining a firewall path is provided, the electronic device comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to execute the instructions to implement a firewall path determination method according to an embodiment of the present invention.

[0031] To achieve the above objectives, according to another aspect of the present invention, a computer-readable storage medium is provided, which, when the instructions in the computer-readable storage medium are executed by the processor of a server that determines a firewall path, enables the server to perform a firewall path determination method according to an embodiment of the present invention.

[0032] To achieve the above objectives, according to another aspect of the present invention, a computer program product is provided, including a computer program that, when executed by a processor, implements a firewall path determination method according to an embodiment of the present invention.

[0033] One embodiment of the above invention has the following advantages or beneficial effects: After obtaining an access request, a first set of addresses corresponding to the source address in the access request and a second set of addresses corresponding to the destination address in the access request are determined. Then, based on the configuration elements included in the address set information in the first and second set of addresses, a source set of addresses different from the second set of addresses is determined from the first set of addresses, and a destination set of addresses different from the first set of addresses is determined from the second set of addresses. Furthermore, based on the configuration elements corresponding to the address set information in the source and destination set of addresses, the firewall path corresponding to the access request is determined. This achieves automatic firewall path analysis, improves path analysis efficiency, and reduces the probability of configuration errors and omissions due to human error.

[0034] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0035] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0036] Figure 1 This is a flowchart illustrating a firewall path determination method provided in an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of a data center firewall configuration architecture provided by an embodiment of the present invention;

[0038] Figure 3 This is a flowchart illustrating another firewall path determination method provided in an embodiment of the present invention;

[0039] Figure 4 This is a flowchart illustrating another firewall path determination method provided in an embodiment of the present invention;

[0040] Figure 5 This is a flowchart illustrating another firewall path determination method provided in an embodiment of the present invention;

[0041] Figure 6 This is a flowchart illustrating a firewall path determination method provided by an embodiment of the present invention when the source address and the destination address correspond to the same address range;

[0042] Figure 7 This is a schematic diagram of the main modules of a firewall path determination device provided in an embodiment of the present invention;

[0043] Figure 8 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0044] Figure 9 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0045] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0046] To enable those skilled in the art to better understand this disclosure, the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings and specific implementation methods. It should be noted that, unless otherwise specified, the embodiments of the present invention and the technical features thereof can be combined with each other.

[0047] Figure 1 This is a firewall path determination method according to an embodiment of the present invention, the method comprising the following steps S101-S104:

[0048] Step S101: Obtain the access request, which includes the source address and the destination address.

[0049] For example, when a new service is launched, the corresponding firewall node access control policy needs to be configured for the access request corresponding to the new service. That is, the firewall path corresponding to the access request needs to be determined. The access source address and access destination address included in the access request determine the network area through which the request packet flows.

[0050] Step S102: Determine one or more address sets corresponding to the access source address from the pre-configured multiple address set information to form a first address set set, and determine one or more address sets corresponding to the access destination address to form a second address set set; each address set information includes an address range and configuration elements.

[0051] In this embodiment of the invention, multiple address set information are pre-configured, each address set information corresponding to one or more IP address network segments, which constitute the address range corresponding to that address set information. Each address set information, in addition to configuring the corresponding address range, also includes configuration elements such as firewall identifier, security domain information, switch VPN (Virtual Private Network) instance information, and protection distance information. Since firewalls divide network areas through security domains and trigger security checks for security control when packets flow across security domains, most firewall security policies are implemented based on security domains. Furthermore, by dividing different VPN instances, switches can achieve routing isolation between different VPN instances, thereby triggering security checks when packets flow between different VPN instances within the same firewall security domain, enabling security control through the firewall and further refining the security control area. Therefore, when configuring address set information, the firewall identifier, security domain information, and switch VPN instance corresponding to the address range are configured accordingly to configure the firewall protection policy corresponding to that address range. Furthermore, the protection distance information corresponding to the address range can also be configured, indicating the distance between the corresponding address range and the firewall node controlling that address range. For example, when an address range is controlled by multiple firewall nodes, the protection distance of the firewall node closest to the address range is 1, the protection distance of the next closest firewall node is 2, and so on. The protection distance of a firewall node increases with the distance from the address range, and the protection distance of the firewall node furthest from the address range is equivalent to the total number of firewall nodes that the address range needs to pass through. When an address range is controlled by only one firewall node, its corresponding protection distance is 1. For example, pre-configured multiple address set information can be shown in Table 1, where each row corresponds to one address set, and the corresponding data center firewall architecture can be as follows: Figure 2 As shown:

[0052] Table 1

[0053]

[0054] If the source address in the access request falls within the address range of a certain address set, then that address set is the address set corresponding to the source address. One or more address sets corresponding to the source address form the first address set S', and these address sets are elements of the first address set S'. Similarly, if the destination address in the access request falls within the address range of a certain address set, then that address set is the address set corresponding to the destination address. One or more address sets corresponding to the destination address form the second address set D'. For example, if the source address in the access request is 10.10.1.1, then its corresponding address sets are address set A and address set C. Therefore, the first address set S' = {(Firewall A, Trust, Vrf01, 1), (Firewall B, Untrust, Vrf01, 2)}. If the destination address in the access request is 10.10.3.1, then the corresponding address set information is address set B and address set C. Then the second address set D' = {(firewall A, Trust, Vrf02, 1), (firewall B, Untrust, Vrf01, 2)}.

[0055] Step S103: Based on the configuration elements, determine a source address set set that is different from the second address set set from the first address set set, and determine a destination address set set that is different from the first address set set from the second address set set.

[0056] As described above, the configuration elements in each address set information may include firewall identifier, security domain information, switch VPN instance information, and protection distance information. In determining the similarities and differences between address set information in the first address set and address set information in the second address set, for any first address set information in the first address set and any second address set information in the second address set: if any of the firewall identifier, security domain information, switch VPN instance information, or protection distance information corresponding to the first address set information and the second address set information are different, then it is determined that the first address set information and the second address set information are different. For example, for address set A and address set B in Table 1 above, their corresponding firewall names and firewall security domain information are the same, but their switch VPN instance information is different; therefore, address set A and address set B can be determined to be different address set information. That is, in this embodiment of the invention, the configuration elements corresponding to different address set information are not completely identical. To avoid address conflicts in network planning, in this embodiment of the invention, if the firewall identifiers corresponding to the same address range are the same, then the security domain information, switch VPN instance information, and protection distance information corresponding to that address range are the same, so that a network segment is allocated to a security zone.

