Firewall configuration generation method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a firewall configuration generation method, electronic equipment, a storage medium and a program product, and relates to the field of financial science and technology. According to the method, configuration application data is obtained, a to-be-configured application without a firewall address and a port is determined according to an application name, firewall resources are allocated based on deployment park information and deployment environment information of the to-be-configured application, and the firewall resource information is sent to a configuration applicant. And when confirmation information fed back by the configuration applicant is received, generating a firewall configuration scheme based on the firewall resource information. According to the method, operation and maintenance personnel do not need to manually screen, check and write configuration, manual intervention is remarkably reduced, configuration errors caused by careless omission or misjudgment are reduced, and meanwhile the integrity of configuration information is ensured. In addition, the automatic process can dynamically adapt to service changes, security vulnerabilities caused by resource allocation lag are avoided, and therefore the accuracy, efficiency and security of Web application firewall configuration are improved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to a method for generating firewall configurations, an electronic device, a storage medium, and a program product. Background Technology

[0002] With the rapid expansion of enterprise business scale, especially the popularization of cloud computing and distributed architecture, the deployment environment of Web (network) services (such as data centers, hybrid clouds, and multi-campus) is becoming increasingly complex, leading to an exponential increase in the demand for WAF (Web Application Firewall) virtual service configuration.

[0003] The configuration of virtual services in existing Web Application Firewalls (WAFs) mainly relies on manual operation. Specifically, business departments submit virtual service configuration request forms to the operations and maintenance department based on application deployment or change requirements. Subsequently, operations and maintenance personnel allocate virtual service (VS) addresses, ports, and clusters for the WAF based on the existing resource pool. Taking into account address conflicts, load balancing, and policy compatibility, they determine the WAF addresses and ports to be allocated and manually write configuration schemes based on the allocation results.

[0004] However, manual operation is inefficient and it is difficult to avoid the omission and misconfiguration of key parameters, thus failing to ensure the completeness and accuracy of the configuration scheme. Summary of the Invention

[0005] This application provides a method for generating firewall configurations, an electronic device, a storage medium, and a program product to address the problems in the prior art where manual analysis and writing of firewall configuration schemes is inefficient and makes it difficult to avoid omissions and misconfigurations of key parameters, thus failing to ensure the completeness and accuracy of the configuration scheme.

[0006] In a first aspect, embodiments of this application provide a method for generating firewall configurations, the method comprising:

[0007] Obtain configuration request data, which includes application name, deployment park information, and deployment environment information;

[0008] Based on the application name, identify the application to be configured that has not been configured with a firewall address and port;

[0009] Firewall resources are allocated based on the deployment park information and deployment environment information of the application to be configured, and the firewall resource information is sent to the configuration requester; the firewall resource information includes: the address to be allocated and the port to be allocated;

[0010] Upon receiving confirmation from the configuration requester, a firewall configuration scheme is generated based on the firewall resource information. The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resource.

[0011] In one possible implementation, the configuration request data further includes DCPP port data, and the allocation of firewall resources based on the deployment park information and deployment environment information of the application to be configured includes:

[0012] The virtual resource allocation rules are invoked to determine the corresponding firewall cluster based on the deployment park information and deployment environment information of the application to be configured; the virtual resource allocation rules include: address and port allocation policies predefined according to the deployment park, deployment environment and DCPP ports;

[0013] Select unoccupied addresses from the address pool of the firewall cluster as addresses to be allocated;

[0014] Based on the virtual resource allocation rules, the ports to be allocated corresponding to the DCPP port data are determined.

[0015] In one possible implementation, generating a firewall configuration scheme based on the firewall resource information includes:

[0016] Based on the firewall resource information, determine the change element information corresponding to each change element field in the change element template;

[0017] Based on the changed element information and the changed element template, a firewall configuration scheme is generated.

[0018] In one possible implementation, the change element information includes: change execution period, protection strategy configuration, production chain, implementation steps, and verification steps; the step of determining the change element information corresponding to each change element field in the change element template based on the firewall resource information includes:

[0019] Determine the time period for implementing the changes based on historical business traffic data;

[0020] The production link is determined based on the application name, DCPP port, and deployment environment information;

[0021] Based on the application type of the application to be configured, determine the corresponding protection policy configuration from the protection policy mapping library;

[0022] The address to be assigned, the port to be assigned, and the production link are filled into the firewall configuration standardization step template in the change element template to obtain the implementation steps;

[0023] Based on the application type and deployment environment, a verification item template is determined, and the address to be assigned and the port to be assigned are filled into the verification item template to obtain the verification steps.

[0024] In one possible implementation, before allocating firewall resources based on the deployment park information and deployment environment information of the application to be configured, the method further includes:

[0025] Obtain the load data of each firewall cluster in the deployment park corresponding to the deployment park information;

[0026] Based on the load data of each firewall cluster, the allocation priority of the addresses corresponding to each firewall cluster is adjusted to obtain the adjusted virtual resource allocation rules.

[0027] In one possible implementation, the verification step includes:

[0028] Based on the topology graph database, simulated links for production links in the firewall configuration scheme are generated. The topology graph database is used to store the connection relationships of network devices in each campus.

[0029] Simulate traffic transmission in the simulated link to verify the connectivity of the simulated link, and verify the compliance of each changed element information in the firewall configuration scheme based on a preset conflict detection rule base.

[0030] If the verification result indicates that the verification failed, the firewall configuration scheme shall be corrected according to the verification result.

[0031] In one possible implementation, the conflict detection rule base includes: cross-subnet communication rules, and the step of correcting the firewall configuration scheme based on the verification results includes:

[0032] If the verification result indicates that the simulation link is not connected, the production link is adjusted based on the transmission breakpoints in the verification result and in conjunction with the topology database.

[0033] If the verification result indicates that the cross-subnet communication rule is not met, the application to be configured is reassigned an address; or, cross-subnet routing rules are added.

