Firewall policy processing method and device, equipment, medium and program product

Abstract

The invention provides a firewall policy processing method and device, equipment, a storage medium and a program product, and is applied to the field of information security. The method comprises the steps that ni firewall policies of each target device in m target devices are acquired, and each firewall policy comprises a source internet protocol address, a source port number, a destination internet protocol address, a destination port number, a protocol type and a policy action; converting each firewall policy into binary symbol representation; according to ni binary symbol representation, same nodes are merged, a multi-terminal binary decision diagram of each target device is constructed, a source internet protocol address, a source port number, a target internet protocol address, a target port number and a protocol type are represented as intermediate nodes, and a strategy action is represented as a terminal node; performing aggregation operation on the multi-terminal binary decision diagrams of the m target devices, and merging the same nodes to obtain a global decision diagram; and exporting a firewall policy set table according to the global decision diagram.

Description

Technical Field

[0001] This application relates to the field of information security technology, and specifically to a method, apparatus, device, medium, and program product for processing firewall policies. Background Technology

[0002] Currently, enterprise network firewall policy management mainly falls into two categories: In small and medium-sized enterprise environments, firewall policies are typically stored as discrete rule sets in local configuration files on various devices, lacking a unified management platform. Administrators must maintain and synchronize policies on a device-by-device basis. In large enterprise environments, professional firewall policy management software is commonly used for centralized configuration management, but its underlying architecture is still based on a sequential dependency rule list storage model. The core implementation of this model involves splitting policies into ordered, independent rule entries. Each rule contains fields such as source address range, destination address range, port, and action, allowing overlapping or inclusion relationships between address ranges of different rules. However, this sequential dependency rule list storage model suffers from the following bottlenecks: complex address overlap relationships between rules are masked by discrete entries; the rule set expands dramatically after long-term manual rule additions; storage space resources are scarce; and the stored content is difficult to analyze and maintain. Therefore, how to globally manage firewall policies, save storage space, and facilitate analysis and maintenance has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0003] In view of the above problems, this application provides a method, apparatus, device, media and program product for processing firewall policies that can globally manage firewall policies, save storage space and facilitate analysis and maintenance.

[0004] According to the first aspect of this application, a method for processing firewall policies is provided, including obtaining n for each of m target devices. i Each firewall policy includes a source Internet Protocol address, a source port number, a destination Internet Protocol address, a destination port number, a protocol type, and a policy action, where m is an integer greater than or equal to 2, and n... i Let n be an integer greater than or equal to 1, and i be an integer greater than or equal to 1 and less than or equal to m; let n be the number of each target device. i Each firewall policy in the n firewall policies is converted into a binary symbol representation; according to the n iEach target device is represented by a binary symbol. Identical nodes are merged to construct a multi-terminal binary decision graph. The source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type represent intermediate nodes, and the policy action represents a terminal node. The multi-terminal binary decision graphs of the m target devices are aggregated, with identical nodes merged to obtain a global decision graph. A firewall policy set table is derived based on the global decision graph.

[0005] According to an embodiment of this application, the firewall policy processing method further includes: obtaining the firewall policy to be added for each of the m target devices; converting each firewall policy to be added into a binary symbol representation; constructing a first binary decision graph path for each firewall policy to be added based on the binary symbol representation; and matching the first binary decision graph path with the global decision graph to determine redundant paths and conflicting paths.

[0006] According to an embodiment of this application, the step of matching the first binary decision graph path with the global decision graph to determine redundant paths and conflicting paths includes: if there is a path in the global decision graph that completely matches the first binary decision graph path, determining that path in the global decision graph as a redundant path; if there is a path in the global decision graph that completely matches the intermediate nodes of the first binary decision graph path but has different terminal nodes, determining that path in the global decision graph as a conflicting path.

[0007] According to an embodiment of this application, the firewall policy processing method further includes: obtaining the firewall policy to be deleted for each of m target devices; converting each firewall policy to be deleted into a binary symbol representation; constructing a second binary decision graph path for each firewall policy to be deleted based on the binary symbol representation; and matching the second binary decision graph path with the global decision graph to determine the scope of influence of the firewall policy to be deleted.

[0008] According to an embodiment of this application, the firewall policy processing method further includes: obtaining a firewall policy to be verified; converting the firewall policy to be verified into a binary symbol representation; constructing a third binary decision graph path of the firewall policy to be verified based on the binary symbol representation; and matching the third binary decision graph path with the global decision graph to determine whether the firewall policy to be verified is configured.

[0009] According to an embodiment of this application, the firewall policy processing method further includes: obtaining traffic fault information, wherein the traffic fault information includes the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type of the faulty traffic; converting the traffic fault information into a binary symbol representation; constructing a fourth binary decision graph path for the traffic fault information based on the binary symbol representation; matching the fourth binary decision graph path with the global decision graph to determine a pre-selected path for the traffic fault information; and obtaining the policy action of the firewall policy corresponding to the traffic fault information based on the terminal node of the pre-selected path.

