Network firewall policy configuration method, device, equipment, medium and product

Abstract

This application provides a method, apparatus, device, medium, and product for configuring network firewall policies, relating to the fields of artificial intelligence or fintech. First, a firewall activation request table containing multiple access control policy requirements is received. Then, each requirement is extracted and processed to obtain corresponding IP information. Next, a policy intermediate representation is generated based on this IP information. Subsequently, policy configuration instructions are generated based on the policy intermediate representation to instruct the target firewall device to perform configuration operations. Finally, the target firewall device is controlled to execute these instructions. This method, by generating a policy intermediate representation and then converting it into policy configuration instructions adapted to different devices, solves the problem of high maintenance costs and low efficiency caused by differences in configuration methods and management rules among firewall devices from different manufacturers, thereby reducing maintenance costs and improving configuration efficiency.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence or financial technology, and in particular to a method, apparatus, device, medium and product for configuring a network firewall policy. Background Technology

[0002] With the rapid development of Internet technology and the continuous expansion of network scale, network attack methods have become increasingly complex and diverse, posing a severe challenge to network security. Firewall devices, as a type of security protection equipment deployed at the network boundary, have emerged to meet this need.

[0003] Most existing firewall policies are configured manually. This means that network administrators manually set access control rules on firewall devices one by one according to the network's security needs and business characteristics, clearly allowing or prohibiting which source addresses, destination addresses, ports, and protocols of data packets to pass through, thereby building the basic framework for network security protection.

[0004] However, this manual configuration method has significant limitations when dealing with firewalls from multiple vendors. Because the command-line interfaces, configuration models, and management APIs of firewalls from different vendors vary greatly, administrators need to learn and adapt to the specific configuration syntax for different devices. This makes unified automated management difficult, significantly increasing operational costs and easily leading to configuration errors due to syntax incompatibility, thus reducing policy deployment efficiency and security. Summary of the Invention

[0005] This application provides a method, apparatus, device, medium, and product for configuring network firewall policies, in order to solve the problem of high maintenance costs and low efficiency when manually configuring firewalls due to differences in configuration methods and management rules among different manufacturers' firewall devices.

[0006] In a first aspect, embodiments of this application provide a method for configuring a network firewall policy, including:

[0007] Receive a firewall access request table, which includes multiple access control policy requirements;

[0008] Each access control policy requirement is extracted to obtain the IP information corresponding to each access control policy requirement;

[0009] Based on the IP information corresponding to each access control policy requirement, generate an intermediate policy representation corresponding to each access control policy requirement;

[0010] Based on the intermediate policy representation corresponding to each access control policy requirement, a policy configuration instruction corresponding to each access control policy requirement is generated. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations.

[0011] Based on the policy configuration instructions corresponding to each access control policy requirement, control the corresponding target firewall device to execute the policy configuration instructions.

[0012] In one possible implementation, each access control policy requirement is extracted to obtain the IP information corresponding to each access control policy requirement, including:

[0013] Based on each access control policy requirement, determine the target firewall device corresponding to each access control policy requirement;

[0014] Based on the configuration information of the target firewall device, conflict verification is performed on each access control policy requirement to obtain the verification result of each access control policy requirement.

[0015] If the verification result of any of the access control policy requirements is successful, each access control policy requirement is extracted according to preset keywords to obtain the IP information corresponding to each access control policy requirement.

[0016] In one possible implementation, the access control policy requirement includes: a service application identifier; and determining the target firewall device corresponding to each access control policy requirement includes:

[0017] Obtain a device resource library, which includes multiple candidate identifiers and a candidate firewall device corresponding to each candidate identifier;

[0018] Based on the business application identifier, a target identifier is determined from a plurality of candidate identifiers;

[0019] The candidate firewall device corresponding to the target identifier is determined as the target firewall device.

[0020] In one possible implementation, the step of performing conflict verification processing on each access control policy requirement based on the configuration information of the target firewall device to obtain the verification result of each access control policy requirement includes:

[0021] For any access control policy requirement, the access control policy requirement is extracted and processed to obtain structured information, which includes at least one of the following: source IP address, destination IP address, source port, destination port, action or protocol information;

[0022] The configuration information of the target firewall device is compared with the structured information to perform conflict verification, thereby obtaining the verification result of the access control policy requirements.

[0023] In one possible implementation, generating an intermediate policy representation corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement includes:

[0024] Based on the IP information corresponding to each access control policy requirement, determine the application category corresponding to each access control policy requirement;

[0025] Based on the application category corresponding to each access control policy requirement, an intermediate policy representation corresponding to each access control policy requirement is generated.