[0057] In one embodiment of the present invention, the source address set and the destination address set can be determined by set operations to determine the similarities and differences between the first address set and the second address set. Specifically, the intersection of the first address set and the second address set can be calculated firstly based on the configuration elements, and then the first difference between the first address set and the intersection, and the second difference between the second address set and the intersection can be calculated based on the configuration elements; the first difference is taken as the source address set, and the second difference is taken as the destination address set. Taking the example of accessing the source address 10.10.1.1 and the destination address 10.10.3.1, the intersection X of the first address set S' and the second address set D' is the address set C, i.e., S'∩D'=X. Therefore, the first difference between the first address set S' and this intersection X can be calculated as the address set A, which is the element in the source address set S, i.e., S=S'-X={(Firewall A,Trust,Vrf01,1)}. The second difference between the second address set D' and this intersection X is the address set B, which is the element in the destination address set D, i.e., D=D'-X={(Firewall A,Trust,Vrf02,1)}.

[0058] In another embodiment of the present invention, a direct comparison method can also be used to determine the source address set S from the first address set S' and the destination address set D from the second address set D'. For example, if the first address set S' includes address set A and address set C, and the second address set D' includes address set B and address set C, the comparison shows that the address set information in the first address set S' that is the same as the address set in the second address set D' is address set C, and the address set information that is different is address set A. Therefore, address set A is determined to be an element in the source address set S. Similarly, if the address set information in the second address set D' that is the same as the address set S' is address set C, and the address set information that is different is address set B, then address set B can be used as an element in the destination address set D.

[0059] It is worth mentioning that if the first address set S' and the second address set D' contain the same elements, it means that they contain the same address set information. This also means that the firewall identifier, security domain information, and switch VPN instance corresponding to the access source address and the access destination address are exactly the same. Therefore, the access packet from the access source address to the access destination address does not need to pass through any firewall node, and in this case, there is no need to configure the firewall path.

[0060] Step S104: Determine the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set set and the address set information in the destination address set set.

[0061] In this embodiment of the invention, one or more source firewall identifiers can be determined from the source address set S based on the configuration elements corresponding to one or more address set information in the source address set S, and one or more destination firewall identifiers can be determined from the destination address set D based on the configuration elements corresponding to one or more address set information in the destination address set D. Then, based on the similarities and differences of the firewall identifiers in the configuration elements corresponding to the source address set and the destination address set, different methods are used to determine the corresponding firewall paths. It is understood that the number of source firewall identifiers is the same as the number of address set information in the source address set. If the source address set includes multiple address set information, the firewall identifier included in the configuration element of each address set information is the source firewall identifier, and in this case, there are multiple source firewall identifiers. If the source address set includes only one address set information, then there is only one source firewall identifier. For example, in the case of accessing the source address 10.10.1.1, the source firewall identifier is firewall A. Similarly, the number of destination firewall identifiers is also the same as the number of address set information in the destination address set. For the case of accessing the destination address 10.10.3.1, the destination firewall identifier is also firewall A. In this example, the source firewall identifier in the source address set is the same as the destination firewall identifier in the destination address set. This indicates that the access request needs to pass through one firewall node from the source address to the destination address, which is the firewall node corresponding to this firewall identifier (firewall node A in this example). It should be understood that since the security domain information, switch VPN instance information, and protection distance information corresponding to the same address range are the same under the control of a specified firewall node, and the address ranges corresponding to the source address and the destination address are uniquely determined, if the source firewall identifier and the destination firewall identifier are the same, then the source address set and the destination address set are either empty or both contain one address set information.

[0062] When both the source and destination address sets are empty, it means that the access packet from the source address to the destination address does not need to pass through any firewall nodes, and no firewall path needs to be configured in this case. When both the source and destination address sets contain address set information and their firewall identifiers are the same, the source firewall identifier or the destination firewall identifier can be used as the firewall identifier in the firewall path. The security domain information in the source address set can be used as the firewall source security domain information in the firewall path, and the security domain information in the destination address set can be used as the firewall destination security domain information in the firewall path. For example, in the example above where the source address is 10.10.1.1 and the destination address is 10.10.3.1, the source address set S = {(Firewall A, Trust, Vrf01, 1)}, and the destination address set D = {(Firewall A, Trust, Vrf02, 1)}, therefore the resulting firewall path is {(Firewall A, Trust, Trust)}.

[0063] Additionally, if the source firewall identifier and the destination firewall identifier are not exactly the same, it means that the access request needs to pass through at least two firewall nodes. In this case, the firewall path can be obtained through the pre-configured topology information. Specifically, the target topology information corresponding to the source firewall identifier and the destination firewall identifier can be obtained from the pre-configured topology information. Then, the firewall path is determined based on the target topology information. This firewall path includes: source firewall identifier, source firewall source security domain, source firewall destination security domain, destination firewall identifier, destination firewall source security domain, and destination firewall destination security domain.

[0064] The pre-configured topology information indicates the mapping relationship between multiple firewall identifiers and the security domain information corresponding to each firewall identifier, as shown in Table 2. In Table 2, the "Firewall Identifier" column is the name of the source firewall node in the topology path, the firewall identifier in the "Topology Information" column is the name of the destination firewall node corresponding to its source firewall node in the topology path, and the security domain information before and after the colon in the "Topology Information" column is the security domain information corresponding to the corresponding source firewall node and destination firewall node, respectively. For example, for the first row of data in Table 2, firewall A is the source firewall node, and firewalls B and C are the destination firewall nodes corresponding to firewall node A, respectively. That is, the topology path represented by the first row of Table 2 is: from the "Trust" security domain of firewall node A to the "Trust" security domain of firewall node B, and from the "Trust" security domain of firewall node A to the "Untrust" security domain of firewall node C. In addition, it can be understood that, besides the way topology information is recorded in Table 2, other methods such as adjacency matrices, indexes, or bipartite graphs can also be used to store the pre-configured topology information, and this embodiment of the invention does not limit this.

[0065] Table 2

[0066] Firewall Identifier Topology information Firewall A Firewall B: Trust: Trust, Firewall C: Trust: Untrust Firewall B Firewall A: Untrust: Untrust, Firewall C: Untrust: Untrust Firewall C Firewall A: Untrust: Untrust, Firewall B: Untrust: Untrust ... ...

[0067] Regardless of the method used to store topology information, the mapping relationship between the security domains of the source firewall identifier and the destination firewall identifier remains consistent. Therefore, the following explanation primarily uses Table 2 as an example to illustrate the process of determining the target topology information. In obtaining the target topology information, the topology information corresponding to the source firewall identifier is first obtained. For example, if the source firewall identifier is firewall A, its corresponding topology information is (Firewall B: Trust: Trust, Firewall C: Trust: Untrust). Then, the topology information corresponding to the destination firewall identifier is determined from the obtained topology information; this topology information is the target topology information. For example, if the destination firewall identifier is firewall C, then the determined target topology information is (Firewall C: Trust: Untrust).

