Network access control method and electronic equipment

Abstract

The invention discloses a network access control method and electronic equipment, and relates to the technical field of computers, network resources and access strategies thereof are visually presented in a graphical user interface in a node and connecting line mode, logic conflict judgment and strategy optimization recommendation are synchronously completed when a user drags and generates the strategies, and the network access control method and the electronic equipment have the advantages that the user experience is improved, and the user experience is improved. The abstract configuration process originally depending on a command line or a rule form is converted into a visual and interactive operation process, so that the degree of dependence of network access strategy configuration on professional experience is reduced, the probability of occurrence of artificial configuration errors is reduced, potential risks are controlled in the strategy generation stage, and the strategy generation efficiency is improved. And the overall efficiency and security of private cloud network access policy management are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a network access control method and electronic equipment. BACKGROUND

[0002] Network access policy is the key to guarantee the security and business isolation of cloud platform, and any configuration error may cause business interruption or security vulnerability. The existing private cloud platform mainly manages the policy through command line interface (CLI) or form-based graphical interface (GUI). The CLI method relies on the administrator to be familiar with the vendor command and complex syntax, and the manual operation is tedious and prone to errors; the form-based GUI simplifies the input process, but still focuses on isolated rules, lacks intuitive display of the overall network topology and traffic relationship, and is inefficient and difficult to maintain in a large-scale virtualization environment. The current common improvement scheme is the "security group" mechanism in the virtualization management platform, and the user can define inbound and outbound rules and associate virtual machines. Although this mechanism improves the abstraction level, it still has problems such as lack of visual display, lack of real-time risk feedback, weak conflict detection capability, and complex policy association, and the administrator cannot intuitively understand the access relationship and security boundary between different security groups. Therefore, the related technology still has problems such as complex operation, low efficiency, and insufficient risk identification capability when facing the dynamic nature and high security requirements of cloud environment. SUMMARY

[0003] The present application provides a network access control method and electronic equipment to at least solve the problem of lack of intuitive visualization, intelligent analysis and automation capability in the private cloud network access policy management method in the related technology, which visualizes abstract rules into network nodes and connection relationships through graphical interface, drag-and-drop operation, real-time feedback and conflict detection mechanism, realizes the visualization, intelligentization and high efficiency of policy management, and significantly reduces the configuration complexity and security risk.

[0004] The present application provides a network access control method, comprising: displaying network resources as graphical nodes and network access policies between the nodes as connection lines on a graphical user interface; the graphical user interface receives a target connection line dragged and dropped by a user between two target nodes, obtains attributes of the target connection line, and the attributes of the target connection line include a connected state or an interrupted state; determining whether to allow network access to create a target network access policy according to the attributes of the target connection line, and determining whether the target network access policy and other network access policies between the two target nodes have logical conflicts; in response to the logical conflicts, feeding back conflict information to the user by changing visual appearance attributes of the target connection line; In response to the absence of logical conflicts, a recommended policy is generated by a recommendation engine based on a preset policy template for optimizing the target network access policy for user selection.

[0005] The application also provides an electronic device, comprising a memory for storing a computer program, and a processor for executing the computer program to implement the steps of any of the network access control methods described above. On the graphical user interface, network resources are displayed as graphical nodes, and network access policies between the nodes are displayed as connection lines. The graphical user interface receives a target connection line dragged and dropped by a user between two target nodes, and obtains attributes of the target connection line, including a connected state or an interrupted state. According to the attributes of the target connection line, it is determined whether to allow network access to create a target network access policy, and whether the target network access policy has logical conflicts with other network access policies between the two target nodes. In response to the presence of logical conflicts, conflict information is fed back to the user by changing visual appearance attributes of the target connection line. In response to the absence of logical conflicts, a recommended policy is generated by a recommendation engine based on a preset policy template for optimizing the target network access policy for user selection.

[0006] According to the application, by intuitively presenting network resources and their access policies in the form of nodes and connection lines on a graphical user interface, and synchronously completing logical conflict determination and policy optimization recommendation when a user drags to generate a policy, an abstract configuration process originally relying on command lines or rule forms is converted into a visual and interactive operation process, thereby reducing the dependence of network access policy configuration on professional experience, reducing the probability of human configuration errors, and controlling potential risks during the policy generation stage, and improving the overall efficiency and security of private cloud network access policy management. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0008] Figure 1 An application environment diagram of the network access control method in an embodiment of the application; Figure 2 A flowchart of the network access control method in an embodiment of the application; Figure 3Figure 1 is a structural block diagram of a network access control device according to an embodiment of the present application; Figure 4 Figure 2 is an internal structural diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0009] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0010] It should be noted that in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0011] In order to make those skilled in the art better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0012] As the background art, the traditional network policy management mainly relies on the following two ways: command line interface (CLI) and form-based graphical user interface (GUI).

[0013] The first is command line interface (CLI). Network administrators need to log in to network devices or management servers and configure access control lists (ACLs), firewall rules, etc. by typing specific vendor's and complex syntax commands. This method requires administrators to have deep professional knowledge and rich practical experience, and must accurately remember a large number of commands and parameters. In the complex scenario of needing to configure hundreds of rules, completely relying on manual operation is not only inefficient, but also prone to errors. In addition, the pure text command is difficult to provide a global network policy view, and it is difficult for administrators to intuitively understand the association and potential conflicts between different policies.

[0014] The second is the form-based GUI. This is an improvement over the CLI approach, where the parameter input of the command line is converted into the form filling on the web page. The administrator defines a rule by entering the IP address in the text box, selecting the protocol and port in the drop-down menu. Although this approach reduces the requirement of command memory, it does not change the essence. The administrator is still dealing with isolated and abstract rules, lacking the macroscopic perception of the whole network topology and data flow. When facing a virtualization environment containing hundreds of dynamic IP addresses, the form-based management approach becomes extremely cumbersome and inefficient, and is also unable to effectively prevent logical conflicts between policies.

[0015] Among them, the network security group management function integrated in the virtualization management platform (such as VMware vCenter, OpenStack Horizon) allows users to create "security groups" and define a set of ingress (Ingress) and egress (Egress) rules for each security group. Users can add one or more virtual machines to a security group, thereby applying the corresponding network access policy.

[0016] Specifically, the operation process of this kind of technology is usually: the administrator creates a security group on the web interface, for example "Web-Servers-SG"; the administrator adds rules to the security group, for example, creates a rule by filling out the form: "allow ingress traffic with source 0.0.0.0 / 0, protocol TCP, port 443"; the administrator creates another rule: "allow egress traffic with target 'DB-Servers-SG', protocol TCP, port 3306"; finally, the administrator adds all the web server virtual machines to "Web-Servers-SG".

[0017] Although this kind of technology introduces the concept of "group", it is further than directly managing individual IP addresses, but it still has significant limitations, and these limitations are the core problems to be solved by the present application: First, lack of visualization and intuitiveness: the whole policy configuration process is still based on forms and lists, and the administrator cannot see the traffic relationship between "Web-Servers-SG" and "DB-Servers-SG" in a unified view, nor can he see the access path of the whole application. All policy logic needs to be constructed and imagined in the administrator's brain.

[0018] Second, no real-time feedback and risk warning: When an administrator adds a rule that may cause a security risk (such as opening public network access to a database) or business interruption, existing systems usually do not provide any real-time warning or impact analysis. All verification work depends on the personal experience of the administrator, and risks can only be discovered through testing or actual failure after the policy is deployed.

[0019] Third, weak conflict detection capability: Existing technologies usually do not have or only have very basic policy conflict detection capabilities. An administrator may inadvertently create an "allow" rule and a "deny" rule that act on the same traffic, and the system cannot prompt such conflicts, and the actual effect of the final policy will depend on the default priority processing of the platform, which may not match the administrator's expectations.

[0020] Fourth, high management complexity: In a large application, a virtual machine may belong to multiple security groups, and a security group may contain dozens of rules. To clarify the final access rights of a virtual machine, it is necessary to manually check all the rules of all related security groups, which is a very complex and error-prone process.

[0021] Therefore, although the related technology provides certain policy management capabilities, it has obvious deficiencies in operation intuitiveness, efficiency, security and intelligence when faced with the dynamics, complexity and high security requirements of modern cloud environments.

[0022] The network access control method provided in the present application can be applied to an application environment as shown in Figure 1 The network access control method provided in the present application can be applied to an application environment as shown in

[0023] The graphical user interface layer includes a navigation and resource area, a policy design canvas, an attribute configuration area, a tool operation bar, and a real-time preview window. The navigation and resource area is used for tree-shaped resource display, virtual machine / container / subnet management, and label classification management. The policy design canvas is used for node dragging operation, connection line drawing, and real-time visual feedback. The attribute configuration area is used for IP address / port configuration, protocol type selection, and access time setting. The tool operation bar is used for saving / verification / deployment, version management, and global operation control. The real-time preview window is used for network topology display, traffic path simulation, and impact analysis.

[0024] The front-end core function layer includes intelligent policy recommendation, conflict detection and repair, real-time feedback mechanism, and multi-condition filter. The intelligent policy recommendation is used for tag-based recommendation engine, historical data machine learning, and setting up a best practice template library. The conflict detection and repair is used for real-time conflict analysis, policy coverage detection, and one-key intelligent repair. The real-time feedback mechanism is used for operation immediate verification, security risk warning, and impact prediction display. The multi-condition filter is used for IP address range filtering, port protocol configuration, and time window control.