[0026] In one possible implementation, after controlling the corresponding target firewall device to execute the policy configuration instruction according to the policy configuration instruction corresponding to each access control policy requirement, the method further includes:

[0027] Obtain the configuration results of the target firewall device;

[0028] If the configuration result indicates that the configuration is complete, a configuration completion message is generated, which indicates that the target firewall device has completed the configuration of the access control policy requirements.

[0029] In one possible implementation, the method further includes:

[0030] If the verification result of any of the access control policy requirements fails, an alarm message is generated. The alarm message is used to indicate that there is a policy conflict or duplicate configuration of the access control policy requirements.

[0031] Secondly, embodiments of this application provide a network firewall policy configuration apparatus, comprising:

[0032] The receiving module is used to receive a firewall access request table, which includes multiple access control policy requirements.

[0033] The processing module is used to extract and process each of the access control policy requirements to obtain the IP information corresponding to each access control policy requirement;

[0034] The generation module is used to generate an intermediate policy representation corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement.

[0035] The generation module is further configured to generate a policy configuration instruction corresponding to each access control policy requirement based on the policy intermediate representation corresponding to each access control policy requirement. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations.

[0036] The control module is used to control the corresponding target firewall device to execute the policy configuration instructions according to the policy configuration instructions corresponding to each access control policy requirement.

[0037] In one possible implementation, the device further includes: a determining module;

[0038] The determining module is used to determine the target firewall device corresponding to each access control policy requirement based on each access control policy requirement.

[0039] The processing module is used to perform conflict verification processing on each access control policy requirement based on the configuration information of the target firewall device, and obtain the verification result of each access control policy requirement.

[0040] The processing module is specifically used to extract each access control policy requirement according to preset keywords when the verification result of any one of the access control policy requirements is successful, thereby obtaining the IP information corresponding to each access control policy requirement.

[0041] In one possible implementation, the apparatus further includes: an acquisition module;

[0042] The acquisition module is used to acquire a device resource library, which includes multiple candidate identifiers and a candidate firewall device corresponding to each candidate identifier.

[0043] The determining module is further configured to determine a target identifier from a plurality of candidate identifiers based on the business application identifier;

[0044] The determining module is specifically used to determine the candidate firewall device corresponding to the target identifier as the target firewall device.

[0045] In one possible implementation, the processing module is further configured to extract and process any access control policy requirement to obtain structured information, wherein the structured information includes at least one of the following: source IP address, destination IP address, source port, destination port, and action or protocol information.

[0046] The processing module is specifically used to perform conflict verification processing on the configuration information of the target firewall device and the structured information to obtain the verification result of the access control policy requirements.

[0047] In one possible implementation, the determining module is further configured to determine the application category corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement;

[0048] The generation module is specifically used to generate an intermediate representation of the policy corresponding to each access control policy requirement based on the application category corresponding to each access control policy requirement.

[0049] In one possible implementation, the acquisition module is further configured to acquire the configuration result of the target firewall device;

[0050] The generation module is further configured to generate configuration completion information when the configuration result indicates that the configuration is complete. The configuration completion information is used to indicate that the target firewall device has completed the configuration of the access control policy requirements.

[0051] In one possible implementation, the generation module is further configured to generate an alarm message if the verification result of any of the access control policy requirements fails, the alarm message being used to indicate that the access control policy requirements have policy conflicts or duplicate configurations.

[0052] Thirdly, embodiments of this application provide a network firewall policy configuration device, including: a memory and a processor;

[0053] The memory stores computer-executed instructions;

[0054] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0055] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0056] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0057] The network firewall policy configuration method, apparatus, device, medium, and product provided in this application first receive a firewall access control policy requirement table containing multiple access control policy requirements. Then, each requirement is extracted and processed to obtain the corresponding IP information. Next, a policy intermediate representation is generated based on this IP information. Subsequently, policy configuration instructions are generated based on the policy intermediate representation to instruct the target firewall device to perform configuration operations. Finally, the target firewall device is controlled to execute these instructions. This method, by generating a policy intermediate representation and then converting it into policy configuration instructions adapted to different devices, solves the problem of high maintenance costs and low efficiency during manual configuration due to differences in configuration methods and management rules among firewall devices from different manufacturers. This reduces maintenance costs and improves configuration efficiency. Attached Figure Description

[0058] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0059] Figure 1 A flowchart illustrating the configuration method of the network firewall policy provided in this application. Figure 1 ;

[0060] Figure 2 A flowchart illustrating the configuration method of the network firewall policy provided in this application. Figure 2 ;

[0061] Figure 3 A schematic diagram of the configuration device for the network firewall policy provided in this application;

[0062] Figure 4 A schematic diagram of the configuration device for the network firewall policy provided in this application.