[0068] The firewall path can then be determined based on the target topology information. In one embodiment of the present invention, in order to comprehensively configure the firewall path, the Cartesian product of the address set information in the source address set and the address set information in the destination address set can be calculated to obtain one or more data pairs; based on the source firewall identifier and the destination firewall identifier in each data pair, the target topology information corresponding to each data pair is obtained; based on the target topology information corresponding to each data pair, the firewall node information corresponding to that data pair is determined; and then, based on the union of the firewall node information, the firewall path corresponding to the access request is determined.

[0069] For example, if both the source firewall identifier and the destination firewall identifier are 1, and the source firewall identifier and the destination firewall identifier are different, then performing a Cartesian product on the address set information in the source address set and the address set information in the destination address set will yield a data pair. The source firewall identifier in this data pair is the same as the source firewall identifier in the source address set, and the destination firewall identifier in this data pair is the same as the destination firewall identifier in the destination address set. Therefore, when the number of address set information in the source address set and the destination address set is only 1, and the firewall identifiers are different, the step of calculating the Cartesian product can be ignored, and the target topology information can be determined directly based on the source firewall identifier and the destination firewall identifier.

[0070] Furthermore, if the number of source firewall identifiers is greater than 1 or the number of destination firewall identifiers is greater than 1, then performing a Cartesian product of the address set information in the source address set and the address set information in the destination address set yields multiple data pairs. The target topology information corresponding to each data pair can then be obtained based on the source firewall identifier and the destination firewall identifier in each data pair. For example, if the source address set S = (a1, a2) and the destination address set D = (b1, b2), a1 and a2 are two address set information pieces in the source address set, and each address set information piece includes a configuration element; the firewall identifier in the configuration element is the source firewall identifier. Similarly, b1 and b2 are two address set information pieces in the destination address set, and the firewall identifiers in these two address set information pieces are the destination firewall identifiers. Taking the Cartesian product of the address set information in the source address set S and the address set information in the destination address set D yields the set SD = S × D = {(a1,b1),(a1,b2),(a2,b1),(a2,b2)}. Each data pair in set SD includes a source firewall identifier and a destination firewall identifier, thus determining the target topology information corresponding to the data pair. Then, based on this target topology information, the firewall node information for the data pair can be determined accordingly, such as determining the source firewall node information corresponding to the source firewall identifier in the data pair, and the destination firewall node information corresponding to the destination firewall identifier in the data pair. The source firewall node information includes the source firewall identifier, the source firewall source security domain information, and the source firewall destination security domain information; the destination firewall node information includes the destination firewall identifier, the destination firewall source security domain, and the destination firewall destination security domain information. In this data pair, the security domain information of the source firewall identifier is the source firewall's source security domain information, and the security domain information corresponding to the source firewall identifier in the target topology information is the source firewall's destination security domain information. Similarly, the security domain information of the destination firewall identifier in the data pair is the destination firewall's destination security domain information, and the security domain information corresponding to the destination firewall identifier in the target topology information is the destination firewall's source security domain information. Taking the data pair consisting of datasets A and E shown in Table 1 as an example, this data pair is {(Firewall A, Trust, Vrf01, 1), (Firewall C, Trust, Vrf01, 1)}. According to the topology information shown in Table 2, the target topology information corresponding to this data pair is (Firewall C: Trust: Untrust). Therefore, the source firewall node information is (Firewall A: Trust: Trust), and the destination firewall node information is (Firewall C: Untrust: Trust). The source firewall node information and destination firewall node information corresponding to other data pairs can be obtained in the same way.In determining the source and destination firewall node information, if the source and destination firewall identifiers in a data pair are the same, it indicates that the data pair corresponds to the same firewall. In this case, the data pair can be ignored to improve the efficiency of firewall path analysis. In other words, when multiple data pairs exist, before determining the target topology information corresponding to the data pair, it can be determined that the source and destination firewall identifiers in the data pair are different. If the source and destination firewall identifiers in a data pair are the same, then the data pair is ignored. Therefore, this embodiment of the invention uses Cartesian product to obtain the data pairs corresponding to the address sets in the source address set and the address sets in the destination address set. This not only facilitates comprehensive configuration of firewall paths and avoids omissions, but also improves the efficiency of firewall path analysis due to the simplicity of the Cartesian product algorithm. Furthermore, the calculation process does not require the collection of network physical and logical topology results from the data center, nor does it require the collection of relevant information from the entire network, thus reducing the system resources occupied by the path analysis process and providing greater flexibility.

[0071] After obtaining the source firewall node information and destination firewall node information corresponding to each data pair, the union of the source firewall node information and destination firewall node information can be calculated to obtain the firewall path. In this process, to sort the firewall nodes in the firewall path according to the direction from the source address to the destination address, so as to facilitate the configuration of each firewall node based on the analyzed firewall path, in one embodiment of the present invention, the source firewall node information and destination firewall node information can be sorted based on protection distance information. Specifically, the protection distance corresponding to the source firewall identifier in the data pair can be used as the first protection distance corresponding to the corresponding source firewall node information, and the protection distance corresponding to the destination firewall identifier in the data pair can be used as the second protection distance corresponding to the destination firewall node information. Taking the above data pair {(Firewall A, Trust, Vrf01, 1), (Firewall C, Trust, Vrf01, 1)} as an example, considering the protection distance information, its corresponding source firewall node information is (Firewall A: Trust: Trust: 1), and the destination firewall node information is (Firewall C: Untrust: Trust: 1). Similarly, the source firewall node information and destination firewall node information corresponding to other data pairs can also be obtained. Each firewall node information also includes protection distance information. For example, for the above SD = {(a1,b1),(a1,b2),(a2,b1),(a2,b2)} which includes four data pairs, if the firewall identifiers are different, then four source firewall node information sets SP1, SP2, SP3, and SP4, and four destination firewall node information sets DP1, DP2, DP3, and DP4 corresponding to these four source firewall node information sets can be obtained. Then, the first union of the source firewall node information sets corresponding to each source firewall identifier, SP = SP1∪SP2∪SP3∪SP4, is calculated, and the second union of the destination firewall node information sets corresponding to each destination firewall identifier, DP = DP1∪DP2∪DP3∪DP4, is calculated. It is understandable that the first union SP includes unique address sets from SP1, SP2, SP3, and SP4, and the second union DP includes unique address sets from DP1, DP2, DP3, and DP4. Then, based on the first protection distance corresponding to each source firewall node information, the source firewall node information in the first union SP is sorted in ascending order, and based on the second protection distance corresponding to each destination firewall node information, the destination firewall nodes in the second union DP are sorted in descending order. The firewall path can then be obtained from the sorting results.