[0034] Secondly, embodiments of this application provide a firewall configuration generation apparatus, the apparatus comprising:

[0035] The acquisition module is used to acquire configuration request data, which includes application name, deployment park information, and deployment environment information.

[0036] The determination module is used to determine the application to be configured that has not been configured with a firewall address and port, based on the application name;

[0037] The allocation module is used to allocate firewall resources based on the deployment park information and deployment environment information of the application to be configured;

[0038] The sending module is used to send firewall resource information to the configuration requester; the firewall resource information includes: address to be assigned and port to be assigned.

[0039] The generation module is used to generate a firewall configuration scheme based on the firewall resource information when it receives confirmation information from the configuration requester. The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resource.

[0040] In one possible implementation, the configuration request data further includes DCPP port data, and the above-mentioned device further includes: a filtering module;

[0041] The determination module is also used to invoke virtual resource allocation rules to determine the corresponding firewall cluster based on the deployment park information and deployment environment information of the application to be configured; the virtual resource allocation rules include: address and port allocation policies predefined according to the deployment park, deployment environment and DCPP ports;

[0042] The filtering module is used to filter unoccupied addresses from the address pool of the firewall cluster as addresses to be allocated.

[0043] The determination module is also used to determine the port to be allocated corresponding to the DCPP port data based on the virtual resource allocation rules.

[0044] In one possible implementation, the determining module is further configured to determine the change element information corresponding to each change element field in the change element template based on the firewall resource information;

[0045] The generation module is specifically used to generate a firewall configuration scheme based on the changed element information and the changed element template.

[0046] In one possible implementation, the change element information includes: change execution period, protection strategy configuration, production chain, implementation steps, and verification steps; the above device also includes: a filling module;

[0047] The determination module is also used to determine the time period for change execution based on historical business traffic data;

[0048] The determination module is also used to determine the production link based on the application name, DCPP port, and deployment environment information;

[0049] The determination module is also used to determine the corresponding protection policy configuration from the protection policy mapping library based on the application type of the application to be configured;

[0050] The population module is used to populate the address to be assigned, the port to be assigned, and the production link into the firewall configuration standardization step template in the change element template to obtain the implementation steps;

[0051] The determination module is also used to determine a verification item template based on the application type and deployment environment, and to fill the address to be assigned and the port to be assigned into the verification item template to obtain the verification steps.

[0052] In one possible implementation, the above-mentioned device further includes: an adjustment module;

[0053] The acquisition module is also used to acquire load data of each firewall cluster in the deployment park corresponding to the deployment park information;

[0054] The adjustment module is used to adjust the allocation priority of the addresses corresponding to each firewall cluster based on the load data of each firewall cluster, so as to obtain the adjusted virtual resource allocation rules.

[0055] In one possible implementation, the above-mentioned device further includes: a verification module and a correction module;

[0056] The generation module is also used to generate simulated links of the production links in the firewall configuration scheme based on the topology graph database, wherein the topology graph database is used to store the connection relationships of network devices in each campus.

[0057] The verification module is used to simulate traffic transmission in the simulated link, verify the connectivity of the simulated link, and verify the compliance of each changed element information in the firewall configuration scheme based on a preset conflict detection rule base.

[0058] The correction module is used to correct the firewall configuration scheme according to the verification result if the verification result indicates that the verification failed.

[0059] In one possible implementation, the conflict detection rule base includes: cross-subnet communication rules, an adjustment module, and is further configured to adjust the production link based on the transmission breakpoint in the verification result and in conjunction with the topology database when the verification result indicates that the simulation link is not connected;

[0060] The correction module is specifically used to, when the verification result indicates that the cross-subnet communication rules are not met, reallocate the address to be assigned to the application to be configured; or, supplement the cross-subnet routing rules.

[0061] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0062] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0063] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0064] This application provides a firewall configuration generation method, electronic device, storage medium, and program product. The method acquires configuration request data and, based on the application name, identifies applications that have not yet been configured with firewall addresses and ports. It then allocates firewall resources based on the deployment park and environment information of the application and sends the firewall resource information to the configuration requester. Upon receiving confirmation from the requester, it generates a firewall configuration scheme based on the firewall resource information. This method eliminates the need for manual screening, verification, and configuration writing by operations personnel, significantly reducing manual intervention and minimizing configuration errors caused by oversights or misjudgments, while ensuring the integrity of configuration information. Furthermore, the automated process can dynamically adapt to business changes (such as cluster expansion), avoiding security vulnerabilities caused by delayed resource allocation, thereby improving the accuracy, efficiency, and security of web application firewall configuration. Attached Figure Description

[0065] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0066] Figure 1 A flowchart illustrating the firewall configuration generation method provided in this application embodiment. Figure 1 ;

[0067] Figure 2 A flowchart illustrating a firewall configuration generation method provided in this application embodiment. Figure 2 ;

[0068] Figure 3 A flowchart illustrating a firewall configuration generation method provided in this application embodiment. Figure 3 ;

[0069] Figure 4A schematic diagram of the structure of the firewall configuration generation device provided in the embodiments of this application;

[0070] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0071] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0072] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0073] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0074] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0075] In this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0076] In the embodiments of this application, the use of terms such as "first" and "second" is to distinguish between identical or similar items that have essentially the same function and effect. For example, "first electronic device" and "second electronic device" are merely used to distinguish different electronic devices and do not limit their order of execution. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply that they are different.

[0077] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0078] It should be noted that the target identification and positioning methods, devices, media and program products provided in this application can be used in the field of fintech, or in any field other than fintech. The application fields of the target identification and positioning methods, devices, media and program products in this application are not limited.

[0079] First, let me explain the terms used in this application:

[0080] Web Application Firewalls (WAFs) are key components of internet security protection systems and are widely used in industries with extremely high network security requirements, such as finance, government affairs, and e-commerce.