[0063] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0064] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0065] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0066] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0067] It should be noted that the network firewall policy configuration methods, devices, equipment, media and products provided in this application can be used in the fields of artificial intelligence or fintech, or in any field other than artificial intelligence or fintech. The application fields of the network firewall policy configuration methods, devices, equipment, media and products in this application are not limited.

[0068] With the rapid development of Internet technology and the continuous expansion of network scale, network attack methods have become increasingly complex and diverse, posing a severe challenge to network security. Firewall devices, as a type of security protection equipment deployed at the network boundary, have emerged to meet this need.

[0069] Most existing firewall policies are configured manually. This means that network administrators manually set access control rules on firewall devices one by one according to the network's security needs and business characteristics, clearly allowing or prohibiting which source addresses, destination addresses, ports, and protocols of data packets to pass through, thereby building the basic framework for network security protection.

[0070] However, this manual configuration method has significant limitations when dealing with firewalls from multiple vendors. Because the command-line interfaces, configuration models, and management APIs of firewalls from different vendors vary greatly, administrators need to learn and adapt to the specific configuration syntax for different devices. This makes unified automated management difficult, significantly increasing operational costs and easily leading to configuration errors due to syntax incompatibility, thus reducing policy deployment efficiency and security.

[0071] The network firewall policy configuration method provided in this application generates an intermediate policy representation and then converts it into policy configuration instructions adapted to different devices. This solves the problem of high maintenance costs and low efficiency caused by differences in configuration methods and management rules among firewall devices from different manufacturers, thereby reducing maintenance costs and improving configuration efficiency.

[0072] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0073] Figure 1 A flowchart illustrating the configuration method of the network firewall policy provided in this application. Figure 1 ,like Figure 1 As shown, the method includes:

[0074] S101. Receive the firewall activation request table, which includes multiple access control policy requirements.

[0075] Access control policy requirements refer to rules requested by users to achieve specific business connectivity or security isolation goals, describing whether to allow or prohibit certain types of network traffic. Access control policy requirements include, but are not limited to: source IP address, destination IP address, protocol type, port number, access direction, and business purpose.

[0076] Understandably, since there are often batch network access control requirements in actual business scenarios, integrating multiple policy requests into one enable request can avoid the inefficient operation of requesting a single policy each time. At the same time, it facilitates unified verification, classification and conversion of batch policies, and adapts to the centralized and automated management of firewalls from multiple vendors.

[0077] The step of receiving firewall activation requests involves the user sending a document containing multiple access control policy requests to the firewall policy management system through a visual configuration interface. The system then filters and extracts the received document to obtain multiple access control policy requirements.

[0078] S102. Extract and process each access control policy requirement to obtain the IP information corresponding to each access control policy requirement.

[0079] The IP information types include IPv4 and IPv6. When IP information is presented in IPv4 format, it can be hierarchically encoded by bytes: the first byte (identifier 1) is used to identify the first-level organization; the second byte (identifier 2) is used to identify the second-level organization; the first four bits of the third byte are used to identify the third-level organization (such as the local area network of the first-level branch business department, the local area network of the second-level branch, and various sub-branches, etc.), and the last four bits of the third byte are used to distinguish the purpose of the address (such as office, production, testing); the fourth byte is used to identify specific office terminals, servers, and other equipment, realizing the location from the organizational level to the specific equipment.

[0080] When IP information is presented in IPv6 format, it can be encoded according to a preset segmentation rule: the first 32 bits are a fixed prefix used to identify the global address space to which the address belongs; bits 33–40 (8 bits) are the address space type used to identify the first-level region; bits 41–48 (8 bits) are the address space type used to identify the sub-region; bits 49–52 (4 bits) are the address space type used for extended classification; bits 53–56 (4 bits) are the address space type used to identify the service type; bits 57–64 (8 bits) are the Info field used to carry additional information; and the last 64 bits are the interface address used to identify the specific network interface or terminal device, realizing hierarchical positioning and management from the address space to the terminal node.

[0081] The purpose of this step is to identify and extract IP address information related to network communication from each access control policy request.