[0072] Since the protection distance information is mainly used to indicate the distance between the corresponding address range and the firewall node controlling that address range, it does not need to be configured in the firewall node and therefore does not need to be reflected in the final firewall path. Therefore, in order to simply and directly display the firewall path corresponding to the access request, facilitating subsequent configuration of the firewall node, in one embodiment of the present invention, the first protection distance and the second protection distance are deleted from the sorted first union SP and second union DP, respectively. Based on the deletion results, the processed first union SP' and second union DP' are obtained respectively. Then, the union SP'∪DP' of the processed first union SP' and second union DP' is calculated, and the calculated union is used as the firewall path. Thus, the formed firewall path includes: source firewall identifier, source firewall source security domain information, source firewall destination security domain information, destination firewall identifier, destination firewall source security domain information, and destination firewall destination security domain information, wherein the source firewall identifier and destination firewall identifier are sorted in the direction from the access source address to the destination access address.

[0073] The following examples illustrate firewall path determination methods under different circumstances through several specific embodiments.

[0074] Example 1

[0075] This embodiment takes the example of source firewall identifiers and destination firewall identifiers being the same, but their corresponding configuration elements not being completely identical. It combines the pre-configured address set information shown in Table 1 and the pre-configured topology information shown in Table 2 provided in the preceding embodiments to illustrate the firewall path determination method provided by this invention. Figure 3 As shown, the method may include the following steps:

[0076] Step S301: Obtain an access request, which includes the source address 10.10.1.1 and the destination address 10.10.3.1.

[0077] Step S302: Determine address set A and address set C from the pre-configured address set information to correspond to the access source address, and form a first address set set from address set A and address set C; and determine address set B and address set C to correspond to the destination access address, and form a second address set set from address set B and address set C.

[0078] Each address set includes an address range and configuration elements, including firewall identifier, security domain information, switch VPN instance information, and protection distance information.

[0079] In this step, the pre-configured address set information shown in Table 1 can be traversed, and the access source address 10.10.1.1 can be matched with the address ranges in each address set in Table 1. If the access source address belongs to a certain address range, then the address set information corresponding to that address range is the address set information in the first address set S' corresponding to the access source address. In this example, the access source address 10.10.1.1 is in both address set A and address set C. Therefore, the address set information in the first address set S' is the union of address set A and address set C, i.e., S' = {(Firewall A, Trust, Vrf01, 1), (Firewall B, Untrust, Vrf01, 2)}. Similarly, by traversing the pre-configured address set information shown in Table 1, the second address set D' corresponding to the access destination address 10.10.3.1 can be obtained as {(Firewall A, Trust, Vrf02, 1), (Firewall B, Untrust, Vrf01, 2)}.

[0080] Step S303: Calculate the intersection of the first address set and the second address set as address set C.

[0081] In this example, the intersection of the first set of addresses S' and the second set of addresses D' is X = S'∩D' = {(firewall B, Untrust, Vrf01, 2)}.

[0082] Step S304: Based on the configuration elements of each address set information, take the first difference between the first address set and the intersection of the first address set as the source address set, and take the second difference between the second address set and the intersection of the second address set as the destination address set.

[0083] Here, the source address set S = S'-X = {(firewall A, Trust, Vrf01, 1)}, and the destination address set D = D'-X = {(firewall A, Trust, Vrf02, 1)}.

[0084] Step S305: Based on the configuration elements corresponding to the source address set and the destination address set respectively, the source firewall identifier is used as the firewall identifier in the firewall path, the security domain information in the source address set is used as the firewall source security domain information in the firewall path, and the security domain information in the destination address set is used as the firewall destination security domain information in the firewall path, so as to form the firewall path.

[0085] In this example, both the source address set S and the destination address set D contain only one address set information, and the firewall name in both address set information is "Firewall A". This indicates that the firewall security domain and the VPN instance of the switch where the source address and destination address reside are not entirely the same. Furthermore, it can be concluded that the request packet from the source address to the destination address needs to pass through one firewall node. In this step, the security domain information in the source address set S is taken as the firewall source security domain information, and the security domain information in the destination address set D is taken as the firewall destination security domain information, resulting in the firewall path P = {(Firewall A, Trust, Trust)}.

[0086] Example 2

[0087] This second embodiment uses an example where the source address set and the destination address set each contain only one address set information, and the firewall identifiers in the source address set and the destination address set are different. It combines the pre-configured address set information shown in Table 1 and the pre-configured topology information shown in Table 2 provided in the previous embodiments to illustrate the firewall path determination method provided by this invention. Figure 4 As shown, the method may include the following steps:

[0088] Step S401: Obtain an access request, which includes the source address 10.10.4.1 and the destination address 10.10.5.1.

[0089] Step S402: Determine the address set information corresponding to the access source address from the pre-configured address set as address set D, and form a first address set from address set D; and determine the address set information corresponding to the destination access address as address set E, and form a second address set from address set E.

[0090] Similar to Embodiment 1, in this Embodiment 2, each address set includes an address range and configuration elements, including firewall identifier, security domain information, switch VPN instance information, and protection distance information.

[0091] In this step, the pre-configured address sets shown in Table 1 can be traversed, and the source address 10.10.4.1 can be matched with the address ranges in each address set in Table 1. If the source address belongs to a certain address range, the address set information corresponding to that address range is the address set information in the first address set S' corresponding to the source address. In this example, the source address 10.10.4.1 is in address set D, so the address set information in the first address set S' is address set D, i.e., S' = {(Firewall B, Trust, Vrf02, 1)}. Similarly, by traversing the pre-configured address sets shown in Table 1, the second address set D' = {(Firewall C, Trust, Vrf01, 1)} corresponding to the destination address 10.10.5.1 can be obtained.

[0092] Step S403: Calculate that the intersection of the first address set and the second address set is an empty set.

[0093] Step S404: Based on the configuration elements of each address set information, take the first difference between the first address set and the intersection of the first address set as the source address set, and take the second difference between the second address set and the intersection of the second address set as the destination address set.

[0094] In this example, since the intersection calculated in step S403 is an empty set, the first address set can be directly used as the source address set and the second address set can be used as the destination address set. That is, the source address set S = {(firewall B, Trust, Vrf02, 1)} and the destination address set D = {(firewall C, Trust, Vrf01, 1)}.

[0095] Step S405: Based on the source firewall identifier in the source address set and the destination firewall identifier in the destination address set, obtain the target topology information corresponding to the source firewall identifier and the destination firewall identifier from the pre-configured topology information.