[0081] Currently, the configuration of virtual services in a Web Application Firewall (WAF) primarily relies on manual operation. Specifically, business departments submit virtual service configuration request forms (including address, port, and other information) to the operations and maintenance department based on application deployment or change requirements. Subsequently, operations and maintenance personnel allocate virtual service addresses, ports, and clusters for the WAF based on the existing resource pool, comprehensively considering address conflicts, load balancing, and policy compatibility to determine the WAF addresses and ports to be allocated, and manually write configuration schemes based on the allocation results.

[0082] For example, in a hybrid cloud environment, addresses requested by business units may conflict with existing resources. Operations personnel need to verify each one, which is time-consuming and prone to omissions. Redundant rules in the policy library (such as duplicate source and destination addresses and protocol ports) reduce the efficiency of determining matching policies from the policy library, and manual optimization of the policy library is difficult to cover the entire dataset. In addition, when the business deployment environment changes (such as adding a new campus), manual adjustment of policies requires re-evaluating the resource allocation logic, resulting in response delays.

[0083] Therefore, existing technologies suffer from low efficiency and are prone to omissions and misconfigurations, thus failing to ensure the completeness and accuracy of the configuration scheme.

[0084] In view of this, the present application provides a target identification and positioning method. This method constructs an end-to-end automated processing logic from application data parsing and dynamic resource allocation to change scheme generation. Through the automated process, it realizes the intelligent generation of Web Application Firewall (WAF) virtual service configuration schemes, which solves the problems of low efficiency, error-proneness and information omission in the prior art due to reliance on manual operation, thus failing to ensure the integrity and accuracy of the configuration scheme.

[0085] The technical solutions of this application will be described in detail below with reference to specific embodiments. The specific embodiments described below can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0086] Figure 1 A flowchart illustrating the firewall configuration generation method provided in this application embodiment. Figure 1 The execution entity of this method can be an electronic device with corresponding data storage and computing capabilities, such as a computer or server. This method can be applied, for example, to firewall systems in financial institutions. Figure 1 As shown, the method includes:

[0087] S101. Obtain configuration request data.

[0088] Configuration request data includes, but is not limited to, the application's Chinese name, English name, DCPP (Data Center Private Protocol) address and port, Layer 2 F5 address and port, deployment park information, and deployment environment information. This configuration request data can be submitted by the application department. For example, a configuration request data submitted by the management department of a bank's business system might include "Application Name: Mobile Banking," "Deployment Park Information: Beijing - Production," and "Deployment Environment Information: Production Environment." The DCPP address is used to identify the internal IP (Internet Protocol) address of the business server.

[0089] Specifically, initial configuration request data is obtained via email or API (Application Programming Interface), and this initial configuration request data is then processed in a structured manner to obtain the configuration request data. This structured processing includes, but is not limited to, data cleaning and format standardization.

[0090] For example, when a bank applies for WAF configuration for its mobile banking application, the application form includes "Application Name in Chinese: Mobile Banking", "DCPP Address: 192.168.1.100" and "Production Deployment Park: Beijing-Production". After the system parses the data, it stores it as structured data.

[0091] It can be understood that when the executing entity is an electronic device that deploys a firewall system, the processor of the electronic device obtains the application form data through the email or the API interface of the application system, parses it into structured fields, and then verifies the completeness of the required fields (such as application name, DCPP port, and campus information). If the detection result indicates that a certain field of information is missing, the above configuration application data is marked as an invalid application and fed back to the applicant.

[0092] S102. Based on the application name, identify the applications that have not been configured with firewall addresses and ports.

[0093] The purpose of this step is to identify applications that require new configuration and avoid duplicate allocations. Automated filtering is achieved through database queries and status marking mechanisms. Specifically, the configuration request data includes at least one application requesting firewall configuration. The firewall configuration database is used to identify applications that have not yet been configured with firewall addresses and ports, and these applications are marked as applications awaiting configuration. The firewall configuration database records the allocated WAF addresses and ports, along with their corresponding application names.

[0094] For example, if the WAF configuration parameters for "Corporate Online Banking" are not found in the firewall configuration database, then "Corporate Online Banking" will be identified as the application to be configured.

[0095] S103. Allocate firewall resources based on the deployment park information and deployment environment information of the application to be configured, and send the firewall resource information to the configuration requester.

[0096] The purpose of this step is to allocate protection resources from the WAF cluster's resource pool to the application to be configured and to provide the resource information back to the configuration requester for confirmation. Firewall resources include those directly usable for virtual service configuration within the WAF cluster, specifically the address and port to be assigned. The address and port to be assigned indicate the address and port allocated to the Web Application Firewall virtual service. For example, assigning the address "10.1.0.200" and port "8080" to the "Enterprise Online Banking" application in the "Beijing-Production" park.

[0097] Specifically, based on the deployment zone to which the web application belongs, all WAF clusters within that zone are identified as candidate clusters. Based on preset allocation rules and the deployment environment of the web application, a target cluster is determined from the candidate clusters. The address range corresponding to this target cluster is the selection range for the addresses to be allocated. The preset allocation rules include, but are not limited to: the cluster protection level corresponding to the deployment environment, the priority of cluster resource allocation, the occupancy status of addresses in the address pool, and the protocol compatibility between the port and the DCPP port.

[0098] For example, in a banking scenario, if the deployment zone for the first web application is Zone A, then clusters in Zone A are selected as candidate clusters. Furthermore, if the deployment environment for the first web application is a branch cloud, and the business scope of the branch cloud is limited to the branch's local area, based on the preset allocation rules regarding the branch cloud's protection level and the existence of unused resources in the address pool, a branch cloud-specific target WAF cluster with a medium protection level and an unused address pool is selected from the candidate clusters. From the address pool of this target WAF cluster, unused addresses are selected as the addresses to be allocated to the aforementioned first web application. Additionally, ports with port numbers matching the DCPP port number are identified as WAF ports to be allocated.