[0082] Understandably, since the original access control policy request may contain a large amount of redundant information such as business descriptions, and firewalls implement access control based on IP addresses, it is necessary to extract the corresponding IP information from the access control policy request to provide the data foundation for subsequently generating policies applicable to firewall devices from different vendors.

[0083] S103. Generate an intermediate representation of the policy corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement.

[0084] Among them, the policy intermediate represents a unified access control policy description language adapted to different firewall devices.

[0085] Understandably, firewall devices from different vendors differ in configuration syntax, rule formats, and policy organization methods. Writing custom policies for each type of firewall device would not only be inefficient but also present significant challenges for subsequent policy maintenance. Therefore, to eliminate configuration differences between devices and achieve unified policy management, an intermediate policy representation adapted to multiple devices can be generated based on access control policy requirements. This enables automated operation and maintenance, allowing for one-time policy definition and multi-device deployment, effectively improving the efficiency, accuracy, and scalability of policy management.

[0086] S104. Based on the intermediate policy representation corresponding to each access control policy requirement, generate a policy configuration instruction corresponding to each access control policy requirement. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations.

[0087] In this step, for example, the exclusive configuration template matching the target firewall device can be determined first based on the target firewall device corresponding to each access control policy requirement; then, the intermediate representation of the policy corresponding to each access control policy requirement is matched with the exclusive configuration template in terms of format and rules; finally, based on the matching results, policy configuration instructions that can be directly executed by the target firewall device for each access control policy requirement are generated.

[0088] Understandably, the intermediate policy representation is a unified description language adapted to different firewall devices, not a native configuration command that can be directly executed by a particular device. Different firewall devices have their own proprietary configuration syntax, rule formats, and execution logic, making it impossible to directly recognize the unified intermediate policy representation. Therefore, the intermediate policy representation corresponding to each access control policy requirement can be used as a basis, combined with the configuration specifications of the target firewall device, to generate native policy configuration commands adapted to the corresponding target firewall device. This allows the standardized policy description to adapt to the specific device's configuration requirements.

[0089] S105. Based on the policy configuration instructions corresponding to each access control policy requirement, control the corresponding target firewall device to execute the policy configuration instructions.

[0090] The purpose of this step is to send the policy configuration instructions adapted to the target firewall device to the corresponding device and drive the device to execute the instructions to complete the actual configuration of the access control policy on the target firewall device.

[0091] Understandably, since policy configuration instructions are operation instructions that are adapted to the specific configuration specifications of the target firewall device and can be directly recognized and executed by the device, the corresponding target firewall device can be controlled to execute the instruction based on the policy configuration instructions corresponding to each access control policy requirement. This solves the problem of cumbersome and inefficient configuration operations for firewall devices from multiple vendors, while effectively ensuring the accuracy and consistency of policy configuration.

[0092] The network firewall policy configuration method provided in this application embodiment first receives a firewall enabling requirement table containing multiple access control policy requirements; then extracts information from each requirement to obtain its corresponding IP information; next, generates a unified policy intermediate representation based on the IP information; then converts the intermediate representation into a policy configuration instruction adapted to the target firewall device; finally, drives the corresponding target firewall device to automatically complete the policy configuration through the instruction.

[0093] This method decouples business requirements from underlying devices by introducing a vendor-independent intermediate policy representation. During the policy generation phase, it shields the differences between firewalls from different vendors in terms of configuration syntax, management interfaces, and rule models. This effectively solves the problems of high operation and maintenance costs, low configuration efficiency, and easy errors caused by device heterogeneity in traditional manual configuration, and realizes efficient, accurate, and cross-platform automated deployment of firewall policies.

[0094] Figure 2 A flowchart illustrating the configuration method of the network firewall policy provided in this application. Figure 2 ,like Figure 2 As shown, in this embodiment... Figure 1 Based on the examples, the configuration method of network firewall policies is described in detail, including:

[0095] S201. Receive the firewall activation request table, which includes multiple access control policy requirements.

[0096] For an explanation of step S201, please refer to the explanation of the above embodiments.

[0097] S202. Based on each access control policy requirement, determine the target firewall device corresponding to each access control policy requirement.

[0098] The purpose of this step is to determine which firewall device each access control policy requirement should be deployed on.

[0099] Understandably, in a network architecture, different firewall devices are deployed in different locations and perform different security protection duties. For example, firewall device A is deployed at the boundary of the enterprise's internal network to defend against external network attacks and protect the internal network security; firewall device B is deployed at the front end of a specific business system and is specifically responsible for controlling the network access behavior of that business system.