[0096] As shown in Table 2 of the aforementioned embodiments, the pre-configured topology information indicates the mapping relationship between multiple firewall identifiers and the security domain information corresponding to each firewall identifier.

[0097] In this embodiment, since both the source address set S and the destination address set D contain only one address set information, and the firewall identifiers in the address set information are different, it can be determined that a request packet accessing the source address to the destination address needs to pass through two firewall nodes. In this step, the source firewall identifier can be determined as firewall B and the destination firewall identifier as firewall C based on the configuration elements of the source address set S. According to the topology information shown in Table 2, the corresponding target topology information can be determined as (firewall C: Trust: Untrust).

[0098] Step S406: Use the security domain information corresponding to the source firewall identifier as the source firewall source security domain information in the firewall path, use the security domain information corresponding to the source firewall identifier in the target topology information as the source firewall destination security domain information, use the security domain information corresponding to the destination firewall identifier as the destination firewall destination security domain information, and use the security domain information corresponding to the destination firewall identifier in the target topology information as the destination firewall source security domain information. Combine the source firewall identifier and the destination firewall identifier to form the firewall path.

[0099] In this example, the source firewall is identified as firewall B and its corresponding security domain information is Trust, based on the configuration elements of the source address set. The destination firewall is identified as firewall C and its corresponding security domain information is Trust, based on the configuration elements of the destination address set. Combining the target topology information (firewall C:Trust:Untrust) determined in step S405, the final firewall path P = {(firewall B:Trust:Trust),(firewall C:Untrust:Trust)} can be obtained.

[0100] Example 3

[0101] This third embodiment uses an example where the source address set includes multiple address set information, the destination address set includes one address set information, and the firewall identifiers in the source address set and the destination address set are different. It combines the pre-configured address set information shown in Table 1 and the pre-configured topology information shown in Table 2 provided in the preceding embodiments to illustrate the firewall path determination method provided by this invention. Figure 5 As shown, the method may include the following steps:

[0102] Step S501: Obtain an access request, which includes the source address 10.10.1.1 and the destination address 10.10.5.1.

[0103] Step S502: Determine address set A and address set C from the pre-configured address set information, which are the address set information in the first address set set corresponding to the access source address, and determine address set E from the address set set in the second address set set corresponding to the destination access address.

[0104] Each address set includes an address range and configuration elements, including firewall identifier, security domain information, switch VPN instance information, and protection distance information.

[0105] In this step, the pre-configured address set information shown in Table 1 can be traversed, and the access source address 10.10.1.1 can be matched with the address ranges in each address set in Table 1. If the access source address belongs to a certain address range, then the address set corresponding to that address range is the address set information in the first address set S' corresponding to the access source address. In this example, the access source address 10.10.1.1 is in both address set A and address set C. Therefore, the obtained first address set S' is the union of address set A and address set C, that is, S' = {(Firewall A, Trust, Vrf01, 1), (Firewall B, Untrust, Vrf01, 2)}. Similarly, by traversing the pre-configured address set information shown in Table 1, the second address set D' = {(Firewall C, Trust, Vrf01, 1)} corresponding to the access destination address 10.10.5.1 can be obtained.

[0106] Step S503: Calculate that the intersection of the first address set and the second address set is an empty set.

[0107] Step S504: Based on the configuration elements of each address set, take the first difference between the first address set and the intersection of the first address set as the source address set, and take the second difference between the second address set and the intersection of the second address set as the destination address set.

[0108] In this example, since the intersection calculated in step S503 is an empty set, the first address set can be directly used as the source address set and the second address set can be used as the destination address set. That is, the source address set S = {(firewall A, Trust, Vrf01, 1), (firewall B, Untrust, Vrf01, 2)} and the destination address set D = {(firewall C, Trust, Vrf01, 1)}.

[0109] Step S505: Calculate the Cartesian product of the address set information in the source address set and the address set information in the destination address set to obtain multiple data pairs.

[0110] In this step, the address set information in the source address set S = {(firewall A, Trust, Vrf01, 1), (firewall B, Untrust, Vrf01, 2)} is multiplied by the address set information in the destination address set D = {(firewall C, Trust, Vrf01, 1)} to obtain multiple data pairs. The set formed by these multiple data pairs is SD = S × D = {((firewall A, Trust, Vrf01, 1), (firewall C, Trust, Vrf01, 1)), ((firewall B, Untrust, Vrf01, 2), (firewall C, Trust, Vrf01, 1))}.

[0111] Step S506: Based on the source firewall identifier and destination firewall identifier in each data pair, obtain the target topology information corresponding to each data pair.

[0112] In this step, for the first data pair in set SD ((Firewall A, Trust, Vrf01, 1), (Firewall C, Trust, Vrf01, 1)), where the source firewall is identified as Firewall A and the destination firewall as Firewall C, according to the topology information shown in Table 2, the target topology information corresponding to this data pair can be obtained as (Firewall C: Trust: Untrust). Similarly, the target topology information corresponding to the second data pair in set SD ((Firewall B, Untrust, Vrf01, 2), (Firewall C, Trust, Vrf01, 1)) is obtained as (Firewall C: Untrust: Untrust).

[0113] Step S507: Based on the target topology information, determine the source firewall node information corresponding to the source firewall identifier in each data pair, and the destination firewall node information corresponding to the destination firewall identifier in each data pair.

[0114] In this step, for each data pair corresponding to the target topology information, the security domain information corresponding to the source firewall identifier in the data pair is used as the source firewall source security domain information in the source firewall node information, and the security domain information corresponding to the source firewall identifier in the target topology information is used as the source firewall destination security domain information in the source firewall node information. Combining the source firewall identifier in the data pair with its corresponding first protection distance, the source firewall node information corresponding to the source firewall identifier in the data pair is obtained. Similarly, the security domain information corresponding to the destination firewall identifier in the data pair is used as the destination firewall destination security domain information in the destination firewall node information, and the security domain information corresponding to the destination firewall identifier in the target topology information is used as the destination firewall source security domain information in the destination firewall node information. Combining the destination firewall identifier in the data pair with its corresponding second protection distance, the source firewall node information corresponding to the source firewall identifier in the data pair is obtained.