[0099] Based on the above example, firewall resources include, but are not limited to, the address to be assigned (VS address), the port to be assigned, and the identifier of the cluster to which it belongs. For example, the virtual service resources assigned to the "Payment Gateway" are "172.16.1.200:80" (address to be assigned and port to be assigned) and "Cluster 2" (cluster to which it belongs).

[0100] S104. Upon receiving confirmation information from the configuration requester, generate a firewall configuration scheme based on firewall resource information.

[0101] The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resources. The association link is used to indicate the end-to-end transmission path of the traffic of the application to be configured. This association path can be, for example, "Web application deployed on the branch cloud - target WAF cluster virtual service - branch local F5 load balancer - DCPP server".

[0102] Specifically, the confirmation message is used to instruct the configuration requester to agree to use the allocated firewall resources. Upon receiving the confirmation message, the configuration request data and network rules and topology data are automatically retrieved based on the firewall resource information. A configuration scheme is generated by combining the firewall resource information, configuration request data, and network rules and topology data. The network rules and topology data are obtained by retrieving the device connection relationships of the target cluster (e.g., the link binding between WAF cluster devices and F5) from the topology database and the link configuration of the deployment environment (e.g., the first link corresponding to the ecosystem cloud environment) from the rule database.

[0103] Understandably, firewall configuration schemes are used to guide operations and maintenance personnel in performing standardized configuration operations, which helps to efficiently and systematically configure firewalls for web applications.

[0104] This application provides a method for generating firewall configurations. By acquiring configuration request data and identifying applications without configured firewall addresses and ports based on application names, firewall resources are allocated based on the deployment park and environment information of the applications. This firewall resource information is then sent to the configuration requester. Upon receiving confirmation from the requester, a firewall configuration scheme is generated based on the firewall resource information. This method eliminates the need for manual screening, verification, and configuration writing by operations personnel, significantly reducing human intervention and minimizing configuration errors due to oversight or misjudgment, while ensuring the integrity of configuration information. Furthermore, the automated process can dynamically adapt to business changes (such as cluster expansion), avoiding security vulnerabilities caused by delayed resource allocation, thereby improving the accuracy, efficiency, and security of web application firewall configuration.

[0105] Figure 2 A flowchart illustrating a firewall configuration generation method provided in this application embodiment. Figure 2 ,like Figure 2 As shown, in this embodiment... Figure 1 Based on the embodiments, a method for allocating firewall virtual resources and generating firewall configuration schemes is described in detail. The method includes:

[0106] S201. Invoke the virtual resource allocation rules and determine the corresponding firewall cluster based on the deployment park information and deployment environment information of the application to be configured.

[0107] The virtual resource allocation rules are used to indicate the predefined address and port allocation policies based on the deployment zone, deployment environment, and DCPP ports. The deployment environment information indicates the network environment type of the application deployment (such as production environment or testing environment).

[0108] Specifically, the multi-dimensional information in the configuration application data is matched with the virtual resource allocation rules to determine at least one pending firewall cluster corresponding to the deployment park information and deployment environment information. If there is only one pending firewall cluster, it is used as the aforementioned firewall cluster, and its identifier is output as the basis for subsequent firewall virtual resource allocation. If there are multiple pending firewall clusters, the firewall clusters to be allocated and their corresponding identifiers are determined based on the priority rules in the virtual resource allocation rules. The priority rules indicate the allocation priority of each firewall cluster. These allocation priority rules are determined based on the load and other operational data of each firewall cluster, and this application does not impose any restrictions on this.

[0109] Understandably, the virtual resource allocation rules are stored in a structured configuration table format. The virtual resource allocation rules include the deployment zone code, deployment environment code, DCPP port segment, and the correspondence with the firewall cluster, address pool, and port. The virtual resource allocation rules support the addition, modification, and deletion operations of operation and maintenance personnel.

[0110] Optionally, a method for adjusting virtual resource allocation rules is provided herein. The method includes: obtaining load data of each firewall cluster in the deployment park corresponding to the deployment park information; adjusting the allocation priority of the addresses corresponding to each firewall cluster based on the load data of each firewall cluster, thereby obtaining the adjusted virtual resource allocation rules.

[0111] The load data includes the occupancy rate of allocated addresses in the cluster.

[0112] Specifically, based on the deployment park information in the configuration application data, load data for each firewall cluster in the corresponding deployment park is retrieved from the monitoring system. Multiple load data sets are sorted in descending order to obtain a load sequence for multiple firewall clusters. This order serves as the allocation priority for the corresponding firewall cluster. Firewall clusters ranked higher in the sequence have lower allocation priority.

[0113] For example, in the "branch cloud" scenario, address ranges of low-load clusters are prioritized to ensure reasonable resource allocation and load balancing. For instance, if the load on "branch cloud" cluster 1 is too high, the idle address range "192.168.10.0 / 24" of cluster 2 is automatically allocated.

[0114] Understandably, the timing of virtual resource allocation rule adjustments can be, for example, when firewall resource allocation is triggered, or based on a preset period.

[0115] In some embodiments, the load data includes: CPU utilization, concurrent connections, allocated address occupancy, and throughput. These load data are preprocessed, and then a weighted sum is performed on the preprocessed load data to obtain a load score for each firewall cluster. This load score reflects the load level of the corresponding firewall cluster; a higher load score indicates a higher load on the corresponding firewall cluster. Therefore, the firewall clusters are sorted according to their load scores from smallest to largest, resulting in a priority sequence for the firewall clusters. The preprocessing includes, but is not limited to, removing outlier data, completing missing data, and standardization / normalization.