[0100] Each access control policy requirement is formulated based on specific network security needs and business scenarios. Only by deploying it to the appropriate target firewall device can the policy fully realize its potential. If a policy is deployed incorrectly to another device, it may become ineffective, failing to achieve the expected security protection, and could even disrupt normal business network communications, causing unnecessary trouble and losses. Therefore, it is necessary to determine the corresponding target firewall device for each access control policy requirement.

[0101] Optionally, this application provides a possible implementation method, including:

[0102] The first step is to obtain the device resource library, which includes multiple candidate identifiers and the candidate firewall devices corresponding to each candidate identifier.

[0103] The candidate identifier is used to uniquely identify each candidate firewall device in the device resource pool. The candidate identifier can be, for example, a number, a letter, a string, or a combination of numbers, letters, and strings.

[0104] Business application identifiers are characteristic information included in access control policy requirements, used to uniquely identify the specific business object served by the policy requirement, such as a production server cluster, network device management system, load balancer node, or other specific network resources or business modules.

[0105] Understandably, by obtaining the device resource library, multiple available firewall devices can be identified, providing a basis for subsequently determining the firewall devices that match the access control policy requirements.

[0106] This step of obtaining the device resource library can be done, for example, by retrieving it from the database in the firewall policy management system or from the log records of the firewall policy management system. This application does not impose any special restrictions on this.

[0107] The second step is to determine the target identifier from multiple candidate identifiers based on the business application identifier.

[0108] The purpose of this step is to determine a unique target identifier that matches the business application identifier associated with the current access control policy requirements from multiple candidate identifiers.

[0109] Understandably, firstly, the business application identifier in the access control policy requirements and each candidate identifier in the device resource library are processed in a structured manner to ensure that they are consistent in naming format, encoding specifications or semantic structure; secondly, the processed business application identifier and each candidate identifier are converted into semantic vectors respectively, and the semantic similarity between them is calculated; finally, the candidate identifier with the highest similarity is determined as the target identifier.

[0110] The third step is to identify the candidate firewall device corresponding to the target identifier as the target firewall device.

[0111] The purpose of this step is to match the filtered and confirmed target identifiers with their corresponding candidate firewall devices, thereby identifying the specific firewall device used to implement the access control policy.

[0112] S203. Based on the configuration information of the target firewall device, perform conflict verification processing on each access control policy requirement to obtain the verification result of each access control policy requirement.

[0113] The verification results include: verification passed and verification failed. Verification passed means that the access control policy requirement to be configured does not conflict with the existing configuration information of the target firewall device, and there is no duplicate content. Verification failed means that the access control policy requirement to be configured has problems such as rule contradictions, permission conflicts, or duplicate content with the existing configuration information of the target firewall device.

[0114] The purpose of this step is to identify conflicts or duplicates between access control policy requirements and the existing configuration of the target firewall device in advance, and to filter out invalid or contradictory policy requests.

[0115] This is understandable, because the target firewall device already has effective access control rules deployed. If a newly submitted policy request contradicts existing rules—for example, if the existing policy prohibits access from a certain IP range, while the new policy allows access from that IP range—directly issuing the policy would lead to rule conflicts and cause network access logic chaos. Therefore, it is necessary to perform conflict verification processing on each access control policy request based on the target firewall device's configuration information to obtain the verification result for each access control policy request.

[0116] Optionally, this application provides a possible implementation method, including:

[0117] The first step is to extract and process any access control policy requirement to obtain structured information. The structured information includes at least one of the following: source IP address, destination IP address, source port, destination port, and action or protocol information.

[0118] The purpose of this step is to transform the original access control policy requirements into easily processed structured information.

[0119] Understandably, the original access control policy requirements are mostly descriptive information tailored to business scenarios, such as ports from zone A to zone B. These requirements have inconsistent formats and contain redundant content, making them impossible for the firewall policy management system to directly recognize and process. However, source IP address, destination IP address, source port, destination port, action or protocol information are essential elements for firewall policy configuration. Therefore, it is necessary to extract and process the access control policy requirements to obtain structured information.

[0120] The second step is to perform conflict verification between the configuration information and structured information of the target firewall device to obtain the verification result of the access control policy requirements.

[0121] The configuration information of the target firewall device refers to all access control policies currently deployed on the device. Configuration information may include, for example, a list of existing rules (each rule includes source IP, destination IP, source / destination port, protocol, action, effective time, priority, etc.) and default security policies (such as "default deny" or "default allow").