[0010] A second aspect of this application provides a firewall policy processing apparatus, comprising: an acquisition module, the acquisition module being configured to acquire n for each of m target devices. i Each firewall policy includes a source Internet Protocol address, a source port number, a destination Internet Protocol address, a destination port number, a protocol type, and a policy action, where m is an integer greater than or equal to 2, and n... i Let be an integer greater than or equal to 1, and let i be an integer greater than or equal to 1 and less than or equal to m; The conversion module is used to convert n of each target device... i Each firewall policy in the n firewall policies is converted into a binary symbolic representation; a construction module is used to convert the n firewall policies into binary symbolic representations. i A binary symbol is used to represent the process of merging identical nodes to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type represent intermediate nodes, and the policy action represents a terminal node. An aggregation module is used to perform aggregation operations on the multi-terminal binary decision graphs of the m target devices, merging identical nodes to obtain a global decision graph. An export module is used to export a firewall policy set table based on the global decision graph.

[0011] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0012] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0013] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0014] According to some embodiments of this application, by aggregating the multi-terminal binary decision graphs of m target devices and merging identical nodes to obtain a global decision graph, mathematical fusion can be achieved. This integrates the firewall policies of dispersed target devices into a single, internally unified data model (global decision graph), thereby solving the problem of fragmented management. Instead of viewing multiple lists from multiple target devices, the entire enterprise's security policies can be operated and analyzed from a unified global view. This application also converts the binary symbol representation of fields such as Internet Protocol addresses and ports from range representation to bit-level representation, enabling fine-grained operations at the bit level. This application employs the same node merging mechanism in both Operation S230 and Operation S240, which is the core mechanism for compressed storage. When constructing the multi-terminal binary decision graph and global decision graph for a single target device, as long as at least one field among the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action fields is the same, or has the same network prefix in the Internet Protocol address (including the source Internet Protocol address and the destination Internet Protocol address), the decision graph path nodes can be shared. This solves the problem of inefficient storage and eliminates redundant storage caused by address overlap and duplicate prefixes at the data structure level, greatly compressing the storage space of firewall policies. Since the global decision graph itself is non-redundant, the firewall policy set table derived from it is also a simplified and logically clearer policy set, which is easy to manually view and archive, thus solving the problem of difficult analysis and maintenance. The firewall policy set table provides a reliable foundation for all subsequent automated analysis functions (such as conflict detection, impact analysis, and fault location), making long-term maintenance of the firewall policy set feasible and convenient. Attached Figure Description

[0015] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 The illustrations depict application scenarios of firewall policy processing methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0017] Figure 2 A flowchart illustrating a method for processing firewall policies according to an embodiment of this application is shown schematically.

[0018] Figure 3 This schematically illustrates a flowchart of the steps for matching a first binary decision graph path with a global decision graph to determine redundant and conflicting paths, according to an embodiment of this application.

[0019] Figure 4This schematic diagram illustrates a structural block diagram of a firewall policy processing apparatus according to an embodiment of the present application;

[0020] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a firewall policy processing method according to an embodiment of this application. Detailed Implementation

[0021] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0022] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0023] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0024] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0025] Currently, enterprise network firewall policy management mainly falls into two categories: In small and medium-sized enterprise environments, firewall policies are typically stored as discrete rule sets in local configuration files on various devices, lacking a unified management platform. Administrators must maintain and synchronize policies on a device-by-device basis. In large enterprise environments, professional firewall policy management software is commonly used for centralized configuration management, but its underlying architecture is still based on a sequential dependency rule list storage model. The core implementation of this model involves splitting policies into ordered, independent rule entries. Each rule contains fields such as source address range, destination address range, port, and action, allowing overlapping or inclusion relationships between address ranges of different rules. However, this sequential dependency rule list storage model suffers from the following bottlenecks: complex address overlap relationships between rules are masked by discrete entries; the rule set expands dramatically after long-term manual rule additions; storage space resources are scarce; and the stored content is difficult to analyze and maintain. Therefore, how to globally manage firewall policies, save storage space, and facilitate analysis and maintenance has become a pressing technical problem for those skilled in the art.

[0026] Embodiments of this application provide a firewall policy processing method, apparatus, electronic device, computer-readable storage medium, and computer program product. The firewall policy processing method includes: obtaining n for each of m target devices. i There are several firewall policies, each including the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action, where m is an integer greater than or equal to 2, and n... i Let n be an integer greater than or equal to 1, and i be an integer greater than or equal to 1 and less than or equal to m; let n be the number of each target device. i Each firewall policy in the set of firewall policies is converted into a binary symbol representation; according to n i Each target device is represented by a binary symbol. Identical nodes are merged to construct a multi-terminal binary decision graph. The source internet protocol address, source port number, destination internet protocol address, destination port number, and protocol type represent intermediate nodes, while policy actions represent terminal nodes. The multi-terminal binary decision graphs of m target devices are aggregated, with identical nodes merged to obtain a global decision graph. Based on the global decision graph, a firewall policy set table is derived.

[0027] It should be noted that the firewall policy processing method, apparatus, electronic device, computer-readable storage medium and computer program product of this application can be used in the field of information security technology, and can also be used in any field other than the field of information security technology, such as the financial field. The field of this application is not limited here.