[0116] This method employs dynamic resource pool management, enabling the system to respond in real-time to changes in resource usage and avoid wasting address ranges or port resources due to fixed rules. For example, it automatically expands the address pool capacity during peak business periods or reclaims idle ports during off-peak periods, thereby improving address and port utilization and reducing the risk of configuration failures due to insufficient resources. Furthermore, the dynamic adjustment strategy reduces the complexity of cross-campus configuration, ensuring independent and efficient resource allocation across different campuses.

[0117] S202. Select unoccupied addresses from the address pool of the firewall cluster as addresses to be allocated.

[0118] Each firewall cluster has a dedicated address pool in the IPAM (IP Address Management) system. The address pool exists in the form of network segments. The IPAM system records the IP address, subnet mask, occupancy status, and application identifier of each IP in the address pool.

[0119] The occupancy status includes unoccupied, occupied, and pending allocation. Addresses with an unoccupied status are designated as pending allocation addresses, and their occupancy status is updated to unpending allocation.

[0120] Understandably, a timeout mechanism for the "pending allocation" status is set up to monitor the duration for which the IP address's occupancy status is updated to "unoccupied." If this duration reaches a preset time, the IP address's occupancy status is updated to "unoccupied," thus releasing resources. This preset time is set based on business requirements and could be, for example, 24 hours. For instance, if an IP address marked as "pending allocation" does not receive confirmation within 24 hours, its status is automatically restored to "unoccupied," releasing resources.

[0121] S203. Based on the virtual resource allocation rules, determine the port to be allocated corresponding to the DCPP port data, and send the firewall resource information to the configuration requester.

[0122] The configuration request data also includes DCPP port data. The virtual resource allocation rules include a port allocation policy, which indicates that the DCPP port number in the configuration request data should be used as the port to be allocated.

[0123] In one implementation, if the port corresponding to the DCPP port number is occupied, the port number to be allocated is set to the DCPP port number + 1. The process of retrieving the port number to be allocated continues until it is found to be unoccupied, at which point the port number to be allocated is output. The port corresponding to this port number is the port to be allocated.

[0124] It should be noted that the address to be allocated obtained in step S202 above is integrated with the information such as the port to be allocated, firewall cluster identifier, and subnet mask determined in this step to obtain firewall resource information. The subnet mask, for example, can be obtained from the IPAM system.

[0125] S204. Upon receiving confirmation information from the configuration requester, determine the change element information corresponding to each change element field in the change element template based on the firewall resource information.

[0126] The firewall system has a pre-defined standardized change element template. This template includes the change element fields required for firewall configuration, including but not limited to cluster identifier, address to be assigned, port to be assigned, application name, and implementation steps. The change element information corresponding to each change element field is determined from the firewall resource information.

[0127] Understandably, a verification mechanism is established for the confirmation information provided by the configuration requester. This verification mechanism includes, but is not limited to, the request number, confirmation status (agreement or rejection), application name, and signature information. The signature information refers to the signature provided by the configuration requester when providing the confirmation information. This signature is used to ensure the authenticity and reliability of the confirmation information.

[0128] Upon receiving the confirmation information, a verification mechanism is used to validate the information. If the verification passes, the corresponding change element information for each change element field in the change element template is determined based on the firewall resource information. If the verification fails, the verification result is sent back to the applicant, including the reason for the failure and prompts for subsequent operations. For example, the verification result could be: "Application number is missing one digit; confirmation information is invalid. Please resubmit."

[0129] Furthermore, based on the address and port to be allocated in the verification results, the occupancy status of the address and port to be allocated is updated to unoccupied in the IPAM system.

[0130] Optionally, a method for determining change element information is provided here. This method includes the following change element information: change execution period, protection policy configuration, production link, implementation steps, and verification steps. Specifically, the method includes: determining the change execution period based on historical business traffic data; determining the production link based on the application name, DCPP port, and deployment environment information; determining the corresponding protection policy configuration from the protection policy mapping library based on the application type of the application to be configured; filling the address to be assigned, the port to be assigned, and the production link into the firewall configuration standardized step template in the change element template to obtain the implementation steps; and determining the verification item template based on the application type and deployment environment, and filling the address to be assigned and the port to be assigned into the verification item template to obtain the verification steps.

[0131] The level of business traffic affects the risk of firewall changes. For example, changing firewall configurations during peak hours may lead to network outages, response delays, and other problems. Therefore, historical business traffic data is analyzed to identify low-traffic periods, and a preset duration is extracted from these low-traffic periods as the change execution period. The traffic level is determined based on factors such as hourly concurrent connections, network throughput, and packet forwarding volume.

[0132] Understandably, the preset duration is the duration of the change execution period, and it is obtained based on historical configuration duration statistical analysis. For example, obtain the historical configuration duration for the past 30 days, calculate the historical average configuration duration, and add a reserved duration to this historical average configuration duration to obtain the aforementioned preset duration. The reserved duration is used to ensure that there is sufficient time to complete firewall configuration and emergency rollback.

[0133] The production link mapping database includes the mapping relationship between application name, DCPP port, deployment environment information, and preset production links. Based on the application name, DCPP port, and deployment environment information of the application to be configured, the production link mapping database is called to determine the corresponding production link.

[0134] Furthermore, the protection policy configuration includes, but is not limited to, SQL (Structured Query Language) injection protection, XSS (Cross-Site Scripting) injection protection, and sensitive information leakage protection. Based on the protection policy mapping library, the protection policy configuration corresponding to the application type of the application to be configured is determined. The protection policy mapping library includes the mapping relationship between application types and protection policy configurations. For example, for a "financial transaction system" application, high-precision SQL injection protection and sensitive information leakage detection are automatically enabled; for a "content management system" application, XSS protection and file upload filtering are enabled.

[0135] Understandably, based on historical protection effectiveness data, the matching weight of strategies is dynamically adjusted (e.g., if a certain type of strategy has a high false alarm rate in a certain type of application, its matching priority is reduced) in order to optimize the protection strategy mapping library.