[0025] The front-end architecture layer includes componentized design, single-page application (SPA), responsive design, data two-way binding, and accessibility support. The componentized design is used for independent reusable components, highly decoupled architecture, and modular development and testing. The single-page application (SPA) is used for virtual DOM technology, non-refresh page update, and smooth user experience. The responsive design is used for multi-device adaptation, adaptive layout, and cross-browser compatibility. The data two-way binding is used for real-time synchronization of state, automatic update of UI, and data model mapping. The accessibility support is used for keyboard navigation, ARIA attributes, and screen reader compatibility.

[0026] The data interaction layer includes interface communication, WebSocket real-time communication, and identity authentication and authorization. The interface communication is used for encrypted transmission, data format management, and standardized interface design. The WebSocket real-time communication is used for bidirectional persistent connection, event message push, and multi-person collaboration synchronization. The identity authentication and authorization is used for encryption protocol management, encryption protection, and interface permission verification.

[0027] The policy management layer includes version control system, policy control panel, label management system, and audit log system. The version control system is used for automatic version snapshot, version comparison (Diff), and one-key rollback mechanism. The policy control panel is used for list management view, advanced search filtering, and batch operation support. The label management system is used for key-value pair label system, dynamic resource grouping, and identity-based policy management. The audit log system is used for operation record tracking, change history query, and compliance report.

[0028] The user permission layer includes role management (RBAC), user authentication system, permission verification engine, and approval workflow. The role management is used for preset role template, custom role configuration, and fine-grained permission control. The backend service layer is used for multi-factor authentication, single sign-on, and session management. The permission verification engine is used for API level verification, resource access control, and operation right review. The approval workflow is used for policy change approval, multi-level audit mechanism, and notification reminder system.

[0029] The backend service layer includes a policy verification service, a policy generation engine, a data persistence service, a recommendation algorithm engine, and a notification push service. The policy verification service is used for syntax format verification, logical reasonableness checking, and security rule review. The policy generation engine is used for platform adaptation conversion, configuration file generation, and API call encapsulation. The data persistence service is used for policy data storage, version history management, and cache optimization mechanism. The recommendation algorithm engine is used for rule engine, machine learning model, and pattern recognition analysis. The notification push service is used for real-time event broadcasting, collaborative update synchronization, and alarm message distribution.

[0030] The platform adaptation layer includes a virtualization platform adapter, a network device adapter, and a cloud management platform integration. The virtualization platform adapter is used for virtualization deployment, container platform integration, and virtual switch configuration. The network device adapter is used for firewall rule conversion, ACL configuration generation, and network firewall rule set. The cloud management platform integration is used for open source cloud computing management platform, private cloud API docking, and plugin extension mechanism.

[0031] The network access policy management system based on graphical user interface (GUI) aims to significantly reduce the complexity and dependence on professional skills of network policy management, improve configuration efficiency and accuracy, and enhance the overall security and maintainability of the network environment by visualizing abstract network access rules into graphical nodes and connections, and combining mechanisms such as drag-and-drop operation, real-time feedback, intelligent recommendation, and automated conflict detection.

[0032] This application aims to transform the complex network policy configuration process from traditional text commands or tedious form filling into a visual and interactive experience, so that users without deep network technology background can easily and accurately manage it.

[0033] Graphical user interface (GUI) is "What You See Is What You Get" (WYSIWYG). The graphical elements that users see on the interface, such as nodes representing virtual machine clusters, icons representing IP address segments, and connection lines representing traffic paths, all directly correspond to the underlying network policy logic. Users do not need to understand complex network protocols or configuration syntax, but can complete policy construction through intuitive drag-and-drop, connection, click, and other actions. For example, if a user wants to allow "Web Server Cluster" to access "Database Server Cluster" on a specific port, they only need to drag a connection line from the "Web Server" node and connect it to the "Database Server" node, and then specify the protocol and port number in the pop-up property configuration box.

[0034] To prevent misconfiguration, the system integrates a real-time feedback mechanism. This mechanism is a key innovation of the invention. When a user makes any operation on the graphical interface (such as adding a deny rule, modifying a port range), the system will immediately simulate the analysis on the front end and show the possible impact of the change in a visual way. For example, when a new policy may cause the network interruption of a key business application, the affected nodes and connection lines will be highlighted in red or with warning icons, accompanied by detailed explanation information, such as "This operation will interrupt the connection from virtual machine A to database B". This instant feedback mechanism enables users to foresee the consequences before the policy takes effect, thereby greatly reducing network failures caused by configuration errors.

[0035] In addition, the overall layout of the GUI adopts a modular design. The interface is divided into several logically clear areas: Navigation and resource area: usually located on the left side of the interface, showing all available network resources in tree or list form, such as virtual machines, containers, subnets, tags, etc. Users can drag resources from this area to the main canvas.

[0036] Policy design canvas: located in the center of the interface, it is the main work area for users to design policies. Users place resource nodes in this area and build traffic control relationships through connection lines.

[0037] Property and configuration area: usually located on the right side of the interface, when a user selects any node or connection line on the canvas, this area will dynamically display its detailed properties and provide configuration options, such as IP address, port, protocol, effective time, etc.

[0038] Tool and operation bar: located at the top or bottom of the interface, providing global operation buttons such as save, verify, deploy, version rollback, etc.

[0039] This clear layout and navigation design effectively guide users to complete policy configuration step by step, reducing the user's cognitive load. Even in the face of complex network environments containing hundreds of nodes, the operation can remain organized and efficient.

[0040] To support the highly dynamic and interactive GUI described above, the frontend architecture layer of the system ensures high performance, high maintainability, and high scalability. The core of the frontend architecture layer is componentization. We split the entire frontend application into a series of independent, reusable components. For example, a "policy node" is one component, a "connection line" is another component, and an "attribute configuration panel" is also a component. Each component encapsulates its own HTML structure, CSS style, and JavaScript logic. The benefit of this design is that the development team can develop and test each component independently without interference. When a certain function needs to be modified, only the corresponding component needs to be focused on, and it will not affect other parts of the system. This high degree of decoupling design makes the system very easy to maintain and upgrade.

[0041] The frontend architecture layer adopts a single-page application (SPA) architecture. Unlike traditional multi-page applications, SPA only loads HTML, CSS, and JavaScript resources once when loading. All subsequent page navigation and content updates are accomplished by dynamically modifying the current page content through JavaScript, without the need to request the entire page from the server again. The present invention utilizes mature, component-based frontend frameworks (such as frameworks that efficiently render interfaces through Virtual DOM technology) to implement SPA. This architecture brings an extremely smooth user experience, and the interface responds almost instantaneously when the user drags nodes on the canvas and modifies configurations, feeling like a local desktop application.

[0042] Intelligent policy recommendation is another core function of the system, which integrates artificial intelligence technology into network policy management. This function is implemented through a background recommendation engine, which can be a system based on expert rules or a model based on machine learning.

[0043] Rule engine: A series of industry best practices and security baselines are predefined. For example, when the system identifies that the user is configuring policies for a resource labeled "web server", the rule engine will automatically recommend opening TCP protocols 80 and 443 ports and suggest rejecting all other inbound connections.

[0044] Machine learning engine: By analyzing massive historical data, including user operation behavior, deployed policy configurations, network traffic logs, and resource metadata (such as labels), the system learns and discovers potential policy patterns. For example, the model may find that in an organization, all virtual machines labeled "backend service" usually need to access "message queue cluster" and "cache cluster". When a newly created virtual machine is labeled "backend service", the system will actively recommend this complete set of policy configurations to the user.

[0045] This function not only helps users quickly complete configuration, but also effectively reduces manual configuration errors caused by lack of experience by recommending verified and optimized strategies, thereby improving the overall quality and security of the strategy.

[0046] To achieve real-time synchronization between the front-end interface and the back-end data state, the system widely applies dynamic interactive design and data two-way binding mechanism. Any operation of the user (such as typing an IP address in the input box) will immediately update the data model inside the front-end. Changes in the data model will be automatically reflected to the UI through the data binding mechanism (for example, the node label on the canvas will be updated in real time). At the same time, the data model of the front-end will keep synchronized with the back-end server through asynchronous communication (such as RESTful API call or WebSocket message). This mechanism ensures that the user interface always shows the latest and most accurate state of the system, providing users with a clear and consistent operation experience.

[0047] The network policy configuration interface includes the following functional areas: Policy direction and type differentiation: clearly differentiate between ingress and egress policies, as well as policies for different dimensions such as specified IP segments, fixed IP segments, application spaces, and scope of action.

[0048] Structured form filling: replace traditional command line input with clear fields (such as IP address, port number) and drop-down selection boxes to reduce user memory burden and input error rate, such as the configuration examples in the figure "0.0.0.0 / 0 (all ports)".

[0049] Scope definition: supports precise definition of the scope of action of the policy through metadata such as labels (such as stimmt.io / citatservice_2.stimmt...), achieving decoupling of the policy and dynamic resources.

[0050] Node-based and composite policy node design: on the policy design canvas, each independent network entity or policy unit exists in the form of a "node".