[0028] Figure 1The illustration schematically depicts application scenarios of firewall policy processing methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0029] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0030] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0032] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0033] It should be noted that the firewall policy processing method provided in this application embodiment can generally be executed by server 105. Correspondingly, the firewall policy processing device provided in this application embodiment can generally be located in server 105. The firewall policy processing method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the firewall policy processing device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0035] The following will be based on Figure 1 The described scene, through Figure 2 and Figure 3 The method for processing firewall policies according to embodiments of this application will be described in detail.

[0036] Figure 2 A flowchart illustrating a method for processing firewall policies according to an embodiment of this application is shown.

[0037] like Figure 2 As shown, the firewall policy processing method in this embodiment includes operations S210 to S250.

[0038] In operation S210, obtain the n of each of the m target devices. i There are several firewall policies, each including the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action, where m is an integer greater than or equal to 2, and n... i Let be an integer greater than or equal to 1, where i is an integer greater than or equal to 1 and less than or equal to m.

[0039] In some examples, the target device can be a network infrastructure device that has deployed access control policies (i.e., firewall policies). These devices are critical control points for network traffic, responsible for performing security functions such as zone isolation and access authorization. The target device is the smallest operational object for the system to collect, symbolically model, uniformly analyze, and accurately distribute policies; it is the bridge connecting the firewall policy processing unit with the specific network hardware. Target devices can include next-generation firewalls, routers, Layer 3 switches, web application firewalls, and cloud-native firewalls, etc.

[0040] Next-generation firewalls are typically deployed between network boundaries (such as internet exits and data center entrances) and critical internal areas. They possess advanced security features such as deep packet inspection, application identification, and intrusion prevention, and their policy rule sets are the most complex. Routers include enterprise core routers or regional aggregation routers. They implement routing policies and basic firewall functions through Access Control Lists (ACLs), controlling traffic forwarding between different network segments. For example, an ACL can be configured to prohibit direct access from the office network segment to the R&D network segment. Layer 3 switches can be used in campus networks and within data centers. When enabling communication between different VLANs (Virtual Local Area Networks), ACLs need to be configured on the VLAN interfaces of the Layer 3 switch to control cross-VLAN access. Web application firewalls are typically deployed in front of web servers, specifically to protect against attacks targeting HTTP / HTTPS applications (such as SQL injection and cross-site scripting). They have their own unique policy set based on web attack characteristics and URL rules, which needs to be managed uniformly. Cloud-native firewalls are used in public or private cloud environments. Network access control for cloud resources such as virtual machines and containers is no longer handled by physical devices but is implemented through a software-defined form like a cloud-native firewall.

[0041] Firewall policies can be deployed across various target devices, including next-generation firewalls, routers, Layer 3 switches, web application firewalls, and cloud-native firewalls. Raw text-formatted firewall policies are collected from these distributed target devices via automated scripts (such as SNMP, SSH, and NETCONF). Each firewall policy may include the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and policy action.

[0042] In some examples, the source Internet Protocol address (IPA) can be understood as the Internet Protocol address of the terminal device that initiates the connection or sends data packets in network communication. In firewall policies, the source IPA is used to identify where the traffic comes from. It can be a precise host address (e.g., 192.168.1.100) or a block of network addresses, specifying a range using a subnet mask or CIDR (Classless Inter-Domain Routing) notation (e.g., 192.168.1.0 / 24, representing addresses from 192.168.1.0 to 192.168.1.255).

[0043] In some examples, the source port number can be understood as the port number used by the client application initiating the connection in a transport layer protocol (such as TCP or UDP). It is used to distinguish different applications or processes on the same source device. For example, a source port number with a length range of 0-65535 can be defined as follows: 0-1023 are generally accepted ports, typically assigned to system-level services (such as port 22 for SSH); 1024-49151 are registered ports, assigned to user applications; and 49152-65535 are dynamic or private ports, typically used for temporary communication by clients. In firewall policies, a specific port number (such as 5201), a port range (such as 1000-2000), or a wildcard can be used to represent "any" source port.

[0044] In some examples, the destination Internet Protocol (IP) address can be understood as the Internet Protocol address of the terminal device to which the data packet is destined in network communication. In firewall policies, it is used to identify where traffic is headed. The format and range of the destination IP address are the same as those of the source IP address, defining the target network or host of the traffic (e.g., a web server 10.0.0.10 or a database network segment 172.16.1.0 / 24).

[0045] In some examples, the destination port number can be understood as the port number that a server application waiting for a connection listens on in the transport layer protocol. Similar to the source port number, the destination port number also follows the same port range conventions. Common examples include HTTP service on port 80, HTTPS on port 443, and DNS on port 53. Firewall policies can control access to specific services via the destination port (e.g., allowing access to destination port 80 for web browsing).

[0046] In some examples, protocol types (such as TCP, UDP, ICMP) can be understood as a set of rules and formats that the communicating parties follow to complete the interaction, defining key elements such as data format and timing.

[0047] In some examples, a policy action can be understood as the action performed by the firewall when the source ISP address, source port number, destination ISP address, and destination port number of a data packet match a firewall policy. Policy actions can include allow (Permit or Allow: the firewall will allow the data packet) and deny (Deny or Drop: the firewall will drop the data packet without notifying the sender).