[0122] Understandably, before deploying a new firewall policy on a target firewall device, comparing the target firewall's current configuration information with the structured information of the policy to be added can help identify potential logical conflicts, security risks, or configuration redundancies in advance. This ensures that the new policy can meet business needs without disrupting the existing security architecture or causing network anomalies.

[0123] S204. If the verification result of any access control policy requirement is successful, extract and process each access control policy requirement according to the preset keywords to obtain the IP information corresponding to each access control policy requirement.

[0124] The preset keywords are defined based on common ways of expressing IP information in access control policy requirements. For example, for a source IP address, the preset keywords can be source IP, initiator IP, or originating IP; for a destination IP address, the preset keywords can be destination IP, recipient IP, or target IP.

[0125] Understandably, if the access control policy requirement fails validation, it indicates a conflict between the policy requirement and the existing configuration of the target firewall device, making IP information extraction unusable. Only when validation passes is the policy requirement considered feasible and compliant with network environment requirements. Extracting the IP information corresponding to each access control policy requirement using preset keywords ensures that the extracted IP information is relevant to the actually implementable policy.

[0126] Optionally, if the verification result of any access control policy requirement fails, this application provides a possible implementation method, including: generating an alarm message, which is used to indicate that there is a policy conflict or duplicate configuration in the access control policy requirement.

[0127] The purpose of this step is to promptly report any issues with access control policy requirements to relevant personnel, preventing conflicting or incorrectly configured policies from being applied to firewall devices, thereby ensuring the effectiveness and stability of network security policies.

[0128] This step generates alarm notifications in various ways, such as through a visual configuration interface on a client application with a firewall policy management system, allowing network administrators to see the alarm notifications on the interface; automatically sending alarm notifications to designated email addresses of relevant personnel; or sending alarm notifications via SMS to the mobile phones of relevant personnel in a timely manner. This application does not impose any special restrictions on this.

[0129] S205. Based on the IP information corresponding to each access control policy requirement, determine the application category corresponding to each access control policy requirement.

[0130] Application category refers to the classification label based on the business scenario corresponding to the IP information, which is used to identify the type of business carried by the IP address. For example, it can be divided into office, production and testing categories.

[0131] Understandably, since IP addresses only serve a network location function and cannot directly reflect the business attributes they carry, different application categories have different security control requirements. For example, production applications require stricter access restrictions, while office applications need to balance convenience and security. Therefore, determining the application category through IP information allows for the configuration of security policies tailored to different application scenarios.

[0132] S206. Generate an intermediate policy representation for each access control policy requirement based on the application category corresponding to each access control policy requirement.

[0133] Understandably, since firewall devices from different vendors have their own proprietary configuration specifications and command execution logic, generating a unified policy description language based on the application category corresponding to the access control policy requirements can ensure that the policy can be accurately parsed and correctly executed on various firewall devices. This achieves the goal of automated operation and maintenance, enabling policies to be defined once and deployed across multiple platforms, effectively improving the efficiency, accuracy, and scalability of firewall policy management.

[0134] S207. Based on the intermediate policy representation corresponding to each access control policy requirement, generate a policy configuration instruction corresponding to each access control policy requirement. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations.

[0135] For an explanation of step S207, please refer to the explanation of the above embodiments, and this application will not repeat it here.

[0136] S208. Based on the policy configuration instructions corresponding to each access control policy requirement, control the corresponding target firewall device to execute the policy configuration instructions.

[0137] The explanation of step S208 is the same as that in the above embodiments, and will not be repeated here.

[0138] S209. Obtain the configuration results of the target firewall device.

[0139] The configuration results include: configuration successful and configuration failed. A successful configuration indicates that the target firewall device has successfully applied the sent configuration commands and that the corresponding access control policies have taken effect. A configuration failed indicates that the target firewall device failed to execute the configuration.

[0140] The purpose of this step is to obtain the target firewall device's configuration of access control policies.

[0141] Understandably, issuing policy configuration commands does not equate to the policy successfully taking effect on the device. The target firewall device may fail to execute the configuration due to reasons such as command format discrepancies, its own operational malfunctions, or network communication problems. Therefore, it is necessary to obtain the configuration results from the target firewall device to confirm whether the policy configuration commands have been successfully applied.