[0136] It should be noted that the standardized procedure template is based on the general procedure settings for firewall configuration. These procedures may include, for example, interface configuration, address binding to be assigned, port mapping to be assigned, and protection policy configuration and activation. Therefore, by filling the address to be assigned, port to be assigned, production link, and protection policy into the firewall configuration standardized procedure template in the change element template, the implementation steps for firewall configuration can be generated.

[0137] The system retrieves a verification template from the verification template library that matches the application type and deployment environment of the application to be configured, and populates the template with the address and port to be assigned, thus obtaining the complete verification steps. The verification template library includes the mapping between application type, deployment environment, and predefined verification templates.

[0138] S205. Generate a firewall configuration scheme based on the changed element information and changed element template.

[0139] The firewall system has a configuration command mapping library. For any changed feature information, it determines the firewall configuration command corresponding to the changed feature field in the changed feature information, and generates a first configuration command based on the mapping relationship between the firewall configuration command and the changed feature information. Furthermore, the changed feature template is a firewall configuration command template. The first configuration commands corresponding to each changed feature field are filled into the corresponding positions in the changed feature template to obtain the firewall configuration scheme.

[0140] Understandably, after obtaining the firewall configuration scheme, each configuration command statement is syntax-checked. If the check indicates a syntax error, a modification prompt is generated to remind the operations and maintenance personnel to correct the grammatically incorrect configuration command statements according to the prompt. If the check passes, the firewall configuration scheme is executed to configure the firewall for the application to be configured.

[0141] This application provides a method for generating firewall configurations. By invoking virtual resource allocation rules, the method determines the corresponding firewall cluster based on the deployment park and environment information of the application to be configured. Unoccupied addresses are then selected from the address pool of the firewall cluster as addresses to be allocated. Furthermore, based on the virtual resource allocation rules, the method determines the ports to be allocated corresponding to DCPP port data and sends the firewall resource information to the configuration requester. This method, by invoking virtual resource allocation rules and combining the configuration request data uploaded by the requester, achieves automated allocation of firewall resources, improving firewall configuration efficiency. Moreover, this method avoids the problem of missing key parameters during manual analysis of configuration request data, which could lead to incorrect allocation of firewall resources, thus helping to ensure the completeness and accuracy of the firewall configuration scheme.

[0142] Upon receiving confirmation from the configuration requester, the system determines the corresponding change element information for each change element field in the change element template based on firewall resource information. Then, based on this change element information and the change element template, a firewall configuration scheme is generated. This method generates configuration commands using change element information and the change element template, and through structured population of these commands, a complete firewall configuration scheme is obtained. This avoids manually writing configuration commands, improving the efficiency of firewall configuration scheme generation, as well as enhancing the completeness and accuracy of the firewall configuration scheme.

[0143] Figure 3 A flowchart illustrating a firewall configuration generation method provided in this application embodiment. Figure 3 ,like Figure 3 As shown, in this embodiment... Figure 1-2 Based on the examples, the verification steps in the firewall configuration scheme are described in detail. The method includes:

[0144] S301. Based on the topology database, generate a simulation link for the production link in the firewall configuration scheme.

[0145] The topology database stores the connection relationships of network devices in each campus. For example, it includes the connection relationships between routers and firewalls in the branch cloud campus. The topology database is updated periodically by acquiring information such as the node information and resource status of the firewall cluster, the connection relationships and configuration rules of network devices within the campus. Understandably, updates to the topology database can also be triggered manually.

[0146] The topology map corresponding to the deployment zone of the application to be configured is obtained from the topology map database. Then, based on the production link in the change element information generated in step S204 above, the connection relationship between each device and port in the production link is determined from the topology map. Based on the connection relationship, the physical connection relationship of the simulated real network devices is generated to simulate real traffic transmission.

[0147] For example, a virtual path from the WAF virtual service to the backend web server is generated based on the network topology of the "Branch Cloud" campus.

[0148] S302. Simulate traffic transmission in the simulated link to verify the connectivity of the simulated link, and verify the compliance of each changed element information in the firewall configuration scheme based on the preset conflict detection rule base.

[0149] Specifically, based on the service type of the application to be configured, a simulated traffic packet with the same characteristics as the real service traffic is generated, and the simulated traffic packet is injected into the starting node of the simulation link to simulate user request traffic and detect whether it successfully reaches the target server in order to verify the connectivity of the simulation link.

[0150] The conflict detection rule base stores a set of rules used to verify the compliance of configuration schemes, including but not limited to cross-subnet communication rules, port compatibility rules, and resource usage detection rules. Specifically, cross-subnet communication rules verify whether the WAF address and F5 address are on the same subnet, and port compatibility rules verify whether the protocols of the WAF port, F5 port, and DCPP port are compatible (e.g., if the WAF uses port 443 (HTTPS), the DCPP port must support the HTTPS protocol and cannot be port 80, which only supports HTTP). Furthermore, resource usage detection rules verify whether the allocated WAF address / port has already been used by other applications in the IPAM system (secondary conflict check).

[0151] This method achieves comprehensive verification of configuration schemes through collaborative validation of simulated link generation and a conflict detection rule base. Simulated link generation ensures that production link selection conforms to the actual network topology, avoiding configuration failures caused by cross-subnet communication rule conflicts. The conflict detection rule base covers multi-dimensional risks such as address, port, and policy conflicts, proactively mitigating errors during implementation. Ultimately, this step significantly improves the reliability of configuration schemes, reduces implementation rollbacks due to unreachable paths or resource conflicts, and lowers operational risks.

[0152] S303. If the verification result indicates that the verification failed, the firewall configuration scheme shall be modified according to the verification result.

[0153] The purpose of this step is to generate a targeted correction strategy by combining the topology data, virtual resource allocation rules, and verification results if the simulated link fails verification, so as to ensure the accuracy and executability of the firewall configuration scheme.