[0048] In some examples, policy actions may also include logging (regardless of whether the final action is to allow or deny, the matching event is logged for auditing and troubleshooting) and alerting (an alert is generated when denying or allowing).

[0049] In operation S220, n of each target device i Each firewall policy in the firewall policy is converted into a binary symbol representation.

[0050] In some examples, the binary representation is a mathematical notation that the machine can efficiently compute. For example, the source Internet Protocol address 192.168.1.100 can be represented in 32-bit binary as: 11000000 10101000 0000000101100100. Similarly, the destination Internet Protocol address 192.168.1.0 / 24 can be represented in 32-bit binary as two parts: a fixed network prefix and variable host bits. The first 24 bits of the network part are specified by / 24, with a fixed network prefix of: 11000000 10101000 00000001; the last 8 bits of the host part are specified by / 24 as "variable" and can be any value. Therefore, the complete binary symbolic representation of 192.168.1.0 / 24 is a vector containing wildcards: 1100000010101000 00000001 XXXXXXXX, where X represents a "don't care" bit, which can be 0 or 1. For example, the destination port number 80 can be represented in 16-bit binary symbolic representation as: 00000000 01010000. "Any" port can be represented using 16 "don't care" bits, such as XXXXXXXX XXXXXXXX. Different protocol types have different numbers; for example, protocol type number 2 can be represented in 8-bit binary symbolic representation as: 00000010. Policy actions can be mapped to terminal values, such as Allow = 1; Deny = 0; Log = 2, etc.

[0051] The complete binary symbolic representation of each firewall policy can be formed by concatenating the binary symbolic representations of the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action field into a long binary symbolic representation. For example, source Internet Protocol address (32 bits) + source port number (16 bits) + destination Internet Protocol address (32 bits) + destination port number (16 bits) + protocol type (8 bits) = 104 bits. This process realizes the symbolic representation of the firewall policy, laying the foundation for subsequent mathematical modeling (constructing a multi-terminal binary decision graph) and calculation. It should be understood that the above long binary symbolic representation, such as source Internet Protocol address (32 bits) + source port number (16 bits) + destination Internet Protocol address (32 bits) + destination port number (16 bits) + protocol type (8 bits) = 104 bits, is only for illustrative purposes. In practice, supported firewall policies may not occupy such a large space. If more than ten protocols are supported, 4-5 bytes are also acceptable. The example provides a large reserved space and should not be interpreted as a limitation of this application.

[0052] In operation S230, according to n i Each binary symbol represents a node, and identical nodes are merged to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, source port number, destination Internet Protocol address, and destination port number represent intermediate nodes, and policy actions represent terminal nodes.

[0053] In some examples, the complete binary representation of the firewall policy generated by operating the S220 is taken as input. Starting from the root node of the multi-terminal binary decision graph (e.g., the first bit out of 96 bits: source HDMI address (32 bits) + source port number (16 bits) + destination HDMI address (32 bits) + destination port number (16 bits) = 96 bits), the decision graph path is built downwards step by step according to whether each bit is 0 or 1, eventually reaching the terminal node representing the action. A key operation during the construction process is merging identical nodes; that is, if two firewall policies have the same fixed network prefix (e.g., the first 16 bits are the same), then the decision graph path corresponding to these 16 bits will be completely shared, and branching only begins at the first different bit. This can significantly reduce storage space.

[0054] In some examples, for Internet Protocol addresses containing "ignored" bits, such as the address represented by 192.168.1.0 / 24, since the last 8 bits of the host portion are specified as "variable" by / 24, these last 8 bits can be represented in a multi-terminal binary decision graph using only a short path, without needing to enumerate all host addresses. The binary decision graph of this application supports multiple endpoints, enabling a single graph to fully represent complex policy sets containing various actions such as allow, deny, and logging.

[0055] Of course, this application supports extending the representation of firewall policies with other fields, such as user and time, which are converted into numbers and ultimately represented by some bytes, and mapped to nodes in the multi-terminal binary decision graph.

[0056] In operation S240, the multi-terminal binary decision graphs of m target devices are aggregated, and identical nodes are merged to obtain the global decision graph.

[0057] In some examples, after constructing an independent multi-terminal binary decision graph for each target device, these scattered multi-terminal binary decision graphs are merged into a unified global decision graph through aggregation operations (such as union, intersection, and overlay operations as shown in the figure). During this process, merging identical nodes again means that even firewall policies from different target devices will still share decision graph path nodes in the global decision graph as long as at least one field in the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action fields is the same, or has the same network prefix in the Internet Protocol address (including both source and destination Internet Protocol addresses).

[0058] When operating S250, export the firewall policy set table based on the global decision graph.

[0059] In some examples, each path from the root node to the endpoint node in the global decision graph can be reconstructed into a standard firewall policy rule by traversing it. Since redundant paths have been merged during the construction and aggregation process of the multi-endpoint binary decision graph, the resulting firewall policy set table is a simplified and more concise policy set with redundant rules removed, making it easier to manage and maintain firewall policies.