[0051] Dynamic scrollable content area implementation technology: to clearly display nodes with a large number of attributes, the system customizes the G6 node type to implement an attribute display area with a scroll bar. The core is to calculate the visible area and scroll position through an algorithm, and only render the visible part to ensure that even if the number of policy entries is large, the front-end rendering performance remains smooth. Users can precisely control content scrolling through the mouse wheel, and this function is realized by customizing the G6 behavior.

[0052] Intelligent status indicator design: Dynamic status indicators are integrated on the nodes. The rule status of the node is dynamically determined by computing properties, and real-time visual feedback is provided on the node in graphical elements and colors, making the complex policy status clear at a glance.

[0053] Multi-condition filtering and intelligent edge connection: The creation process of the policy is completed by dragging "connection lines" between nodes.

[0054] Dynamic anchor positioning technology: The system customizes edge types to achieve precise positioning of connection lines and specific attribute items in nodes. The algorithm dynamically calculates the precise coordinates of the connection line based on the index position of the specific attribute item associated with the policy rule in the node and the current scroll position, ensuring that the connection line always points accurately to the associated specific attribute row.

[0055] Multi-type edge visualization differentiation: The system visually differentiates different policy types through a color coding system, and configures different colors and arrow styles for different types of connection lines, greatly improving the visual recognition efficiency of policy types.

[0056] Dynamic interface update and adaptive layout strategy: Dynamic spacing adjustment algorithm: The system uses a layout algorithm and implements differentiated spacing control based on node types to ensure the clarity and readability of the overall topology graph.

[0057] Responsive graphical reshaping technology: The interface has complete responsive design capabilities. When the browser window size changes, the system will automatically trigger the reset function to recalculate the layout and drawing, ensuring that the visualized graph can maintain the best display effect on any screen size.

[0058] Any modification by the user will immediately produce visual changes on the canvas. The system will also show the changes in traffic path through smooth graphical animations.

[0059] Component-based editing framework: The front-end interface adopts a complete component-based design, such as IP address block editor, Pod selector, etc., which are encapsulated as independent components, achieving high cohesion and low coupling of editing logic.

[0060] Optimization of visual interaction: Context-sensitive zoom control: Zoom operations are only allowed in the blank area of the canvas, improving the accuracy of the interactive experience.

[0061] Intelligent tool pop-up generation: When the user hovers over a graphical element, the system will dynamically generate different content pop-up boxes based on the graphical element type, providing flexible information display capabilities and window data interaction capabilities.

[0062] The present application deeply integrates a tag-based policy management mechanism. Users can tag one or more tags to any network resource (such as virtual machines, container instances, network interfaces, etc.) in the private cloud. The tag is a key-value pair (Key-ValuePair), for example, `environment:production`, `app:database`, `security-level:confidential`. This classification method is very flexible and can be organized according to business needs, functional roles, security levels, etc. In the policy design interface, users can create nodes representing tags (for example, a node representing all resources tagged with `app:database`). In this way, a policy rule pointing to this node will automatically apply to all resources matching this tag, regardless of how the IP address of these resources changes, and regardless of how many new resources will be tagged with this tag in the future.

[0063] The intelligent policy recommendation function of the system is closely integrated with the tag system. When the user drags one or more resource nodes (such as a newly created virtual machine) onto the canvas, the system will immediately analyze the tags of these resources and query the background recommendation engine. The recommendation engine will recommend the most suitable policy for these resources according to the preset policy template or the patterns learned from historical data. For example, if a virtual machine has both `environment:production` and `app:webserver` tags, the system may pop up a recommendation window: "Detected as a production environment web server, we recommend applying 'Standard Web Service Policy' (allow public TCP 80 / 443 port inbound, allow access to 'production database' cluster) and 'Production Environment Monitoring Policy'. Do you want to apply?" The user only needs to confirm with one click to complete the configuration of a series of complex policies.

[0064] This tag-based intelligent recommendation greatly simplifies the onboarding configuration process of new resources, ensures the consistency of policies, and reduces human errors.

[0065] At any stage of policy configuration, users can enable real-time preview function, which is a separate, interactive window or panel that simulates and demonstrates the effect of the current policy configuration in a real network environment.

[0066] Dynamic effect display: The preview window displays network traffic in a more macro or concrete way. For example, it can generate a simplified network topology diagram and simulate different types of network traffic with dynamic, colored particle streams. When the user drafts a new rule on the main canvas, a particle stream will appear or disappear accordingly in the preview window, with its color and flow rate representing the protocol type and bandwidth. If a rule blocks traffic, the corresponding path will become dark or show an interruption. This dynamic display makes the impact of the policy no longer an abstract description, but a visual effect.

[0067] Feedback mechanism: After each operation that may have an impact, the system automatically performs background verification and provides clear feedback through the preview window or pop-up window. Feedback includes but is not limited to: configuration conflict: clearly indicates which existing rule is logically conflicted with the current operation; redundant policy: prompts the user that the rule created is completely duplicated with an existing rule or is covered by a more general rule; security risk warning: when a high-risk configuration is detected (such as exposing a resource labeled as "core database" to the public network), the system will issue the highest level of warning and require the user to confirm twice; "impact" analysis: the system lists the specific virtual machines, services or business applications affected by the current policy change, allowing the user to accurately assess the impact range before deployment.

[0068] Conflict detection mechanism runs in real time when the user edits the policy. It can identify multiple types of conflicts, such as direct conflict, policy coverage, policy redundancy, and relevance conflict.

[0069] When a conflict is detected, the system will immediately give intuitive and explicit prompts through visual elements on the graphical interface, which is closely related to the advanced composite policy node design and intelligent edge connection algorithm of the system, forming an efficient technical closed loop.

[0070] Node state warning: The policy node involved in the conflict will trigger its intelligent state indicator immediately. For example, the state icon on the node may become a red warning sign or a locked icon, indicating that the node has a policy problem.

[0071] Connection line visual feedback: The specific connection line with conflict or high risk will dynamically switch its visual style to a red dashed line, flashing effect or highlighted thick line. This function benefits from the system's customized edge type and color coding system, which can change the visual properties of the connection line in real time, thus sending a strong visual warning to the user.

[0072] When the user clicks on the node or connection line with a warning mark, the system will pop up a detailed conflict analysis report, explaining the reasons for the conflict, the specific rules involved, and the potential consequences in natural language.

[0073] Further, the system provides a one-key or guided conflict resolution function. In the conflict analysis report, the system provides several possible solutions for the user to choose according to the conflict type. After the user selects a solution, the system automatically modifies the underlying policy data to resolve the conflict. This intelligent auxiliary repair function greatly reduces the difficulty of solving complex policy conflicts.

[0074] In order to ensure the smoothness of operation and the immediacy of data, the system uses real-time communication technology. The front end and the back end are connected through a persistent and bidirectional communication channel (such as WebSocket technology). When the user performs any editing operation on the GUI (such as dragging a node or modifying a port number), the operation will be serialized into a lightweight event message and immediately sent to the back end through the channel. After the back end is processed, the latest policy state or operation result will be broadcast back to all connected clients. This mechanism ensures: multi-person collaboration: if multiple administrators are simultaneously operating the policy, the modification of one person can be seen by others in real time, avoiding version overlap and conflict; immediate response: the feedback of user operation has almost no delay, and the experience is like a local application; immediate error reporting and feedback: the back end will perform strict verification when processing each rule update. The verification result will be returned to the front end immediately. The front end gives corresponding feedback according to the returned status code or message. For example: when successful, a green check mark icon is displayed next to the modified element for a short time. When failed, the modified element turns red and a tooltip pops up to explain the failure reason, such as "backend storage failed" or "violates the global security policy". When warning, a yellow exclamation mark is displayed next to the element, indicating a potential problem, such as "the rule may affect system performance". This real-time and fine-grained feedback loop ensures that the user has a clear understanding of the result of each operation.

[0075] The front end and the back end of the system mainly communicate through the application program interface (API) based on the Representational State Transfer (REST) architecture style of the HTTP protocol. All the policies designed by the user on the GUI will eventually be converted into a standardized and structured data format, such as JSON (JavaScript Object Notation) or YAML (YAML Ain't Markup Language). This format has good readability and machine friendliness, easy to process and transmit.

[0076] When a user saves or deploys a policy, the frontend sends this JSON or YAML data to the backend through a secure (HTTPS) API endpoint (e.g., `POST / api / policies`). The backend service receives the data, parses and validates it, and stores it persistently in the database. The system supports import and export of multiple data formats, for example, users can upload an existing YAML-formatted policy file for bulk creation, or export all policies on the current canvas into a JSON file for backup or migration. This design ensures that the system can be integrated well with other automation tools or third-party platforms (such as version control system Git).

[0077] Data security is of utmost importance. All API communications are encrypted using the Transport Layer Security (TLS) protocol to prevent eavesdropping or tampering during transmission. In addition, all API requests must undergo strict identity authentication and authorization checks. The system uses industry-standard authentication mechanisms such as OAuth 2.0 or JSON Web Tokens (JWT) to ensure that only authorized users or services can access and modify policy data.

[0078] Network policies are critical infrastructure configurations, and any inappropriate modifications can have serious consequences. Therefore, the invention has a powerful version control system built-in, similar to code version control in software development.

[0079] Whenever a user successfully saves a change to a policy configuration, the system automatically creates a new version snapshot. Each version has a unique identifier (such as version number or hash value) and records the complete policy content, change time, operator, and operator's change description (Commit Message). Users can view all historical versions of a policy set in a timeline format in a dedicated "Historical Versions" interface.