[0154] Specifically, when the verification result indicates that the verification failed, traffic transmission data is extracted from the verification log to determine the node and cause of the traffic transmission interruption. This cause could be, for example, an interface not being enabled or a port not being open. Furthermore, the conflict detection rules for which the verification result failed are identified from the verification results.

[0155] For example, if the verification result indicates that the simulation link is not connected, the production link is adjusted based on the transmission break nodes in the verification result and in conjunction with the topology database. For instance, the status of inactive interfaces is updated to inactive, and for the transmission break nodes, backup devices are identified from the topology database, and the device corresponding to that node in the production link is replaced with the backup device.

[0156] Cross-subnet communication rules are designed to ensure that the address configurations of the WAF device and the F5 (load balancer) support normal communication settings. If the WAF device and the F5 are not on the same subnet and there is no subnet routing, traffic forwarding will fail. Therefore, if the verification result indicates that the cross-subnet communication rules are not met, the application to be configured should be reassigned an address; or, cross-subnet routing rules should be added.

[0157] S304 If the verification result indicates that the verification is successful, then perform the firewall configuration operation and send the verification result to the operation and maintenance personnel.

[0158] The verification results include a standardized verification report, which includes, but is not limited to, the configuration request number, the firewall configuration scheme, and the simulation verification results.

[0159] Understandably, the verification results are pushed to relevant personnel through the operations and maintenance system, and the verification results are marked as pending execution. After receiving the notification, the operations and maintenance personnel can confirm the receipt status in the operations and maintenance platform; after the actual firewall configuration operation is completed, the operations and maintenance personnel need to report "configuration execution completed" in the platform. The system records the execution time and execution result, forming a full lifecycle record of the firewall configuration scheme from "generation-verification-implementation".

[0160] This application provides a method for generating firewall configurations. Based on a topology database, it generates simulated links for production links in a firewall configuration scheme, simulates traffic transmission in the simulated links, verifies the connectivity of the simulated links, and verifies the compliance of various changed elements in the firewall configuration scheme based on a preset conflict detection rule base. Furthermore, if the verification result indicates a failure, the firewall configuration scheme is corrected according to the verification result. This method simulates the transmission process of request traffic in a real link using simulated links, and, combined with a conflict detection rule base, verifies the connectivity and compliance of the production links. This facilitates the timely detection of problems in the firewall configuration scheme, avoiding risks such as service interruptions and network failures after firewall configuration is completed, thereby improving the accuracy and executability of the firewall configuration scheme.

[0161] Furthermore, when the firewall configuration scheme fails verification, this method combines topology data, virtual resource allocation rules, and verification results to generate targeted correction strategies, improving the efficiency of firewall configuration scheme correction and reducing the workload of operations and maintenance personnel.

[0162] If the verification result indicates that the verification passed, it is sent to the operations and maintenance personnel to instruct them to perform firewall configuration operations. The verification result includes the verified firewall configuration scheme. This method avoids manually writing firewall configuration commands, improving firewall configuration efficiency. Furthermore, pushing the verification result to the operations and maintenance personnel ensures that they have timely access to detailed configuration data, guaranteeing the traceability of the configuration process.

[0163] Figure 4 A schematic diagram of the structure of the firewall configuration generation device provided in the embodiments of this application is shown below. Figure 4 As shown, this application embodiment provides a firewall configuration generation apparatus, the apparatus 40 including:

[0164] The acquisition module 401 is used to acquire configuration request data, which includes application name, deployment park information and deployment environment information.

[0165] Module 402 is used to determine the application to be configured that has not been configured with a firewall address and port, based on the application name;

[0166] The allocation module 403 is used to allocate firewall resources based on the deployment park information and deployment environment information of the application to be configured;

[0167] The sending module 404 is used to send firewall resource information to the configuration requester; the firewall resource information includes: the address to be assigned and the port to be assigned.

[0168] The generation module 405 is used to generate a firewall configuration scheme based on firewall resource information when it receives confirmation information from the configuration requester. The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resources.

[0169] In one possible implementation, the above configuration application data also includes DCPP port data, and the above device further includes: a filtering module 406;

[0170] The determination module 402 is also used to invoke virtual resource allocation rules to determine the corresponding firewall cluster based on the deployment park information and deployment environment information of the application to be configured; the virtual resource allocation rules include: address and port allocation policies predefined based on the deployment park, deployment environment and DCPP ports;

[0171] The filtering module 406 is used to filter unoccupied addresses from the address pool of the firewall cluster as addresses to be allocated.

[0172] The determination module 402 is also used to determine the port to be allocated corresponding to the DCPP port data based on the virtual resource allocation rules.

[0173] In one possible implementation, the determining module 402 is also used to determine the change element information corresponding to each change element field in the change element template based on the firewall resource information.

[0174] Module 405 is specifically used to generate firewall configuration schemes based on change element information and change element templates.

[0175] In one possible implementation, the change element information includes: change execution period, protection strategy configuration, production chain, implementation steps, and verification steps; the above device also includes: filling module 407;

[0176] The determination module 402 is also used to determine the change execution period based on historical business traffic data;

[0177] The determination module 402 is also used to determine the production link based on the application name, DCPP port, and deployment environment information;

[0178] The determination module 402 is also used to determine the corresponding protection policy configuration from the protection policy mapping library based on the application type of the application to be configured;

[0179] The populate module 407 is used to populate the address to be assigned, the port to be assigned, and the production link into the firewall configuration standardization step template in the change element template to obtain the implementation steps;

[0180] The determination module 402 is also used to determine the verification item template based on the application type and deployment environment, and to fill the address to be assigned and the port to be assigned into the verification item template to obtain the verification steps.