[0060] According to the firewall policy processing method in the embodiments of this application, the n of each of the m target devices is obtained. i There are several firewall policies, each including the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action, where m is an integer greater than or equal to 2, and n... i Let n be an integer greater than or equal to 1, and i be an integer greater than or equal to 1 and less than or equal to m; let n be the number of each target device. i Each firewall policy in the set of firewall policies is converted into a binary symbol representation; according to n iThe binary symbols represent the process of merging identical nodes to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type represent intermediate nodes, while policy actions represent terminal nodes. By aggregating the multi-terminal binary decision graphs of m target devices and merging identical nodes, a global decision graph can be obtained. Based on the global decision graph, a firewall policy set table can be derived.

[0061] The firewall policy processing method of this application aggregates the multi-terminal binary decision graphs of m target devices, merging identical nodes to obtain a global decision graph. This achieves mathematical fusion, integrating the dispersed firewall policies of target devices into a single, internally unified data model (global decision graph). This solves the problem of fragmented management, allowing for the operation and analysis of the entire enterprise's security policies from a unified global view, rather than viewing multiple lists from multiple target devices. Furthermore, this application converts fields such as Internet Protocol addresses and ports from range representations to bit-level representations by converting binary symbol representations, enabling fine-grained operations at the bit level. This application employs the same node merging mechanism in both Operation S230 and Operation S240, which is the core mechanism for compressed storage. When constructing the multi-terminal binary decision graph and global decision graph for a single target device, as long as at least one field among the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action fields is the same, or has the same network prefix in the Internet Protocol address (including the source Internet Protocol address and the destination Internet Protocol address), the decision graph path nodes can be shared. This solves the problem of inefficient storage and eliminates redundant storage caused by address overlap and duplicate prefixes at the data structure level, greatly compressing the storage space of firewall policies. Since the global decision graph itself is non-redundant, the firewall policy set table derived from it is also a simplified and logically clearer policy set, which is easy to manually view and archive, thus solving the problem of difficult analysis and maintenance. The firewall policy set table provides a reliable foundation for all subsequent automated analysis functions (such as conflict detection, impact analysis, and fault location), making long-term maintenance of the firewall policy set feasible and convenient.

[0062] According to some embodiments of this application, the firewall policy processing method may further include a first acquisition operation, a first transformation operation, a first construction operation, and a first matching operation.

[0063] First acquisition operation: Acquire the firewall policy to be added for each of the m target devices.

[0064] The first conversion operation is to convert each firewall policy to be added into a binary symbol representation.

[0065] First construction operation: Based on the binary symbol representation, construct the first binary decision graph path for each firewall policy to be added.

[0066] The first matching operation: Match the first binary decision graph path with the global decision graph to determine redundant paths and conflicting paths.

[0067] Understandably, when adding a new firewall policy rule to a traditional sequential rule list, it is difficult for administrators to visually determine whether it will be overwritten by preceding rules or subsequent rules due to complex address overlaps with several rules already in the list. This conflict and redundancy are hidden and are only discovered when a network failure occurs.

[0068] This application enables matching detection before new firewall policies are applied. Through a first acquisition operation, a first transformation operation, a first construction operation, and a first matching operation, configurations that contradict the logic of existing policies can be automatically and accurately identified before deployment, thereby achieving proactive defense and fundamentally avoiding network outages or security vulnerabilities caused by conflicts in new firewall policy configurations. It can also identify redundant firewall policies, preventing unnecessary redundant rules from being configured at the entry point. This ensures that the global firewall policy set always remains in its simplest form, with each policy having its own necessity and uniqueness.

[0069] According to some embodiments of this application, such as Figure 3 As shown, the steps of matching the first binary decision graph path with the global decision graph to determine redundant and conflicting paths include operations S310 and S320.

[0070] In operation S310, if there is a path in the global decision graph that completely matches the path in the first binary decision graph, then that path in the global decision graph is identified as a redundant path.

[0071] In operation S320, if there is a path in the global decision graph that has intermediate nodes that completely match the path in the first binary decision graph but different terminal nodes, then that path in the global decision graph will be identified as a conflict path.

[0072] By operating S310 and S320, it is easy to match the first binary decision graph path with the global decision graph and determine redundant and conflicting paths.

[0073] According to some embodiments of this application, the firewall policy processing method may further include a second acquisition operation, a second transformation operation, a second construction operation, and a second matching operation.

[0074] The second acquisition operation is to acquire the firewall policies to be deleted for each of the m target devices.

[0075] The second conversion operation: convert each firewall policy to be deleted into a binary symbolic representation.

[0076] The second construction operation: Based on the binary symbol representation, construct the second binary decision graph path for each firewall policy to be deleted.

[0077] The second matching operation: Match the second binary decision graph path with the global decision graph to determine the scope of impact of the firewall policy to be deleted.