[0080] This interface provides rich functionality: Version viewing: Users can click on any historical version to load and preview the policy layout and content of that version on the canvas.

[0081] Version comparison (Diff): Users can compare any two versions. The system highlights the differences between the two versions, including which nodes or connections are added, deleted, or modified, and the changes in specific attributes. This is extremely useful for auditing and troubleshooting.

[0082] One-click rollback: If a current version of the policy is found to be problematic, the user can simply select a stable and reliable old version from the history version list, click the "Rollback" button, and the online policy will be restored to the state of that version.

[0083] To prevent misoperation, the system will provide a rollback warning before executing the rollback. This warning will analyze the possible impact of the rollback operation (for example, it may interrupt some business connections that are currently running), and require the user to make a final confirmation, ensuring that the rollback operation is carried out with full knowledge and safety.

[0084] In addition to the graphical design canvas, the system also provides a unified, list or table form, policy management control panel, also known as "Dashboard". This panel is the main entrance for administrators to conduct macro management and daily maintenance.

[0085] The control panel lists all policy sets or independent policy rules in the system in a clear table format. Each row represents a policy, and each column displays a key piece of information, such as policy name, associated tags, creation date, last modification time, current state (enabled / disabled), creator, etc. Users can sort any column by clicking on the table header.

[0086] The panel provides powerful search and filtering functions at the top. Users can: search for policy names or descriptions by keywords; filter by one or more tags, such as displaying all policies related to the `pci-dss` tag; filter by time range, such as viewing all policies modified in the past 24 hours.

[0087] In addition, the control panel supports batch operations. Users can select multiple policies through checkboxes and then perform unified operations such as batch enable, batch disable, batch delete, or add or remove a certain tag for all selected policies. These batch operation functions greatly improve the efficiency of managing hundreds of policies in a large-scale environment.

[0088] The front-end interface of the system uses responsive design. This means that the layout and elements of the interface will automatically adjust and optimize according to the screen size and orientation (landscape / portrait) of the user's device.

[0089] Desktop: On a wide desktop monitor, the system will use a multi-column layout to display the navigation area, main canvas, and property area simultaneously to maximize information density and operational efficiency.

[0090] Tablet: On a tablet computer, the property area may be hidden by default in the form of a side menu, leaving more canvas space for touch operations.

[0091] Mobile Devices: On smaller screen devices like smartphones, the graphical canvas can be simplified to a list-based strategy view that is more suitable for vertical scrolling. Users can tap on a list item to enter a dedicated editing page.

[0092] This design ensures a consistent and smooth user experience whether the user is in front of a large monitor in a data center or working on a laptop or tablet on the go. The system also guarantees compatibility across all major modern browsers (Chrome, Firefox, Safari, Edge). Additionally, the system offers switchable interface themes like Dark Mode to accommodate different lighting environments and user visual preferences.

[0093] To ensure accessibility for users with visual, auditory, or motor impairments, we have followed the internationally recognized Web Content Accessibility Guidelines (WCAG).

[0094] Keyboard Navigation: All interface elements, including nodes and connection lines on the canvas, are accessible and operable solely through the keyboard (e.g., `Tab` key, arrow keys, `Enter` key) without relying on a mouse.

[0095] Screen Reader Compatibility: The system uses ARIA (Accessible Rich Internet Applications) attributes to provide rich semantic information to screen reader software. When visually impaired users navigate the interface using a screen reader, the software accurately reads "This is a node representing a group of web servers, and the current status is normal" or "This is an allow rule from the database to the backup server," allowing them to understand the interface layout and perform operations.

[0096] Color and Contrast: The interface design takes into account colorblind and low-vision users, ensuring that all important information is not solely conveyed through color. The contrast between text and background also meets accessibility standards, ensuring content readability.

[0097] Additionally, the system has built-in internationalization (i18n) support, allowing easy switching between multiple languages such as Chinese and English to meet the needs of users in different regions around the world.

[0098] To ensure the security and compliance of enterprise-level applications, the system integrates a complete Role-Based Access Control (RBAC) mechanism. The system predefines multiple user roles and supports flexible customization by administrators. Common roles include: Administrator: has the highest privileges in the system, can manage users and roles, and perform Create, Read, Update, Delete (CRUD) operations on all network policies; Network Engineer: can perform complete CRUD operations on policies within the business scope or virtual network they are responsible for; Developer: may have only read-only permissions or can only create and modify policies in specific "development / test" environments, and their changes need to be approved by administrators before being released to production environments; Auditor: has read-only access to all policies and their historical versions for security auditing and compliance checks.

[0099] Permission control is enforced at the backend API level. Even if a user bypasses the interface restrictions on the front end through technical means, each API request on the backend will strictly verify the user's identity and permissions, ensuring that the user cannot perform any unauthorized operations, thereby ensuring the security of the entire system and the compliance of policy configuration.

[0100] The user interaction flow of the front-end interaction flow is as follows: User operation: The user drags a node on the GUI canvas or modifies a port number in the property panel.

[0101] Front-end event capture: The front-end JavaScript code captures this operation event (such as `onDragEnd` or `onChange`).

[0102] State update and data serialization: The front-end internal data model (State) is updated. For example, the position coordinates of a node are modified. This updated state is serialized into a JSON object.

[0103] API request sending: The front-end sends a RESTful API request (such as `PUT / api / policies / {id}`) to the back-end through HTTPS, and the request body contains the serialized JSON data.

[0104] Backend processing: The backend API receives the request, performs identity verification and permission checks. After that, the backend logic starts processing the data: verifying data format, performing conflict detection, and persisting policy changes to the database.

[0105] Target platform adaptation: The backend converts the abstract policy model into a specific configuration file or API call that the target private cloud platform can recognize (e.g., generating iptables rule sets, configuring virtual switch access control lists ACL, etc.) based on the specific type of the target platform (e.g., platforms based on different virtualization technologies).

[0106] Policy deployment: The backend deploys the generated configuration to the target cloud platform, making the policy effective.

[0107] Response return: The backend returns an HTTP response to the frontend, containing information about the success or failure of the operation.

[0108] Front-end interface update: The frontend receives the response. If successful, it displays a success prompt on the interface; if it fails, it reverts the previous interface changes and displays detailed error information. The entire process achieves the final consistency of front-end and back-end data.

[0109] From a data perspective, the entire data flow process is a closed loop: user graphical operation -> front-end component state change -> front-end application global data model update -> serialized to JSON / YAML data -> transmitted through encrypted API -> received and parsed by the backend service -> backend business logic processing (verification, conflict detection, storage) -> persistent to the database -> policy generation engine reads data -> generates platform-specific configuration -> deployed to the cloud platform -> the backend returns the processing result -> the frontend receives the result and updates the UI. This closed loop ensures that every valid operation by the user on the GUI is accurately translated into network control rules at the bottom layer of the cloud platform.

[0110] In a multi-user collaboration environment, when a user modifies a policy, other users who are viewing the policy need to be notified in a timely manner. This system achieves this through a backend push mechanism. When the backend successfully updates a policy, it sends a notification to all frontend clients that have subscribed to the policy update event through a message bus or directly through a WebSocket connection. Upon receiving the notification, the frontend immediately pops up a non-intrusive prompt box on the user interface, such as: "User 'Zhang San' has updated the 'Core Database Firewall' policy at 15:32, please refresh the page to get the latest version." This ensures that all collaborators can work based on the latest information, avoiding conflicts and misoperations caused by information delays.

[0111] The architecture design fully considers future scalability and maintainability, providing flexible deployment options and clear evolution paths. The entire system adheres to the principles of high cohesion and low coupling, adopting a thorough modular architecture.

[0112] Front-End Separation: The front-end is a standalone single-page application, and the back-end is a set of API services. They communicate only through standard RESTful APIs and WebSockets. This allows the front-end and back-end to be developed, tested, deployed, and upgraded independently by different teams.

[0113] Backend Microservices: The backend itself can also be split into multiple smaller, specialized services (microservices), such as user authentication services, policy storage services, conflict detection services, and policy generation services for different cloud platforms. For example, to support a new cloud platform, only a new policy generation microservice plugin needs to be developed without changing the core logic of the system.

[0114] This modular design ensures good backward compatibility and horizontal scalability, and can easily integrate with other IT management systems (such as CMDB, automation operation platform).

[0115] The system is designed as a sustainable evolution platform, and can be regularly updated, including: Feature enhancements: For example, adding support for new network protocols, or introducing more advanced machine learning recommendation algorithms.

[0116] Interface improvements: Continuously optimize the layout and interaction process of the GUI based on user feedback.

[0117] Performance optimization: Improve rendering speed and backend processing capacity in large-scale policy environments.

[0118] The update process will go through strict automated testing, integration testing, and regression verification to ensure the stability and security of the new version. Through the plugin mechanism, the system can easily extend support for different private cloud platforms (such as platforms based on KVM, VMware, and other virtualization technologies) or different network devices, ensuring compatibility in heterogeneous and multi-cloud environments.

[0119] The system provides flexible deployment solutions to meet the needs of users of different sizes.

[0120] Single-node deployment: For small or test environments, all front-end and back-end services can be packaged into a set of containers (using industry-leading containerization technology, for example) and quickly deployed on a physical server or virtual machine.