[0115] Specifically, for the first data pair in the set SD ((Firewall A, Trust, Vrf01, 1), (Firewall C, Trust, Vrf01, 1)), we can obtain the source firewall identifier as Firewall A, the source firewall source security domain as Trust, and the first protection distance as 1, and the destination firewall identifier as Firewall C, the destination firewall destination security domain as Trust, and the protection distance as 1. Further, combining the target topology information corresponding to this data pair determined in step S406 as (Firewall C: Trust: Untrust), we can obtain the source firewall destination security domain as Trust and the destination firewall source security domain as Untrust. Therefore, we determine the source firewall node information SP1 = {(Firewall A: Trust: Trust: 1)} and the destination firewall node information DP1 = {(Firewall C: Untrust: Trust: 1)} corresponding to this data pair. Similarly, for the second data pair in the set SD ((Firewall B, Untrust, Vrf01, 2), (Firewall C, Trust, Vrf01, 1)), the source firewall node information SP2 = {(Firewall B: Untrust: Untrust: 2)} and the destination firewall node information DP2 = {(Firewall C: Untrust: Trust: 1)} can be determined accordingly.

[0116] Step S508: Calculate the first union of the information of each source firewall node, and sort the source firewall node information in the first union in ascending order according to the first protection distance corresponding to each source firewall node information.

[0117] In this step, the union of the source firewall node information corresponding to each data pair is taken to obtain the set SP = SP1∪SP2 = {(Firewall A:Trust:Trust:1),(Firewall B:Untrust:Untrust:2)}. The result after sorting in ascending order according to the first protection distance is {(Firewall A:Trust:Trust:1),(Firewall B:Untrust:Untrust:2)}. It can be understood that if the address set information in the first union is only one, the step of sorting in ascending order according to the first protection distance can be omitted.

[0118] Step S509: Calculate the second union of the information of each destination firewall node, and sort the destination firewall nodes in the second union in descending order according to the second protection distance corresponding to each destination firewall node information.

[0119] In this step, the union of the destination firewall node information corresponding to each data pair is taken to obtain the set DP = DP1∪DP2 = {(firewall C:Untrust:Trust:1)}. Since the generated union DP only includes one set of address information, the step of sorting in descending order according to the second protection distance can be omitted.

[0120] It is also understandable that the execution order of steps S508 and S509 is not important.

[0121] Step S510: Delete the first protection distance and the second protection distance from the sorted first union and second union, calculate the union of the first union and the second union based on the deletion result, and use the calculation result as the firewall path.

[0122] In this step, the value of the first protection distance in each address set information in the SP set is deleted, resulting in the processed SP' = {(Firewall A:Trust:Trust),(Firewall B:Untrust:Untrust)}. The value of the second protection distance in each address set information in the DP set is deleted, resulting in the processed DP' = {(Firewall C:Untrust:Trust)}. Finally, the firewall path P = SP'∪DP' = {(Firewall A:Trust:Trust),(Firewall B:Untrust:Untrust),(Firewall C:Untrust:Trust)} is obtained.

[0123] Example 4

[0124] This fourth embodiment takes the example of the source address and destination address corresponding to the same address range, and, in conjunction with the pre-configured address set information shown in Table 1 and the pre-configured topology information shown in Table 2 provided in the previous embodiments, illustrates the firewall path determination method provided by this embodiment. Figure 6 As shown, the method may include the following steps:

[0125] Step S601: Obtain an access request, which includes the source address 10.10.1.1 and the destination address 10.10.2.1.

[0126] Step S602: Determine address set A and address set C from the pre-configured address set information to be in the first address set set corresponding to the access source address, and determine address set A and address set C from the second address set set corresponding to the destination access address.

[0127] Each address set includes an address range and configuration elements, including firewall identifier, security domain information, switch VPN instance information, and protection distance information.

[0128] In this step, the pre-configured address set information shown in Table 1 can be traversed, and the access source address 10.10.1.1 can be matched with the address ranges in each address set in Table 1. If the access source address belongs to a certain address range, then the address set corresponding to that address range is the address set information in the first address set S' corresponding to the access source address. In this example, the access source address 10.10.1.1 is in both address set A and address set C. Therefore, the obtained first address set S' is the union of address set A and address set C, that is, S' = {(Firewall A, Trust, Vrf01, 1), (Firewall B, Untrust, Vrf01, 2)}. Similarly, by traversing the pre-configured address set information shown in Table 1, we can obtain the address set information in the second address set D' corresponding to the access destination address 10.10.2.1, which is address set A and address set C. That is, the second address set D' = {(firewall A, Trust, Vrf01, 1), (firewall B, Untrust, Vrf01, 2)}.

[0129] Step S603: Calculate the intersection of the first address set and the second address set.

[0130] In this example, the intersection of the first set of addresses S' and the second set of addresses D' is X = S'∩D' = {(firewall A, Trust, Vrf01, 1), (firewall B, Untrust, Vrf01, 2)}.

[0131] Step S604: Based on the configuration elements of the address set, take the first difference between the first address set and the intersection of the first address set as the source address set, and take the second difference between the second address set and the intersection of the second address set as the destination address set.

[0132] Step S605: Determine that the source address set and the destination address set are empty, and no firewall path needs to be configured.

[0133] Here, the source address set and the destination address set are empty, indicating that the first address set S' and the second address set D' contain completely identical address set information. They are equivalent, meaning that the firewall identifier, firewall security domain, and switch VPN instance corresponding to the access source address and the access destination address are completely identical. Therefore, it can be concluded that the request packet from the access source address to the access destination address does not need to pass through any firewall node and does not require configuration.

[0134] The firewall path determination method provided in the above embodiments achieves automatic firewall path analysis, improves path analysis efficiency, and reduces the probability of configuration errors and omissions due to human error. Furthermore, the firewall path determination process can be independent of the network physical and logical topology of the data center, offering high flexibility. The determined firewall path does not need to be adapted to specific services, reducing the resources consumed during debugging. Moreover, the firewall path determination process can be based on pre-configured address set information and topology information, eliminating the need for real-time collection of all network-wide information. Since address set information and topology information have simpler data structures and smaller data volumes compared to network-wide information, this not only saves resources but also improves firewall path analysis efficiency, enabling the rapid and accurate display of firewall and security domain information required for service activation and reducing security risks.

[0135] Based on the above-described firewall path determination method, this invention also provides a firewall path determination device 700, such as... Figure 7 As shown, the device mainly includes: a request acquisition module 701, an address set determination module 702, and a path determination module 703; wherein,

[0136] The request acquisition module 701 is configured to acquire an access request, which includes the access source address and the access destination address.

[0137] The address set determination module 702 is configured to determine one or more address set information corresponding to the access source address from a pre-configured plurality of address set information to form a first address set set, and to determine one or more address set information corresponding to the access destination address to form a second address set set; each address set information includes an address range and configuration elements; based on the configuration elements, a source address set set different from the second address set set is determined from the first address set set, and a destination address set set different from the first address set set is determined from the second address set set.

[0138] The path determination module 703 is configured to determine the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set.