[0078] It is understandable that when administrators delete firewall policies on target devices, they are often unaware whether the firewall policy to be deleted is implicitly depended upon by other services, or whether it is currently the only rule allowing a certain type of traffic. Blindly deleting such policies may lead to sudden interruptions of critical services, and the cause of the failure is difficult to trace. This application constructs a second binary decision graph path for the firewall policy to be deleted and matches it with the global decision graph. This allows the precise location and role of the second binary decision graph path in the global logic to be determined, thereby calculating the range of addresses related to this second binary decision graph path that will be affected if it is removed. This enables administrators to foresee all the consequences of the deletion operation before deleting the firewall policy. By leveraging the global and precise characteristics of the global decision graph, this application makes the black-box, high-risk deletion operation completely transparent and controllable, transforming the unknown consequences into visible impacts, thereby preventing service interruptions.

[0079] According to some embodiments of this application, the firewall policy processing method may further include a third acquisition operation, a third transformation operation, a third construction operation, and a third matching operation.

[0080] The third acquisition operation: acquire the firewall policy to be verified.

[0081] The third conversion operation: convert the firewall policy to be verified into a binary symbol representation.

[0082] The third construction operation: Based on the binary symbol representation, construct the third binary decision graph path of the firewall policy to be verified.

[0083] The third matching operation: Match the third binary decision graph path with the global decision graph to determine whether the firewall policy to be verified is configured.

[0084] Understandably, enterprises often need to verify whether critical firewall policies (such as blocking guest network access to core databases) have been deployed on all relevant target devices across the network. Traditionally, administrators need to log into each target device individually and manually check the rule list, a process that is extremely tedious, slow, and prone to omissions. This application can obtain the firewall policies to be verified (whether single or in batches), construct a third binary graph decision path for the policies, and perform matching operations to compare the firewall policies to be verified with the entire global policy, thus enabling large-scale, periodic policy compliance audits. Administrators can easily verify whether hundreds or thousands of critical firewall policies exist, ensuring that the actual network state conforms to the security design blueprint and compliance requirements. Furthermore, the firewall policies configured on target devices may differ from the expected state due to synchronization failures, manual errors, or malicious tampering. In traditional troubleshooting, locating such problems is like finding a needle in a haystack, requiring comparison of configurations on a large number of target devices. This application obtains clear results by verifying the third binary decision path of the firewall policy and the global decision graph. For example, within the range of source Internet Protocol address A to destination Internet Protocol address B, and source port number C to destination port number D, the policy action should be allowed but is actually not effective. This provides the most direct action guide for quickly resolving configuration issues, greatly shortening the remediation time.

[0085] According to some embodiments of this application, the firewall policy processing method may further include a fourth acquisition operation, a fourth transformation operation, a fourth construction operation, a fourth matching operation, and a determination operation.

[0086] The fourth acquisition operation is to acquire traffic fault information, which includes the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type of the faulty traffic.

[0087] The fourth conversion operation: converts the traffic fault information into a binary symbol representation.

[0088] The fourth construction operation: Based on the binary symbol representation, construct the fourth binary decision graph path for traffic fault information.

[0089] The fourth matching operation: Match the fourth binary decision graph path with the global decision graph to determine the pre-selected path for traffic fault information.

[0090] Determine the action: Based on the terminal nodes of the pre-selected path, obtain the policy action of the firewall policy corresponding to the traffic failure information.

[0091] Understandably, when a user encounters a failure to access B from A, there are many possible causes, such as routing problems, physical link issues, and the other party's service not being running. Firewall policy is only one of these, but it is also the most complex to troubleshoot. Administrators need to log into multiple firewall devices along the possible path, simulate traffic paths, and check rules one by one, a process that is extremely time-consuming and relies heavily on extensive experience. Now, assuming the failure is caused by firewall blocking, this application can convert traffic failure information into binary symbol representation. Based on the binary symbol representation, a fourth binary decision graph path for the traffic failure information is constructed. By matching the fourth binary decision graph path with the global decision graph, the pre-selected path for the traffic failure information can be determined. Then, through the terminal nodes of the pre-selected path, the policy action represented by the terminal nodes can be known, thereby determining the policy action of the firewall policy corresponding to the traffic failure information. This application can answer a key question within minutes or even seconds: is the failure to access due to firewall policy blocking? This achieves rapid fault delimitation. If the calculation result shows a match with an allowed action, then operations and maintenance personnel can immediately shift their troubleshooting focus to other directions such as routing and links, avoiding wasting time on firewall troubleshooting. If the result is a rejection, proceed to the next step. Based on this, this application can significantly improve network maintenance efficiency.

[0092] Based on the above-described firewall policy processing method, this application also provides a firewall policy processing apparatus. The following will combine... Figure 4 The device is described in detail.

[0093] Figure 4 This diagram schematically illustrates a structural block diagram of a firewall policy processing apparatus according to an embodiment of the present application.

[0094] like Figure 4 As shown, the firewall policy processing device 10 includes an acquisition module 1, a conversion module 2, a construction module 3, an aggregation module 4, and an export module 5.

[0095] Module 1 is used to obtain the n of each of the m target devices. i There are several firewall policies, each including the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action, where m is an integer greater than or equal to 2, and n... i Let be an integer greater than or equal to 1, where i is an integer greater than or equal to 1 and less than or equal to m.

[0096] Conversion module 2 is used to convert n of each target device i Each firewall policy in the firewall policy is converted into a binary symbol representation.