[0142] S210. If the configuration result indicates that the configuration is complete, generate configuration completion information. The configuration completion information is used to indicate that the target firewall device has completed the configuration of the access control policy requirements.

[0143] Understandably, after the target firewall device completes the configuration of the access control policy requirements, generating configuration completion information allows relevant personnel (such as network administrators, system maintenance personnel, etc.) to know in a timely manner that the configuration operation has been successfully completed.

[0144] This step generates configuration completion information in various ways, such as through a visual configuration interface on a client application with a firewall policy management system, allowing network administrators to see the configuration completion information on the interface; it can also be sent automatically via email to designated email addresses of relevant personnel; or it can be sent via SMS notification to the mobile phones of relevant personnel in a timely manner. This application does not impose any special restrictions on this.

[0145] The network firewall policy configuration method provided in this application embodiment first receives a firewall enabling requirement table containing multiple access control policy requirements, then determines the corresponding target firewall device for each requirement; performs conflict verification on the requirements based on the target firewall device configuration information, and extracts the IP information of the requirements according to preset keywords after the verification passes; determines the application category based on the IP information, and then generates an intermediate policy representation, and then generates a policy configuration instruction to instruct the target firewall device to perform configuration operations; subsequently controls the target firewall device to execute the instruction and obtains the configuration result, and generates configuration completion information if the result indicates that the configuration is complete.

[0146] This method generates a unified intermediate policy representation, transforming access control policy requirements under different business scenarios into standardized descriptions adapted to firewall devices from different vendors, and then converting them into native configuration instructions for each device. This solves the problem of high maintenance costs and low efficiency in manual configuration caused by differences in configuration methods and management rules among firewall devices from different vendors. It achieves automation and standardization of firewall policy configuration, effectively reducing maintenance costs and improving configuration efficiency and accuracy.

[0147] Figure 3 A schematic diagram of the configuration device for the network firewall policy provided in this application is shown below. Figure 3 As shown, the network firewall policy configuration device 300 provided in this embodiment includes:

[0148] The receiving module 301 is used to receive the firewall access request table, which includes multiple access control policy requirements.

[0149] Processing module 302 is used to extract and process each access control policy requirement to obtain the IP information corresponding to each access control policy requirement;

[0150] The generation module 303 is used to generate an intermediate representation of the policy corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement.

[0151] The generation module 303 is also used to generate a policy configuration instruction corresponding to each access control policy requirement based on the policy intermediate representation corresponding to each access control policy requirement. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations.

[0152] The control module 304 is used to control the corresponding target firewall device to execute the policy configuration instructions according to the policy configuration instructions corresponding to each access control policy requirement.

[0153] In one possible implementation, the device further includes: a determining module 305;

[0154] The determination module 305 is used to determine the target firewall device corresponding to each access control policy requirement based on each access control policy requirement.

[0155] The processing module 302 is used to perform conflict verification processing on each access control policy requirement based on the configuration information of the target firewall device, and obtain the verification result of each access control policy requirement.

[0156] The processing module 302 is specifically used to extract and process each access control policy requirement according to preset keywords when the verification result of any access control policy requirement is successful, so as to obtain the IP information corresponding to each access control policy requirement.

[0157] In one possible implementation, the device further includes: an acquisition module 306;

[0158] The acquisition module 306 is used to acquire a device resource library, which includes multiple candidate identifiers and a candidate firewall device corresponding to each candidate identifier.

[0159] The determination module 305 is also used to determine the target identifier from multiple candidate identifiers based on the business application identifier;

[0160] The determination module 305 is specifically used to determine the candidate firewall device corresponding to the target identifier as the target firewall device.

[0161] In one possible implementation, the processing module 302 is further configured to extract and process the access control policy requirement for any access control policy requirement to obtain structured information, the structured information including at least one of the following: source IP address, destination IP address, source port, destination port, action or protocol information.

[0162] The processing module 302 is specifically used to perform conflict verification processing on the configuration information and structured information of the target firewall device to obtain the verification result of the access control policy requirements.

[0163] In one possible implementation, the determining module 305 is further configured to determine the application category corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement.

[0164] The generation module 303 is specifically used to generate an intermediate representation of the policy corresponding to each access control policy requirement based on the application category corresponding to each access control policy requirement.

[0165] In one possible implementation, the acquisition module 306 is further configured to acquire the configuration results of the target firewall device;

[0166] The generation module 303 is also used to generate configuration completion information when the configuration result indicates that the configuration is complete. The configuration completion information is used to indicate that the target firewall device has completed the configuration of the access control policy requirements.