[0139] In one embodiment of the present invention, the configuration elements include: firewall identifier and security domain information. The path determination module 703 is configured to determine one or more source firewall identifiers in the source address set based on the configuration elements corresponding to one or more address set information in the source address set, and to determine one or more destination firewall identifiers in the destination address set based on the configuration elements corresponding to one or more address set information in the destination address set. If one or more source firewall identifiers are not completely identical to one or more destination firewall identifiers, target topology information corresponding to the source firewall identifiers and destination firewall identifiers is obtained from pre-configured topology information. The pre-configured topology information indicates the mapping relationship between multiple firewall identifiers and the security domain information corresponding to each firewall identifier. The firewall path is determined based on the target topology information. The firewall path includes: source firewall identifier, source firewall source security domain, source firewall destination security domain, destination firewall identifier, destination firewall source security domain, and destination firewall destination security domain.

[0140] In one embodiment of the present invention, the path determination module 703 is configured to calculate the Cartesian product of the address set information in the source address set and the address set information in the destination address set to obtain one or more data pairs; obtain the target topology information corresponding to each data pair according to the source firewall identifier and the destination firewall identifier in the data pair; determine the firewall node information corresponding to each data pair according to the target topology information corresponding to each data pair; and determine the firewall path corresponding to the access request according to the union of the firewall node information.

[0141] In one embodiment of the present invention, the path determination module 703 is configured to use the security domain information of the source firewall identifier in the data pair as the source firewall source security domain information, and determine the security domain information corresponding to the source firewall identifier from the target topology information, and use the determined security domain information as the source firewall destination security domain information; use the security domain information of the destination firewall identifier in the data pair as the destination firewall destination security domain information, and determine the security domain information corresponding to the destination firewall identifier from the target topology information, and use the determined security domain information as the destination firewall source security domain information.

[0142] In one embodiment of the present invention, the path determination module 703 is configured to determine that the source firewall identifier and the destination firewall identifier in a data pair are different before obtaining the target topology information based on the source firewall identifier and the destination firewall identifier in each data pair when there are multiple data pairs.

[0143] In one embodiment of the present invention, the path determination module 703 is configured to determine the source firewall node information corresponding to the source firewall identifier in the data pair and the destination firewall node information corresponding to the destination firewall identifier in the data pair, respectively; the source firewall node information includes: source firewall identifier, source firewall source security domain information, and source firewall destination security domain information; the destination firewall node information includes: destination firewall identifier, destination firewall source security domain information, and destination firewall destination security domain information.

[0144] In one embodiment of the present invention, the configuration elements further include: protection distance information; the source firewall node information further includes a first protection distance corresponding to the source firewall identifier, and the destination firewall node information further includes a second protection distance corresponding to the destination firewall identifier; the path determination module 703 is configured to calculate a first union of the source firewall node information, and sort the source firewall node information in the first union in ascending order according to the first protection distance; calculate a second union of the destination firewall node information, and sort the destination firewall node information in the second union in descending order according to the second protection distance; and obtain the firewall path based on the sorting result.

[0145] In one embodiment of the present invention, the path determination module 703 is configured to delete the first protection distance and the second protection distance in the sorted first union and the second union respectively; based on the deletion result, calculate the union of the first union and the second union, and use the calculated union as the firewall path.

[0146] In one embodiment of the present invention, the path determination module 703 is configured to, when the source firewall identifier in the source address set is the same as the destination firewall identifier in the destination address set, use the source firewall identifier or the destination firewall identifier as the firewall identifier in the firewall path, use the security domain information in the source address set as the firewall source security domain information in the firewall path, and use the security domain information in the destination address set as the firewall destination security domain information in the firewall path, so as to form a firewall path.

[0147] In one embodiment of the present invention, the configuration elements include: firewall identifier and security domain information, switch VPN instance information and protection distance information; the address set determination module 702 is configured to calculate the intersection of the first address set and the second address set according to the configuration elements, and calculate the first difference between the first address set and the intersection, and the second difference between the second address set and the intersection; the first difference is used as the source address set, and the second difference is used as the destination address set.

[0148] The firewall path determination device provided in the above embodiments enables automatic analysis of firewall paths, improving path analysis efficiency and reducing the probability of configuration errors and omissions due to human error. Furthermore, the firewall path determination process can operate independently of the data center's network physical and logical topology, offering high flexibility. The determined firewall path does not need to be adapted to specific services, reducing resource consumption during debugging. Moreover, the firewall path determination process can be based on pre-configured address set information and topology information, eliminating the need for real-time collection of all network-wide information. Since address set information and topology information have simpler data structures and smaller data volumes compared to network-wide information, this not only saves resources but also improves firewall path analysis efficiency, enabling the rapid and accurate display of firewall and security domain information required for service activation and reducing security risks.

[0149] Figure 8 An exemplary system architecture 800 is shown that can be applied to the firewall path determination method or firewall path determination apparatus of the present invention.

[0150] like Figure 8 As shown, the system architecture 800 may include terminals 801, 802, and 803, a network 804, and a server 805. Network 804 serves as the medium for providing communication links between terminals 801, 802, and 803, server 805, and blockchain 601. Network 804 may include various connection types, such as wired or wireless communication links, or fiber optic cables. Terminals 801, 802, and 803 can initiate access requests to server 805 through network 804. Upon receiving an access request, server 805 can analyze pre-configured address set information and topology information to obtain the firewall path corresponding to the access request and configure the firewall nodes accordingly.

[0151] It should be understood that Figure 8 The number of terminals, networks, and servers shown are merely illustrative. Depending on implementation needs, there can be any number of terminals, networks, and servers.

[0152] The following is for reference. Figure 9 It shows a schematic diagram of the structure of a computer system 900 suitable for implementing a terminal device of the present invention. Figure 9 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0153] like Figure 9As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of the system 900. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0154] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 910 as needed so that computer programs read from it can be installed into storage section 908 as needed.

[0155] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by central processing unit (CPU) 901, it performs the functions defined above in the system of this invention.

[0156] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0157] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0158] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described system can also be located in a processor; for example, it can be described as: a processor including a request acquisition module, an address set determination module, and a path determination module. The names of these modules do not necessarily limit the system itself; for example, the request acquisition module can also be described as a "module for acquiring access requests".

[0159] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include: acquiring an access request, the access request including an access source address and an access destination address; determining one or more address set information corresponding to the access source address from a pre-configured plurality of address set information to form a first address set set; and determining one or more address set information corresponding to the access destination address to form a second address set set; each address set includes an address range and configuration elements; determining a source address set set different from the second address set set from the first address set set according to the configuration elements, and determining a destination address set set different from the first address set set from the second address set set; and determining a firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set set and the address set information in the destination address set set, respectively.