[0097] Module 3 is used to build based on n iEach binary symbol represents a node, and identical nodes are merged to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type represent intermediate nodes, while policy actions represent terminal nodes.

[0098] The aggregation module 4 is used to perform aggregation operations on the multi-terminal binary decision graphs of m target devices, merging identical nodes to obtain a global decision graph.

[0099] Export module 5 is used to export a firewall policy set table based on the global decision graph.

[0100] According to some embodiments of this application, the firewall policy processing apparatus may further include a first acquisition module, a first conversion module, a first construction module, and a first matching module.

[0101] First acquisition module: Acquire the firewall policy to be added for each of the m target devices.

[0102] The first conversion module converts each firewall policy to be added into a binary symbol representation.

[0103] First building module: Based on the binary symbol representation, construct the first binary decision graph path for each firewall policy to be added.

[0104] The first matching module matches the first binary decision graph path with the global decision graph to determine redundant and conflicting paths.

[0105] According to some embodiments of this application, the first matching module may include a first determining unit and a second determining unit.

[0106] First determining unit: If there is a path in the global decision graph that completely matches the path in the first binary decision graph, then that path in the global decision graph is determined as a redundant path.

[0107] Second determining unit: If there is a path in the global decision graph that has intermediate nodes that completely match the path in the first binary decision graph but has different terminal nodes, then the path in the global decision graph is determined as a conflict path.

[0108] According to some embodiments of this application, the firewall policy processing apparatus may further include a second acquisition module, a second conversion module, a second construction module, and a second matching module.

[0109] The second acquisition module: acquires the firewall policies to be deleted for each of the m target devices.

[0110] The second conversion module converts each firewall policy to be deleted into a binary symbol representation.

[0111] The second building module: Based on the binary symbol representation, constructs the second binary decision graph path for each firewall policy to be deleted.

[0112] The second matching module matches the paths in the second binary decision graph with the global decision graph to determine the scope of impact of the firewall policy to be deleted.

[0113] According to some embodiments of this application, the firewall policy processing apparatus may further include a third acquisition module, a third conversion module, a third construction module, and a third matching module.

[0114] The third acquisition module: acquires the firewall policy to be verified.

[0115] The third conversion module converts the firewall policy to be verified into a binary symbol representation.

[0116] The third building module: Based on the binary symbol representation, constructs the third binary decision graph path of the firewall policy to be verified.

[0117] The third matching module matches the third binary decision graph path with the global decision graph to determine whether the firewall policy to be verified is configured.

[0118] According to some embodiments of this application, the firewall policy processing apparatus may further include a fourth acquisition module, a fourth conversion module, a fourth construction module, a fourth matching module, and a determination module.

[0119] The fourth acquisition module acquires traffic fault information, which includes the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, and protocol type of the faulty traffic.

[0120] The fourth conversion module converts traffic fault information into binary symbol representation.

[0121] The fourth building module: Based on the binary symbol representation, construct the fourth binary decision graph path for traffic fault information.

[0122] The fourth matching module matches the fourth binary decision graph path with the global decision graph to determine the pre-selected path for traffic fault information.

[0123] Determine the module: Based on the terminal nodes of the pre-selected path, obtain the policy action of the firewall policy corresponding to the traffic fault information.

[0124] The firewall policy processing device of this application achieves mathematical fusion by aggregating the multi-terminal binary decision graphs of m target devices and merging identical nodes to obtain a global decision graph. This integrates the dispersed firewall policies of target devices into a single, internally unified data model (global decision graph), thereby solving the problem of fragmented management. Instead of viewing multiple lists from multiple target devices, it allows for the operation and analysis of the entire enterprise's security policies from a unified global view. Furthermore, this application converts fields such as Internet Protocol addresses and ports from range representations to bit-level representations by converting binary symbol representations, enabling fine-grained operations at the bit level. This application employs the same node merging mechanism in both Operation S230 and Operation S240, which is the core mechanism for compressed storage. When constructing the multi-terminal binary decision graph and global decision graph for a single target device, as long as at least one field among the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number, protocol type, and policy action fields is the same, or has the same network prefix in the Internet Protocol address (including the source Internet Protocol address and the destination Internet Protocol address), the decision graph path nodes can be shared. This solves the problem of inefficient storage and eliminates redundant storage caused by address overlap and duplicate prefixes at the data structure level, greatly compressing the storage space of firewall policies. Since the global decision graph itself is non-redundant, the firewall policy set table derived from it is also a simplified and logically clearer policy set, which is easy to manually view and archive, thus solving the problem of difficult analysis and maintenance. The firewall policy set table provides a reliable foundation for all subsequent automated analysis functions (such as conflict detection, impact analysis, and fault location), making long-term maintenance of the firewall policy set feasible and convenient.