[0121] Distributed deployment: As the business grows, the system can seamlessly expand into a distributed cluster. Through a container orchestration platform (such as Kubernetes), each backend microservice can be deployed to multiple server nodes to achieve load balancing and high availability. The front-end application can be distributed through a content distribution network (CDN) to accelerate access for global users.

[0122] This deployment architecture supports deployment in complex cloud environments with multiple data centers and multiple geographic regions, providing a solid foundation for building a large-scale, high-reliability network policy management center.

[0123] In summary, the system of the present application fundamentally changes the management mode of network policies in a private cloud environment by providing a network access policy management system that integrates graphical design, real-time feedback, intelligent recommendation, conflict detection, and version control. It converts complex technical configurations into intuitive visual operations, significantly reducing the management threshold and operational risk, improving efficiency and accuracy, and providing a powerful, easy-to-use, and secure network policy management solution for modern cloud data centers.

[0124] Scenario Description: An IT administrator of a certain enterprise needs to deploy a new three-tier e-commerce application on a private cloud platform based on KVM virtualization technology. The application includes three service clusters: a web server cluster (providing HTTPS services externally), an application server cluster (handling business logic), and a database server cluster (storing data). The administrator needs to configure network access policies to ensure that: external users can only access the web server cluster through HTTPS (TCP / 443 port); only the web server cluster can access the business port (TCP / 8080) of the application server cluster; only the application server cluster can access the port (TCP / 3306) of the database server cluster; all servers allow ICMP access (for Ping testing) from the internal monitoring system (IP range: 10.0.10.0 / 24).

[0125] The specific implementation steps are as follows: Step 1: Resource Preparation and Labeling Before deploying the application, the administrator has created the required virtual machines on the private cloud platform. Then, the administrator uses the label management function of the cloud platform to label these virtual machines.

[0126] All web server virtual machines are labeled with `app:e-commerce`, `tier:web`.

[0127] All application server virtual machines are labeled with `app:e-commerce`, `tier:app`.

[0128] All database server virtual machines are labeled with `app:e-commerce`, `tier:database`.

[0129] Step 2: Start the system and create policies The administrator logs in to the network access policy management system provided by the present application. The system automatically synchronizes all resources and their tags on the cloud platform through API.

[0130] Enter the policy design canvas: The administrator clicks "New Policy Set" in the policy management control panel and names it "E-Commerce-Policy". The system then displays a blank graphical policy design canvas.

[0131] Add policy nodes: In the "Resource & Template Area" on the left, the administrator finds the "Tag" category. He drags and drops three tag nodes, `tier:web`, `tier:app`, and `tier:database`, to the center of the canvas.

[0132] The administrator then drags a "Public Network" (representing external Internet) node and an "IP Range" node from the Resource Area to the canvas. For the "IP Range" node, he sets its value to `10.0.10.0 / 24` in the property configuration area on the right and names it "Monitoring System".

[0133] Step 3: Define traffic rules through graphical operations The administrator starts to build access relationships between nodes by dragging and dropping connection lines.

[0134] Define public network access rules: The administrator holds down the left mouse button on the "Public Network" node and drags out a connection line, connecting it to the `tier:web` node. After releasing the mouse button, the system automatically pops up the property configuration box for this connection line. The administrator configures as follows: Protocol: Select TCP.

[0135] Target Port: Enter 443.

[0136] Action: Select Allow.

[0137] After clicking "OK", a green connection line representing the allowed public network access to the Web service is generated.

[0138] Define application layer access rules: The administrator drags a connection line from the `tier:web` node to the `tier:app` node in the same way, configuring it as "Allow TCP protocol, target port 8080". Then, he drags a connection line from the `tier:app` node to the `tier:database` node, configuring it as "Allow TCP protocol, target port 3306".

[0139] Real-time preview and conflict detection example: At this moment, an inexperienced junior administrator may make a mistake and try to connect the `tier:database` node directly from the "public network" node. After he drags out the connection line and configures it to "allow TCP 3306", the connection line is immediately rendered in bright red dashed line by the system. At the same time, the node `tier:database` also appears a flashing warning icon. The administrator hovers the mouse over the icon, and the system prompts: "Security risk warning: this rule exposes the core database directly to the public network, which seriously violates the security baseline. It is recommended to delete immediately." This immediate feedback prevents a serious security configuration error. The administrator immediately deletes the wrong connection line.

[0140] Define monitoring access rules: The administrator drags a connection line from the "monitoring system" node to the `tier:web`, `tier:app`, and `tier:database` nodes. For these three connection lines, he configures them to "allow ICMP protocol".

[0141] Step 4: Policy verification and deployment After completing the visual design of all policies, the canvas clearly shows the complete access topology of the entire e-commerce application.

[0142] One-click verification: The administrator clicks the "Verify" button on the toolbar. The system backend performs a comprehensive conflict and redundancy analysis on all policies on the current canvas. After a few seconds, the system returns the report: "Verification passed, no logical conflicts or redundant policies found." Deploy policies: The administrator clicks the "Deploy" button. The system pops up a confirmation window, with the "Impact Analysis" section listing the specific virtual machines that will be changed by this deployment. The administrator confirms that there is no error and clicks "Confirm Deployment".

[0143] Backend processing and taking effect: The system backend service receives the JSON data sent by the front end, which describes the entire policy graph.

[0144] The policy generation engine parses this JSON and converts it into specific instructions that the target private cloud platform (in this case, a KVM-based platform) can understand, such as generating a series of `iptables` rules or `nftables` rule sets.

[0145] The deployment module calls the management API of the cloud platform to send these rules to the firewall of the virtual switch or host associated with the corresponding virtual machine, so that the policy takes effect formally.

[0146] Step 5: Version control and audit After the deployment is successful, the system automatically creates a new version snapshot (e.g., v1.0) for the "E-Commerce-Policy" policy set, recording all the content of this deployment, the operator (the administrator), and the time. In the future, if the application needs to be changed, the administrator can modify it on the basis of this version and generate a new version. If there is a problem online, he can always roll back the policy to the stable state of v1.0 in the "Historical Versions" interface. Auditors can also check and compare the differences between different versions at any time to meet compliance requirements.

[0147] Through the above embodiments, the application changes a task that originally needs to write a large number of complex and error-prone command line scripts or repeatedly fill in tedious forms into an intuitive, efficient, and safe visual design process, greatly improving the quality and efficiency of network policy management.

[0148] As shown in Figure 2 The embodiment of the application provides a network access control method, including the following steps: Step S1, on a graphical user interface, network resources are displayed as graphical nodes, and network access policies between the nodes are displayed as connection lines; Step S2, the graphical user interface receives a target connection line dragged and dropped by a user between two target nodes, and obtains attributes of the target connection line, the attributes including a connected state or an interrupted state; Step S3, whether to allow network access is determined according to the attributes of the target connection line to create a target network access policy, and whether the target network access policy conflicts with other network access policies between the two target nodes is determined; Step S4, in response to the existence of a logical conflict, conflict information is fed back to the user by changing a visual appearance attribute of the target connection line; Step S5, in response to the nonexistence of a logical conflict, a recommended policy is generated by a recommendation engine based on a preset policy template to optimize the target network access policy, for the user to select.

[0149] In the method, the network resources and their access policies are intuitively presented in the graphical user interface in the form of nodes and connection lines, and logical conflict determination and policy optimization recommendation are simultaneously completed when the user drags to generate a policy, so that an abstract configuration process that depends on command lines or rule forms is converted into a visual and interactive operation process, thereby reducing the dependence of network access policy configuration on professional experience, reducing the probability of human configuration errors, and controlling potential risks in the policy generation stage, and improving the overall efficiency and security of private cloud network access policy management.

[0150] In the embodiment, on the graphical user interface, the network resources are displayed as graphical nodes, and the network access policies between the nodes are displayed as connection lines, including: The graphical user interface is divided into a navigation and resource area, a canvas, an attribute and configuration area, and a tool and operation bar; The network resources are classified, and key-value pair labels are set for the network resources according to the classification results of the network resources. Nodes representing the key-value pair labels are created in the navigation and resource area, and all available network resource nodes are displayed in a tree or list form; Connection lines representing network access policies between the nodes are created in the navigation and resource area. The properties of the connection lines are set as a connected state or an interrupted state, and a traffic control relationship is constructed through the connection lines; The key-value pair labels corresponding to the preset network resources are determined according to the types of the preset network resources, the target nodes corresponding to the key-value pair labels are determined in the canvas, and the target nodes are dragged onto the canvas; The target connection lines corresponding to the preset network access policies are determined according to the preset network access policies, the target connection lines are dragged onto the canvas, and the two ends of the target connection lines are connected to two target nodes; When a user selects any node or connection line on the canvas, attribute information is displayed in the attribute and configuration area, and configuration options are provided, including at least one of an IP address, a port, a protocol, and an effective time; The tool and operation bar provides operation buttons for saving, verifying, deploying, and version rollback, and the state of the nodes and connection lines in the canvas is controlled through the operation buttons.