[0160] According to the technical solution of this embodiment of the invention, after obtaining an access request, a first set of address sets corresponding to the source address in the access request and a second set of address sets corresponding to the destination address in the access request are determined. Then, based on the configuration elements included in the address set information in the first and second set of address sets, a source set of address sets different from the second set of address sets is determined from the first set of address sets, and a destination set of address sets different from the first set of address sets is determined from the second set of address sets. Furthermore, based on the configuration elements corresponding to the address set information in the source and destination set of address sets, the firewall path corresponding to the access request is determined. This achieves automatic firewall path analysis, improves path analysis efficiency, and reduces the probability of configuration errors and omissions due to human error.

[0161] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A firewall path determination method, characterized in that, include: Obtain an access request, which includes an access source address and an access destination address; From a plurality of pre-configured address sets, one or more address sets corresponding to the access source address are determined to form a first address set; and from a plurality of address sets corresponding to the access destination address are determined to form a second address set. Each of the address set information includes an address range and configuration elements; Based on the configuration elements, a source address set set that is different from the second address set set is determined from the first address set set, and a destination address set set that is different from the first address set set is determined from the second address set set; The firewall path corresponding to the access request is determined based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set.

2. The method according to claim 1, characterized in that, The configuration elements include: firewall identifier and security domain information; The step of determining the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set includes: Based on the configuration elements corresponding to one or more address sets in the source address set, determine one or more source firewall identifiers in the source address set; and based on the configuration elements corresponding to one or more address sets in the destination address set, determine one or more destination firewall identifiers in the destination address set. If one or more source firewall identifiers are not completely identical to one or more destination firewall identifiers, the target topology information corresponding to the source firewall identifier and the destination firewall identifier is obtained from the pre-configured topology information; the pre-configured topology information indicates the mapping relationship between multiple firewall identifiers and the security domain information corresponding to each firewall identifier. The firewall path is determined based on the target topology information. The firewall path includes: source firewall identifier, source firewall source security domain, source firewall destination security domain, destination firewall identifier, destination firewall source security domain, and destination firewall destination security domain.

3. The method according to claim 2, characterized in that, Determining the firewall path based on the target topology information includes: Calculate the Cartesian product of the address set information in the source address set and the address set information in the destination address set to obtain one or more data pairs; Based on the source firewall identifier and the destination firewall identifier in each data pair, obtain the target topology information corresponding to each data pair; The firewall node information corresponding to each data pair is determined based on the target topology information corresponding to each data pair. The firewall path corresponding to the access request is determined based on the union of the information of each firewall node.

4. The method according to claim 3, characterized in that, The step of determining the firewall path corresponding to each data pair based on the target topology information corresponding to each data pair includes: The security domain information of the source firewall identifier in the data pair is used as the source security domain information of the source firewall, and the security domain information corresponding to the source firewall identifier is determined from the target topology information. The determined security domain information is used as the target security domain information of the source firewall. The security domain information of the destination firewall identifier in the data pair is taken as the destination firewall's destination security domain information, and the security domain information corresponding to the destination firewall identifier is determined from the target topology information. The determined security domain information is taken as the destination firewall's source security domain information.

5. The method according to claim 3, characterized in that, In the presence of multiple data pairs, before obtaining the target topology information based on the source firewall identifier and destination firewall identifier in each data pair, the method further includes: It was determined that the source firewall identifier and the destination firewall identifier in the data pair were different.

6. The method according to claim 4, characterized in that, The step of determining the firewall node information corresponding to each data pair based on the target topology information corresponding to each data pair includes: The source firewall node information corresponding to the source firewall identifier in the data pair and the destination firewall node information corresponding to the destination firewall identifier in the data pair are determined respectively. The source firewall node information includes: source firewall identifier, source firewall source security domain information, and source firewall destination security domain information. The destination firewall node information includes: destination firewall identifier, destination firewall source security domain information, and destination firewall destination security domain information.

7. The method according to claim 6, characterized in that, The configuration elements also include: protection distance information; the source firewall node information also includes a first protection distance corresponding to the source firewall identifier, and the destination firewall node information also includes a second protection distance corresponding to the destination firewall identifier; Determining the firewall path corresponding to the access request based on the union of the information of each firewall node includes: Calculate the first union of the information of each source firewall node, and sort the information of the source firewall nodes in the first union in ascending order according to the first protection distance; Calculate the second union of the destination firewall node information for each of the aforementioned destination firewall nodes, and sort the destination firewall node information in the second union in descending order according to the second protection distance; The firewall path is obtained based on the sorting results.

8. The method according to claim 7, characterized in that, The firewall path is obtained based on the sorting results, including: Delete the first protection distance and the second protection distance from the sorted first union and second union respectively; Based on the deletion results, calculate the union of the first union and the second union, and use the calculated union as the firewall path.

9. The method according to any one of claims 2-8, characterized in that, The step of determining the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set, further includes: If the source firewall identifier in the source address set is the same as the destination firewall identifier in the destination address set, the source firewall identifier or the destination firewall identifier is used as the firewall identifier in the firewall path, the security domain information in the source address set is used as the firewall source security domain information in the firewall path, and the security domain information in the destination address set is used as the firewall destination security domain information in the firewall path to form the firewall path.

10. The method according to claim 1, characterized in that, The configuration elements include: firewall identifier and security domain information, switch VPN instance information and protection distance information; the step of determining a source address set different from the second address set from the first address set and a destination address set different from the first address set from the second address set according to the configuration elements includes: Based on the configuration elements, calculate the intersection of the first address set and the second address set, and calculate the first difference between the first address set and the intersection, and the second difference between the second address set and the intersection; The first difference set is used as the source address set, and the second difference set is used as the destination address set.

11. A firewall path determination device, characterized in that, include: The module includes a request acquisition module, an address set determination module, and a path determination module; among them, The request acquisition module is configured to acquire access requests, the access requests including the access source address and the access destination address; The address set determination module is configured to: determine one or more address set information corresponding to the access source address from a pre-configured plurality of address set information to form a first address set set; and determine one or more address set information corresponding to the access destination address to form a second address set set, wherein each address set information includes an address range and configuration elements; and, based on the configuration elements, determine a source address set set different from the second address set set from the first address set set, and determine a destination address set set different from the first address set set from the second address set set. The path determination module is configured to determine the firewall path corresponding to the access request based on the configuration elements corresponding to the address set information in the source address set and the address set information in the destination address set.

12. An electronic device for determining a firewall path, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the firewall path determination method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, wherein instructions in the computer-readable storage medium, when executed by a processor of a server processing data, enable the server processing data to perform the firewall path determination method as described in any one of claims 1 to 10.

Images