[0125] In summary, this application enables the construction of a unified policy view covering the entire network, eliminating blind spots in traditional distributed configurations and allowing enterprises to monitor the global policy status in real time. A timed automatic synchronization mechanism ensures consistency between distributed device policies and the global view. Utilizing a multi-terminal binary decision graph to represent firewall policies completely partitions the address space, theoretically avoiding overlaps and redundancies, and mitigating the problems of sequentially dependent rule list-based firewall policy models. Furthermore, the path merging characteristic of the binary decision graph compresses policy storage space, significantly improving policy query efficiency. The system automatically generates a simplified equivalent policy set, resulting in significant policy reduction during long-term maintenance. This application automatically identifies conflicting and redundant configurations when adding policies and accurately analyzes dependency impacts when deleting policies, mathematically ensuring operational accuracy and effectively avoiding configuration anomalies caused by cross-departmental collaboration. This application supports rapid verification of batch policies and, in the event of network access failures, can quickly locate the firewall policies and related devices causing the anomalies, shortening troubleshooting time.

[0126] According to embodiments of this application, any multiple modules among the acquisition module 1, conversion module 2, construction module 3, aggregation module 4, and export module 5 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the acquisition module 1, conversion module 2, construction module 3, aggregation module 4, and export module 5 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 1, conversion module 2, construction module 3, aggregation module 4, and export module 5 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0127] Figure 5 A block diagram schematically illustrates an electronic device suitable for the described method according to an embodiment of this application.

[0128] like Figure 5 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0129] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0130] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0131] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0132] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0133] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0134] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0135] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0136] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0137] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0139] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for processing firewall policies, characterized in that, include: Get n for each of the m target devices i Each firewall policy includes a source Internet Protocol address, a source port number, a destination Internet Protocol address, a destination port number, a protocol type, and a policy action, where m is an integer greater than or equal to 2, and n... i Let be an integer greater than or equal to 1, where i is an integer greater than or equal to 1 and less than or equal to m; n for each of the target devices i Each firewall policy in the firewall policy is converted into a binary symbol representation; According to the n i Each binary symbol represents a node, and identical nodes are merged to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, the source port number, the destination Internet Protocol address, the destination port number, and the protocol type represent intermediate nodes, and the policy action represents terminal nodes. The multi-terminal binary decision graphs of the m target devices are aggregated, and identical nodes are merged to obtain a global decision graph. Based on the global decision graph, derive the firewall policy set table.

2. The firewall policy processing method according to claim 1, characterized in that, Also includes: Retrieve the firewall policy to be added for each of the m target devices; Convert each firewall policy to be added into a binary symbol representation; Based on the binary symbol representation, construct the first binary decision graph path for each firewall policy to be added; The first binary decision graph path is matched with the global decision graph to determine redundant paths and conflicting paths.

3. The method for processing firewall policies according to claim 1, characterized in that, The step of matching the first binary decision graph path with the global decision graph to determine redundant paths and conflicting paths includes: If there is a path in the global decision graph that completely matches the path in the first binary decision graph, then that path in the global decision graph is identified as a redundant path. If there exists a path in the global decision graph that has intermediate nodes that completely match the path in the first binary decision graph but different terminal nodes, then that path in the global decision graph is identified as a conflict path.

4. The method for processing firewall policies according to claim 1, characterized in that, Also includes: Retrieve the firewall policies to be deleted for each of the m target devices; Convert each of the firewall policies to be deleted into a binary symbol representation; Based on the binary symbol representation, construct a second binary decision graph path for each of the firewall policies to be deleted; The second binary decision graph path is matched with the global decision graph to determine the scope of influence of the firewall policy to be deleted.

5. The method for processing firewall policies according to claim 1, characterized in that, Also includes: Retrieve the firewall policy to be verified; Convert the firewall policy to be verified into a binary symbol representation; Based on the binary symbol representation, construct the third binary decision graph path of the firewall policy to be verified; The third binary decision graph path is matched with the global decision graph to determine whether the firewall policy to be verified is configured.

6. The method for processing firewall policies according to claim 1, characterized in that, Also includes: Obtain traffic fault information, wherein the traffic fault information includes the source Internet Protocol address, source port number, destination Internet Protocol address, destination port number and protocol type through which the faulty traffic passed; Convert the traffic fault information into binary symbol representation; Based on the binary symbol representation, construct the fourth binary decision graph path for the traffic fault information; The fourth binary decision graph path is matched with the global decision graph to determine the pre-selected path for the traffic fault information; The firewall policy action corresponding to the traffic fault information is obtained from the terminal node of the pre-selected path.

7. A firewall policy processing apparatus, characterized in that, include: The acquisition module is used to acquire n for each of the m target devices. i Each firewall policy includes a source Internet Protocol address, a source port number, a destination Internet Protocol address, a destination port number, a protocol type, and a policy action, where m is an integer greater than or equal to 2, and n... i Let be an integer greater than or equal to 1, where i is an integer greater than or equal to 1 and less than or equal to m; The conversion module is used to convert n of each target device i Each firewall policy in the firewall policy is converted into a binary symbol representation; The construction module is used to build a module based on the n i Each binary symbol represents a node, and identical nodes are merged to construct a multi-terminal binary decision graph for each target device. The source Internet Protocol address, the source port number, the destination Internet Protocol address, the destination port number, and the protocol type represent intermediate nodes, and the policy action represents terminal nodes. An aggregation module is used to perform aggregation operations on the multi-terminal binary decision graphs of the m target devices, merging identical nodes to obtain a global decision graph. An export module is used to export a firewall policy set table based on the global decision graph.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images