[0151] In the embodiment, by dividing the graphical user interface into functional areas such as resource navigation, canvas, attribute configuration, and operation control, and based on resource labels, network resources are uniformly modeled and displayed, so that users can complete resource selection, policy construction, and parameter configuration in the same interface, thereby avoiding the operational complexity caused by frequent switching between multiple configuration pages. At the same time, the overall visibility of network topology and access relationship is enhanced through the canvas-based policy construction method, which is conducive to improving policy maintenance efficiency and understanding accuracy in large-scale cloud environments.

[0152] In the embodiment, whether the target network access policy and other network access policies between the two target nodes have logical conflicts is determined, including: The properties of the target connection lines corresponding to the target network access policy are identified, and the connected state or interrupted state of the target network access policy between the two target nodes is determined; Whether there are other network access policies between the two target nodes is determined; If there are no other network access policies, it is determined that there is no logical conflict between the network access policies between the two target nodes. If there are other network access policies, it is determined that there is a logical conflict between the network access policies of the two target nodes.

[0153] In the embodiment, the automatic identification of whether there are other network access policies between the target nodes in the policy generation stage is performed, and the policy logical consistency is determined based on the identification result, so that the system can discover potential conflict relationships before the user submits or deploys the policy, thereby avoiding the problem of uncertain access control behavior caused by the coexistence of multiple policies, and improving the predictability and stability of the execution result of the network access policy.

[0154] In the embodiment, the determination of the logical conflict between the network access policies of the two target nodes further includes: determining the connectivity state or interruption state expressed by the other network access policies between the two target nodes, and determining whether the connectivity state or interruption state expressed by the target network access policy and the other network access policies is the same; If not, the logical conflict of the connectivity state or interruption state between the nodes connected to the two target nodes is obtained. If there is no logical conflict of the connectivity state or interruption state, it is determined that there is a direct conflict between the network access policies of the two target nodes. If there is a logical conflict of the connectivity state or interruption state, it is determined that there is an association conflict between the network access policies of the two target nodes. If the same, it is determined whether the connectivity state or interruption state expressed by the target network access policy and the other network access policies is consistent. If the same, it is determined whether the limit rules of the target network access policy and the other network access policies are the same. If the limit rules are the same, the other network access policies between the two target nodes remain unchanged, and it is determined that there is a policy redundancy between the network access policies of the two target nodes. If the limit rules are different, the network access policy with the least limit rule is used as the final network access policy between the two target nodes, and it is determined that there is a policy coverage between the network access policies of the two target nodes.

[0155] In the embodiment, by distinguishing the differences of different network access policies in the connectivity state, the limit rules and the association relationship, and finely identifying the conflict types between the policies, the system can not only discover the existence of policy conflicts, but also accurately determine the nature and influence range of the conflicts, thereby providing clear basis for subsequent policy processing, optimization or merging, reducing the accumulation of invalid or repeated policies, and improving the clarity and maintainability of the network access control rule system.

[0156] In the embodiment, in response to the existence of a logical conflict, the conflict information is fed back to the user by changing the visual appearance attribute of the target connection line, including: The target network access policy with a logical conflict and other network access policies are respectively acquired for policy priority and setting time, and the type of the logical conflict is determined as direct conflict, policy coverage, policy redundancy, and relevance conflict. The target connection line corresponding to the target network access policy with a logical conflict is acquired, and the visual appearance attribute of the target connection line is changed to a red dashed line, a flashing effect, or a highlighted thick line. Corresponding to the target connection line, a conflict analysis report is generated according to the policy priority, the setting time, and the type of the logical conflict, and the content of the conflict analysis report includes the conflict reason, the involved limiting rules, and the potential consequences. When the target connection line is clicked, the content of the conflict analysis report is displayed through a preview window or a pop-up window.

[0157] In the embodiment, the abstract policy conflict result is converted into visual changes corresponding to the graphical connection line, and the explainable conflict analysis information is generated by combining the policy priority, the setting time, and the conflict type, so that the user can intuitively perceive the conflict position and its cause in the graphical interface, thereby avoiding the situation that it is difficult to locate the problem in time due to the dependence on text prompts only, improving the efficiency of policy adjustment and troubleshooting, and reducing the network configuration risk.

[0158] In the embodiment, the recommendation engine is set according to the preset policy template corresponding to the intelligent recommendation model. Historical network access policy data is collected, and an intelligent recommendation model is obtained by training according to the historical network access policy data, the intelligent recommendation model including a plurality of preset policy templates; The recommendation engine is set according to the preset policy template corresponding to the intelligent recommendation model. When the target network access policy is optimized, the network resources corresponding to the nodes associated with the target network access policy are identified, the recommendation engine is called by running the intelligent recommendation model, and the recommendation engine determines the preset policy template matched with the target network access policy according to the type of the network resources corresponding to the nodes associated with the target network access policy. The missing network access policy in the target network access policy is determined according to the preset policy template matched with the target network access policy, and the missing network access policy and the target network access policy are combined to form a recommended policy. In response to the existence of new network access policy data, the intelligent recommendation model and the recommendation engine are updated according to the new network access policy data.

[0159] The intelligent recommendation mechanism based on historical policy data and resource type characteristics is introduced, so that the system can automatically complete or optimize the missing access rules in the policy configuration process, reduce the dependence of users on complex network security experience, improve the configuration consistency and standardization while ensuring the rationality of the policy, make the network access policy more consistent with the actual business scenario and security requirements, and enhance the intelligent level of policy management.

[0160] In the embodiment, the method further comprises: In response to the generated recommended policy being selected, a corresponding connection line is set between the two target nodes according to the selected recommended policy, the real-time positions of the two target nodes are determined according to the attribute items associated with the selected recommended policy, and the starting point and ending point coordinates of the connection line are calculated; Each time the user successfully saves a change in policy configuration, a new version snapshot is created, the new version snapshot is added to the historical version list, each version snapshot has a unique identifier, and the policy content, change time, operator, and change description information are recorded.

[0161] The display position of the connection line in the canvas is automatically calculated after the policy is selected, so that the policy change can be immediately and accurately reflected in the visual interface, and by creating a traceable version snapshot for each policy configuration change, the policy evolution process has a complete record, so that the historical state can be quickly traced back when configuration errors or business abnormalities occur, and the reliability and recoverability of network access policy management are improved.

[0162] In the embodiment, the method further comprises: When any two version snapshots are selected for comparison, the difference content between the two version snapshots is highlighted, and the difference content includes added, deleted, or modified nodes or connection lines and attribute change content; If the current version snapshot is changed to the target historical version snapshot, the rollback operation is performed after the target historical version snapshot is selected from the historical version list.

[0163] The differences between nodes, connection lines, and attributes of different policy versions are intuitively displayed, so that the user can clearly understand the policy change content and its impact range, and the current policy can be quickly restored to a historical version when needed, thereby reducing the risk of business interruption caused by misoperation or incorrect configuration, and improving the security and stability of network access policy management in complex cloud environments.

[0164] In the embodiment, the method further comprises: In response to receiving a request for creating, reading, updating, or deleting a node or a connection line, identity authentication and permission checking are performed to verify the management level of the user sending the request; According to the management level of the user, matched create, read, update and delete operations are realized, response data is obtained, and the response data is parsed to determine operation success or operation failure; In response to operation success, a successful prompt message is displayed on the graphical user interface; In response to operation failure, the previous changes are reversed, and error information is displayed on the graphical user interface.

[0165] Among them, by introducing identity authentication and permission checking mechanism in the creation, modification and deletion process of network access policy, different management roles can only perform operations matching their permission levels, thereby avoiding security risks caused by unauthorized configuration, automatically reversing changes when operation fails, ensuring the consistency and reliability of policy state, and enhancing the security protection capability of private cloud network access control system.

[0166] In the embodiment, the method further comprises: When the instance of the network resource is migrated, scaled, reconstructed or upgraded, causing the network address of the network resource to change, the network access policy is determined based on the key-value pair label corresponding to the changed network resource; A policy dependency relationship is established between the network access policies, and the policy dependency relationship is used to represent that the effectiveness of the first network access policy depends on the effectiveness state of the second network access policy; When it is detected that the second network access policy has a creation, modification, deletion or invalidation operation, the first network access policy having a dependency relationship with the second network access policy is triggered to recheck; In the rechecking process, it is judged whether the first network access policy satisfies the preset connectivity state, interruption state and limitation rule after the network resource changes and the second network access policy changes; If not, it is determined that the first network access policy has a dependency conflict, and the dependency conflict information is fed back to the user by changing the visual appearance attribute of the connection line corresponding to the first network access policy; If yes, the validity state of the first network access policy is updated, and the first network access policy continues to take effect.

[0167] By adopting a network access policy definition method based on metadata tags and establishing a policy dependency relationship between network access policies, the scheme can automatically maintain the continuous effectiveness and consistency of network access policies when network resources in a cloud environment are dynamically changed, such as migration, scaling, or reconstruction. At the same time, when the dependent network access policy is changed or invalidated, the system can automatically trigger the re-verification of the associated policy, timely identify and feedback the dependency conflicts caused by resource changes or policy cascade changes, and avoid hidden access interruptions or security risks. Thus, the automatic adaptation, cascade consistency verification, and visual risk prompt of network access policies in a dynamic network environment are realized, the complexity of manual maintenance is reduced, and the reliability and security of network access control are improved.