[0181] In one possible implementation, the above-mentioned device further includes: an adjustment module 408;

[0182] The acquisition module 401 is also used to acquire the load data of each firewall cluster in the deployment park corresponding to the deployment park information;

[0183] The adjustment module 408 is used to adjust the allocation priority of the addresses corresponding to each firewall cluster based on the load data of each firewall cluster, so as to obtain the adjusted virtual resource allocation rules.

[0184] In one possible implementation, the above-mentioned device further includes: a verification module 409 and a correction module 410;

[0185] The generation module 405 is also used to generate simulated links of production links in the firewall configuration scheme based on the topology database. The topology database is used to store the connection relationships of network devices in each campus.

[0186] The verification module 409 is used to simulate the transmission of traffic in the simulated link, verify the connectivity of the simulated link, and verify the compliance of each changed element information in the firewall configuration scheme based on the preset conflict detection rule base.

[0187] The correction module 410 is used to correct the firewall configuration scheme according to the verification result if the verification result indicates that the verification failed.

[0188] In one possible implementation, the aforementioned conflict detection rule base includes: cross-subnet communication rules, and adjustment module 408, which is also used to adjust the production link based on the transmission break nodes in the verification results and in conjunction with the topology database when the verification results indicate that the simulation link is not connected.

[0189] The correction module 410 is specifically used to reallocate the address to be assigned to the application to be configured when the verification result indicates that it does not conform to the cross-subnet communication rules; or to supplement the cross-subnet routing rules.

[0190] The firewall configuration generation device provided in this application embodiment can be used to execute the technical solution of the firewall configuration generation method in any of the above embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0191] Figure 5 A schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0192] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0193] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0194] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0195] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0196] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0197] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0198] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0199] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0200] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0201] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0202] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0203] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0204] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0205] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0206] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0207] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0208] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0209] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0210] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0211] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0212] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0213] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0214] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for generating firewall configurations, characterized in that, include: Obtain configuration request data, which includes application name, deployment park information, and deployment environment information; Based on the application name, identify the application to be configured that has not been configured with a firewall address and port; Firewall resources are allocated based on the deployment park information and deployment environment information of the application to be configured, and the firewall resource information is sent to the configuration requester. The firewall resource information includes: addresses to be assigned and ports to be assigned; Upon receiving confirmation from the configuration requester, a firewall configuration scheme is generated based on the firewall resource information. The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resource.

2. The method according to claim 1, characterized in that, The configuration request data also includes DCPP port data, and the allocation of firewall resources based on the deployment park information and deployment environment information of the application to be configured includes: The virtual resource allocation rules are invoked to determine the corresponding firewall cluster based on the deployment park information and deployment environment information of the application to be configured; the virtual resource allocation rules include: address and port allocation policies predefined according to the deployment park, deployment environment and DCPP ports; Select unoccupied addresses from the address pool of the firewall cluster as addresses to be allocated; Based on the virtual resource allocation rules, the ports to be allocated corresponding to the DCPP port data are determined.

3. The method according to claim 1, characterized in that, The process of generating a firewall configuration scheme based on the firewall resource information includes: Based on the firewall resource information, determine the change element information corresponding to each change element field in the change element template; Based on the changed element information and the changed element template, a firewall configuration scheme is generated.

4. The method according to claim 3, characterized in that, The change element information includes: change execution period, protection strategy configuration, production chain, implementation steps, and verification steps; the step of determining the change element information corresponding to each change element field in the change element template based on the firewall resource information includes: Determine the time period for implementing the changes based on historical business traffic data; The production link is determined based on the application name, DCPP port, and deployment environment information; Based on the application type of the application to be configured, determine the corresponding protection policy configuration from the protection policy mapping library; The address to be assigned, the port to be assigned, and the production link are filled into the firewall configuration standardization step template in the change element template to obtain the implementation steps; Based on the application type and deployment environment, a verification item template is determined, and the address to be assigned and the port to be assigned are filled into the verification item template to obtain the verification steps.

5. The method according to any one of claims 1-4, characterized in that, Before allocating firewall resources based on the deployment park information and deployment environment information of the application to be configured, the method further includes: Obtain the load data of each firewall cluster in the deployment park corresponding to the deployment park information; Based on the load data of each firewall cluster, the allocation priority of the addresses corresponding to each firewall cluster is adjusted to obtain the adjusted virtual resource allocation rules.

6. The method according to claim 4, characterized in that, The verification steps include: Based on the topology graph database, simulated links for production links in the firewall configuration scheme are generated. The topology graph database is used to store the connection relationships of network devices in each campus. Simulate traffic transmission in the simulated link to verify the connectivity of the simulated link, and verify the compliance of each changed element information in the firewall configuration scheme based on a preset conflict detection rule base. If the verification result indicates that the verification failed, the firewall configuration scheme shall be corrected according to the verification result.

7. The method according to claim 6, characterized in that, The conflict detection rule base includes: cross-subnet communication rules, and the step of correcting the firewall configuration scheme based on the verification results includes: If the verification result indicates that the simulation link is not connected, the production link is adjusted based on the transmission breakpoints in the verification result and in conjunction with the topology database. If the verification result indicates that the cross-subnet communication rule is not met, the application to be configured is reassigned an address; or, cross-subnet routing rules are added.

8. A firewall configuration generation apparatus, characterized in that, include: The acquisition module is used to acquire configuration request data, which includes application name, deployment park information, and deployment environment information. The determination module is used to determine the application to be configured that has not been configured with a firewall address and port, based on the application name; The allocation module is used to allocate firewall resources based on the deployment park information and deployment environment information of the application to be configured; The sending module is used to send firewall resource information to the configuration requester; The firewall resource information includes: addresses to be assigned and ports to be assigned; The generation module is used to generate a firewall configuration scheme based on the firewall resource information when it receives confirmation information from the configuration requester. The firewall configuration scheme is used to indicate the association link between the application to be configured and the firewall resource.

9. An electronic device, characterized in that, include: Memory and processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-7.

Images