[0167] In one possible implementation, the generation module 303 is further configured to generate an alarm message when the verification result of any access control policy requirement fails. The alarm message is used to indicate that there is a policy conflict or duplicate configuration in the access control policy requirement.

[0168] The network firewall policy configuration device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0169] Figure 4 A schematic diagram of the configuration device for the network firewall policy provided in this application. Figure 4 As shown, the electronic device 400 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 400 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0170] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0171] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0172] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0173] The memory may include high-speed memory (Random Access Memory, RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0174] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0175] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0176] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0177] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0178] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application-Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0179] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0180] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0181] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0182] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0183] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0184] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for configuring a network firewall policy, characterized in that, The method includes: Receive a firewall access request table, which includes multiple access control policy requirements; Each access control policy requirement is extracted to obtain the IP information corresponding to each access control policy requirement; Based on the IP information corresponding to each access control policy requirement, generate an intermediate policy representation corresponding to each access control policy requirement; Based on the intermediate policy representation corresponding to each access control policy requirement, a policy configuration instruction corresponding to each access control policy requirement is generated. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations. Based on the policy configuration instructions corresponding to each access control policy requirement, control the corresponding target firewall device to execute the policy configuration instructions.

2. The method according to claim 1, characterized in that, The step of extracting each access control policy requirement to obtain the IP information corresponding to each access control policy requirement includes: Based on each access control policy requirement, determine the target firewall device corresponding to each access control policy requirement; Based on the configuration information of the target firewall device, conflict verification is performed on each access control policy requirement to obtain the verification result of each access control policy requirement. If the verification result of any of the access control policy requirements is successful, each access control policy requirement is extracted according to preset keywords to obtain the IP information corresponding to each access control policy requirement.

3. The method according to claim 2, characterized in that, The access control policy requirements include: a business application identifier; determining the target firewall device corresponding to each access control policy requirement based on each access control policy requirement includes: Obtain a device resource library, which includes multiple candidate identifiers and a candidate firewall device corresponding to each candidate identifier; Based on the business application identifier, a target identifier is determined from a plurality of candidate identifiers; The candidate firewall device corresponding to the target identifier is determined as the target firewall device.

4. The method according to claim 2, characterized in that, Based on the configuration information of the target firewall device, conflict verification is performed on each access control policy requirement to obtain a verification result for each access control policy requirement, including: For any access control policy requirement, the access control policy requirement is extracted and processed to obtain structured information, which includes at least one of the following: source IP address, destination IP address, source port, destination port, action or protocol information; The configuration information of the target firewall device is compared with the structured information to perform conflict verification, thereby obtaining the verification result of the access control policy requirements.

5. The method according to claim 1, characterized in that, The step of generating an intermediate policy representation for each access control policy requirement based on the IP information corresponding to each access control policy requirement includes: Based on the IP information corresponding to each access control policy requirement, determine the application category corresponding to each access control policy requirement; Based on the application category corresponding to each access control policy requirement, an intermediate policy representation corresponding to each access control policy requirement is generated.

6. The method according to claim 2, characterized in that, After controlling the corresponding target firewall device to execute the policy configuration instruction according to the policy configuration instruction corresponding to each access control policy requirement, the method further includes: Obtain the configuration results of the target firewall device; If the configuration result indicates that the configuration is complete, a configuration completion message is generated, which indicates that the target firewall device has completed the configuration of the access control policy requirements.

7. The method according to claim 2, characterized in that, The method further includes: If the verification result of any of the access control policy requirements fails, an alarm message is generated. The alarm message is used to indicate that there is a policy conflict or duplicate configuration of the access control policy requirements.

8. A network firewall policy configuration device, characterized in that, include: The receiving module is used to receive a firewall access request table, which includes multiple access control policy requirements. The processing module is used to extract and process each of the access control policy requirements to obtain the IP information corresponding to each access control policy requirement; The generation module is used to generate an intermediate policy representation corresponding to each access control policy requirement based on the IP information corresponding to each access control policy requirement. The generation module is further configured to generate a policy configuration instruction corresponding to each access control policy requirement based on the policy intermediate representation corresponding to each access control policy requirement. The policy configuration instruction is used to instruct the target firewall device corresponding to the access control policy requirement to perform firewall policy configuration operations. The control module is used to control the corresponding target firewall device to execute the policy configuration instructions according to the policy configuration instructions corresponding to each access control policy requirement.

9. A device for configuring network firewall policies, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images