[0168] In the network access control method, the network resources and their access policies are visually presented in a graphical user interface in the form of nodes and connecting lines, and logical conflict judgment and policy optimization recommendation are simultaneously completed when the user drags to generate the policy. The abstract configuration process originally relying on command lines or rule forms is transformed into a visual and interactive operation process, thereby reducing the dependence of network access policy configuration on professional experience, reducing the probability of human configuration errors, and controlling potential risks at the policy generation stage, and improving the overall efficiency and security of private cloud network access policy management.

[0169] From the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software and a general hardware platform as necessary, of course, it can also be implemented by hardware, but in many cases the former is a better implementation.

[0170] In one embodiment, as shown in Figure 3 A network access control apparatus 10 is provided, including a visual display module 1, a policy interaction acquisition module 2, a policy conflict judgment module 3, a conflict visual feedback module 4, a policy recommendation generation module 5, a policy deployment and version management module 6, a version comparison and rollback module 7, and a permission control module 8.

[0171] The visual display module 1 is used to display network resources as graphical nodes and network access policies between nodes as connecting lines on a graphical user interface.

[0172] The policy interaction acquisition module 2 is used to receive a target connecting line dragged and dropped by a user between two target nodes on the graphical user interface, and acquire attributes of the target connecting line, the attributes including a connected state or an interrupted state.

[0173] The policy conflict judgment module 3 is configured to determine whether to allow network access according to the attribute of the target connection line to create a target network access policy, and determine whether the target network access policy has a logical conflict with other network access policies between the two target nodes.

[0174] The conflict visualization feedback module 4 is configured to, in response to the existence of the logical conflict, feed back the conflict information to the user by changing the visual appearance attribute of the target connection line.

[0175] The policy recommendation generation module 5 is configured to, in response to the non-existence of the logical conflict, generate a recommended policy by optimizing the target network access policy based on a preset policy template through a recommendation engine, for the user to select.

[0176] In the embodiment, on the graphical user interface, the network resources are displayed as graphical nodes, and the network access policies between the nodes are displayed as connection lines, including: The graphical user interface is divided into a navigation and resource area, a canvas, an attribute and configuration area, and a tool and operation bar; The network resources are classified, the key-value pair tags are set to the network resources according to the classification results of the network resources, the nodes representing the key-value pair tags are created in the navigation and resource area, and all the nodes of the available network resources are displayed in a tree or list form; The connection lines representing the network access policies between the nodes are created in the navigation and resource area, the attributes of the connection lines are set as a connected state or an interrupted state, and the traffic control relationship is constructed through the connection lines; The key-value pair tags corresponding to the preset network resources are determined according to the types of the preset network resources, the target nodes corresponding to the key-value pair tags are determined in the canvas, and the target nodes are dragged onto the canvas; The target connection lines corresponding to the preset network access policies are determined according to the preset network access policies, the target connection lines are dragged onto the canvas, and the two ends of the target connection lines are connected to the two target nodes; When the user selects any node or connection line on the canvas, the attribute information is displayed in the attribute and configuration area, and the configuration options are provided, the configuration options including at least one of an IP address, a port, a protocol, and an effective time; The tool and operation bar provides operation buttons for saving, verifying, deploying, and version rollback, and the state of the nodes and the connection lines in the canvas is controlled through the operation buttons.

[0177] In the embodiment, the determination of whether the target network access policy has a logical conflict with other network access policies between the two target nodes includes: The attribute of the target connection line corresponding to the target network access policy is identified, and the connected state or the interrupted state of the target network access policy between the two target nodes is determined; determining whether there is another network access policy between the two target nodes; if there is no another network access policy, determining that there is no logical conflict of the network access policies between the two target nodes; if there is another network access policy, determining that there is a logical conflict of the network access policies between the two target nodes.

[0178] In the embodiment, the determining that there is a logical conflict of the network access policies between the two target nodes further includes: determining a connectivity state or an interruption state of the another network access policy between the two target nodes, and determining whether the connectivity state or the interruption state of the target network access policy is the same as that of the another network access policy; if not, obtaining a logical conflict of the connectivity state or the interruption state between the nodes connected to the two target nodes respectively; if there is no logical conflict of the connectivity state or the interruption state, determining that there is a direct conflict of the network access policies between the two target nodes; if there is a logical conflict of the connectivity state or the interruption state, determining that there is an association conflict of the network access policies between the two target nodes; if yes, determining whether the connectivity state or the interruption state of the target network access policy is consistent with that of the another network access policy; if consistent, determining whether the limit rules of the target network access policy and the another network access policy are the same; if the limit rules are the same, keeping the another network access policy between the two target nodes unchanged, and determining that there is a policy redundancy of the network access policies between the two target nodes; if the limit rules are different, adopting the network access policy with the least limit rules as the final network access policy between the two target nodes, and determining that there is a policy coverage of the network access policies between the two target nodes.

[0179] In the embodiment, in response to the existence of the logical conflict, the conflict information is fed back to the user by changing the visual appearance attribute of the target connection line, including: obtaining the policy priority and the setting time of the target network access policy and the another network access policy respectively, and determining the type of the logical conflict as a direct conflict, a policy coverage, a policy redundancy and an association conflict; obtaining the target connection line corresponding to the target network access policy with the logical conflict, and changing the visual appearance attribute of the target connection line to a red dashed line, a flashing effect or a highlighted thick line; corresponding to the target connection line, generating a conflict analysis report according to the policy priority, the setting time and the type of the logical conflict, and the content of the conflict analysis report including the conflict reason, the involved limit rules and the potential consequences; The content of the conflict analysis report is displayed through the preview window or the pop-up window when the target connection line is clicked.

[0180] In the embodiment, the recommendation engine generates a recommended strategy based on the preset strategy template for the target network access strategy optimization, including: Collect historical network access strategy data, and train an intelligent recommendation model based on the historical network access strategy data, wherein the intelligent recommendation model includes a plurality of preset strategy templates; The recommendation engine is set according to the preset strategy template corresponding to the intelligent recommendation model; When the target network access strategy optimization is performed, the network resources corresponding to the nodes associated with the target network access strategy are identified, the recommendation engine is invoked by running the intelligent recommendation model, and the recommendation engine determines the preset strategy template matched with the target network access strategy according to the type of the network resources corresponding to the nodes associated with the target network access strategy; The missing network access strategy in the target network access strategy is determined according to the preset strategy template matched with the target network access strategy, and the recommended strategy is formed by combining the missing network access strategy with the target network access strategy; In response to the existence of new network access strategy data, the intelligent recommendation model and the recommendation engine are updated according to the new network access strategy data.

[0181] In the embodiment, the strategy deployment and version management module 6 is configured to: In response to the generated recommended strategy being selected, the corresponding connection line is set between the two target nodes according to the selected recommended strategy, the real-time positions of the two target nodes are determined according to the attribute items associated with the selected recommended strategy, and the starting point and ending point coordinates of the connection line are calculated; Each time the user successfully saves a change of the strategy configuration, a new version snapshot is created, the new version snapshot is added to the historical version list, each version snapshot has a unique identifier, and the strategy content, change time, operator, and change description information are recorded.

[0182] In the embodiment, the version comparison and rollback module 7 is configured to: When any two version snapshots are selected for comparison, the difference content between the two version snapshots is highlighted, and the difference content includes the added, deleted, or modified nodes or connection lines and attribute change content; If the current version snapshot is changed to a target historical version snapshot, the rollback operation is performed after the target historical version snapshot is selected from the historical version list.

[0183] In the embodiment, the permission control module 8 is configured to: In response to receiving a request for creating, reading, updating, or deleting a node or a connection line, identity authentication and permission checking are performed to verify the management level of the user who sends the request; According to the management level of the user, a matched creating, reading, updating, or deleting operation is implemented, response data is obtained, and the response data is parsed to determine whether the operation is successful or failed; In response to the operation being successful, a successful prompt information is displayed on the graphical user interface; In response to the operation being failed, the previous changes are revoked, and error information is displayed on the graphical user interface.

[0184] In the network access control device, the network resources and the access strategy thereof are visually presented in the graphical user interface in the form of nodes and connection lines, and logical conflict judgment and strategy optimization recommendation are synchronously completed when the user drags to generate the strategy, so that the abstract configuration process originally relying on command lines or rule forms is converted into a visual and interactive operation process, thereby reducing the dependence of the network access strategy configuration on professional experience, reducing the probability of human configuration errors, and controlling potential risks in the strategy generation stage, and improving the overall efficiency and security of the private cloud network access strategy management.

[0185] The features of the embodiments of the network access control device can be referred to the related descriptions of the embodiments of the network access control method, which will not be repeated here.

[0186] Embodiments of the present application also provide an electronic device including a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above network access control method embodiments.

[0187] In one embodiment, the electronic device can be a server, and its internal structure diagram can be as shown in Figure 4 The electronic device includes a processor, a memory, a network interface, and a database connected through a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the electronic device is used to store network access control data. The network interface of the electronic device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a network access control method.

[0188] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, wherein the computer program is configured to execute the steps in any of the network access control method embodiments when running. The network resources are displayed as graphical nodes on the graphical user interface, and the network access policies between the nodes are displayed as connection lines. The graphical user interface receives a target connection line dragged and dropped between two target nodes by a user, and obtains attributes of the target connection line, the attributes including a connection state or an interruption state. The attributes of the target connection line are used to determine whether to allow network access to create a target network access policy, and whether the target network access policy has a logical conflict with other network access policies between the two target nodes. In response to the logical conflict, conflict information is fed back to the user by changing visual appearance attributes of the target connection line. In response to the absence of the logical conflict, a recommended policy is generated by optimizing the target network access policy based on a preset policy template through a recommendation engine, so as to be selected by the user.

[0189] In an example embodiment, the computer readable storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0190] The embodiment of the present application further provides a computer program product, and the computer program product includes a computer program, and the computer program is executed by a processor to implement the steps in any of the network access control method embodiments. The network resources are displayed as graphical nodes on the graphical user interface, and the network access policies between the nodes are displayed as connection lines. The graphical user interface receives a target connection line dragged and dropped between two target nodes by a user, and obtains attributes of the target connection line, the attributes including a connection state or an interruption state. The attributes of the target connection line are used to determine whether to allow network access to create a target network access policy, and whether the target network access policy has a logical conflict with other network access policies between the two target nodes. In response to the logical conflict, conflict information is fed back to the user by changing visual appearance attributes of the target connection line. In response to the absence of the logical conflict, a recommended policy is generated by optimizing the target network access policy based on a preset policy template through a recommendation engine, so as to be selected by the user.

[0191] The embodiment of the present application further provides another computer program product, comprising a non-volatile computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps in any of the network access control method embodiments described above: The network resource is displayed as a graphical node on the graphical user interface, and the network access policy between the nodes is displayed as a connection line; The graphical user interface receives a target connection line dragged and dropped by a user between two target nodes, and obtains the attribute of the target connection line, the attribute including a connection state or an interruption state; According to the attribute of the target connection line, it is determined whether the network access is allowed to create a target network access policy, and whether the target network access policy has a logical conflict with other network access policies between the two target nodes; In response to the logical conflict, the user is fed back the conflict information by changing the visual appearance attribute of the target connection line; In response to the absence of the logical conflict, a recommended policy is generated by a recommendation engine based on a preset policy template to optimize the target network access policy, for the user to select.

[0192] Those skilled in the art will further appreciate that the units and algorithm steps of the examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in general terms above as being performed in a particular manner. The implementation of the described functionality in hardware and software can depend on the particular application and design constraints imposed on the overall architecture. Those skilled in the art can implement the described functionality in varying ways for each particular application, but such implementation should not be considered to be beyond the scope of the present application.

[0193] The above-described embodiments only express several implementation manners of the present application, which are described in a specific and detailed manner, but should not be understood as limiting the scope of the present application. It should be pointed out that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A network access control method, characterized in that, include: On the graphical user interface, network resources are displayed as graphical nodes, and network access policies between the nodes are displayed as connecting lines; The graphical user interface receives the target connection line dragged and dropped by the user between two target nodes, and obtains the attributes of the target connection line, including the connected state or the interrupted state. Based on the attributes of the target connection line, determine whether network access is allowed to create a target network access policy, and determine whether the target network access policy has any logical conflict with other network access policies between the two target nodes; In response to the existence of a logical conflict, the conflict information is fed back to the user by changing the visual appearance attributes of the target connection line; In response to the absence of logical conflicts, a recommendation strategy is generated by optimizing the target network access strategy based on a preset strategy template through a recommendation engine, for users to choose from.

2. The network access control method according to claim 1, characterized in that, The method of displaying network resources as graphical nodes on a graphical user interface and displaying network access policies between the nodes as connecting lines includes: The graphical user interface is divided into a navigation and resource area, a canvas, a properties and configuration area, and a tools and action bar. The network resources are categorized, and key-value pair labels are set for the network resources according to the categorization results. Nodes representing the key-value pair labels are created in the navigation and resource area, and all available network resource nodes are displayed in a tree or list format. Within the navigation and resource area, create connection lines to represent network access policies between the nodes, set the attributes of the connection lines to connected or interrupted states, and construct flow control relationships through the connection lines. Determine the key-value pair label corresponding to the preset network resource based on the type of preset network resource, determine the target node corresponding to the key-value pair label in the canvas, and drag the target node onto the canvas. Determine the target connection line corresponding to the preset network access policy according to the preset network access policy, drag the target connection line onto the canvas, and set the two ends of the target connection line to two target nodes; When a user selects any node or connection line on the canvas, attribute information is displayed in the attribute and configuration area, and configuration options are provided. The configuration options include at least one of IP address, port, protocol and effective time. The tools and operation bar provide operation buttons for saving, verifying, deploying, and rolling back versions, and these operation buttons control the state of nodes and connecting lines within the canvas.

3. The network access control method according to claim 1, characterized in that, The step of determining whether the target network access policy conflicts logically with other network access policies between the two target nodes includes: Identify the attributes of the target connection line corresponding to the target network access policy, and determine the connectivity or interruption status of the target network access policy between the two target nodes. Determine if there are other network access policies between the two target nodes; If no other network access policies exist, it is determined that there is no logical conflict between the network access policies of the two target nodes. If other network access policies exist, it is determined that there is a logical conflict between the network access policies of the two target nodes.

4. The network access control method according to claim 3, characterized in that, The determination that there is a logical conflict in the network access policies between the two target nodes also includes: Determine the connectivity or interruption state of the other network access policies expressed between the two target nodes, and determine whether the connectivity or interruption state expressed by the target network access policy is the same as that expressed by the other network access policies. If they are different, then obtain the logical conflict of whether there is an associated connectivity state or interruption state between the nodes connected to the two target nodes respectively. If there is no logical conflict between the associated connected or interrupted states, it is determined that there is a direct conflict in the network access policies between the two target nodes. If there is a logical conflict between the connected or interrupted states, it is determined that there is a conflict in the network access policies between the two target nodes. If they are the same, then determine whether the target network access policy is consistent with the connectivity or interruption status expressed by the other network access policies; If they match, then determine whether the limiting rules of the target network access policy are the same as those of the other network access policies; If the limiting rules are the same, the other network access policies between the two target nodes remain unchanged, and it is determined that there is policy redundancy in the network access policies between the two target nodes. If the limiting rules are different, the network access strategy with the fewest limiting rules is adopted as the final network access strategy between the two target nodes, and it is determined that there is policy overlap between the network access strategies between the two target nodes.

5. The network access control method according to claim 3, characterized in that, The step of responding to a logical conflict by changing the visual appearance attributes of the target connecting line to provide feedback on the conflict to the user includes: For target network access policies with logical conflicts and other network access policies, obtain the policy priority and setting time respectively, and determine the type of logical conflict as direct conflict, policy overriding, policy redundancy and related conflict; Obtain the target connection line corresponding to the target network access policy that has a logical conflict, and change the visual appearance attribute of the target connection line to a red dashed line, a flashing effect, or a bright thick line. Corresponding to the target connection line, a conflict analysis report is generated based on the strategy priority, setting time, and type of logical conflict. The content of the conflict analysis report includes the cause of the conflict, the relevant limiting rules, and the potential consequences. When the target connection line is clicked, the contents of the conflict analysis report are displayed in a preview window or pop-up window.

6. The network access control method according to claim 1, characterized in that, The step of generating a recommendation strategy by optimizing the target network access strategy based on a preset strategy template using a recommendation engine includes: Collect historical network access strategy data, and train an intelligent recommendation model based on the historical network access strategy data. The intelligent recommendation model includes multiple preset strategy templates. The recommendation engine is set according to the intelligent recommendation model corresponding to the preset strategy template; When optimizing the target network access strategy, the network resources corresponding to the nodes associated with the target network access strategy are identified. The recommendation engine is invoked by running the intelligent recommendation model. The recommendation engine determines a preset strategy template that matches the target network access strategy based on the type of network resources corresponding to the nodes associated with the target network access strategy. Based on a preset policy template that matches the target network access policy, the missing network access policy in the target network access policy is determined, and the missing network access policy is combined with the target network access policy to form a recommended policy. In response to the existence of new network access policy data, the intelligent recommendation model and the recommendation engine are updated according to the new network access policy data.

7. The network access control method according to claim 1, characterized in that, The method further includes: In response to the selection of a generated recommendation strategy, a corresponding connection line is set between two target nodes according to the selected recommendation strategy. The real-time positions of the two target nodes are determined according to the attribute items associated with the selected recommendation strategy, and the coordinates of the start and end points of the connection line are calculated. Whenever a user successfully saves a policy configuration change, a new version snapshot is created and added to the historical version list. Each version snapshot has a unique identifier and records the policy content, change time, operator, and change description information.

8. The network access control method according to claim 7, characterized in that, The method further includes: When any two version snapshots are selected for comparison, the differences between the two version snapshots are highlighted. The differences include nodes or connections that have been added, deleted, or modified, as well as changes in attributes. If the current version snapshot is changed to the target historical version snapshot, the target historical version snapshot is selected from the historical version list and then a rollback operation is performed.

9. The network access control method according to claim 1, characterized in that, The method further includes: In response to receiving a request to create, read, update, or delete the node or the connection line, authentication and permission checks are performed to verify the management level of the user issuing the request; Based on the user's management level, perform corresponding create, read, update, and delete operations, obtain response data, and parse the response data to determine whether the operation was successful or failed. If the operation is successful, a success message is displayed on the graphical user interface. In response to an operation failure, previous changes are undone, and an error message is displayed on the graphical user interface.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network access control method as described in any one of claims 1 to 9 when executing the computer program.

Images