CN112217773B - Firewall rule processing method, device and storage medium - Google Patents

Abstract

The invention discloses a firewall rule processing method. Based on information carried by a first firewall rule, the priority of the first firewall rule in a target firewall rule list is determined; priority in the list, insert the first firewall rule into the target firewall rule list. The invention also discloses a firewall rule processing device and a storage medium at the same time. Here, according to the inserted priority of the first firewall rule, the priorities of other firewall rules in the target firewall rule list can be adjusted accordingly to obtain an adjusted target firewall rule list. It can be seen that the insertion process of the firewall rules is simplified, and the efficiency of the maintenance process of the firewall rules is improved.

Description

Firewall rule processing method, device and storage medium

technical field

The present invention relates to the field of information processing, and in particular, to a method, device and storage medium for processing firewall rules.

Background technique

In the prior art, the firewall rule list is often stored in the firewall device, and the firewall rules are stored in different intervals. When a new firewall rule is inserted into the firewall rule list or a firewall rule is deleted from the firewall rule list, it may cause many problems. A firewall rule is migrated to a new range, and the maintenance process of the firewall rule list is relatively complicated.

In addition, if the terminal device wants to obtain the firewall rule list, it needs to send a request message to the firewall operation platform, and then the firewall operation platform sends the request message to the firewall device. After receiving the firewall rule list fed back by the firewall device, the firewall operation platform sorts the firewall rule list before sending it to the terminal device. It can be seen that the entire interaction process is complex and the response time is long.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention are expected to provide a firewall rule processing method, device, and storage medium, aiming at solving the above-mentioned problems existing in the prior art.

In order to achieve the above-mentioned purpose, the technical scheme of the embodiment of the present invention is realized as follows:

An embodiment of the present invention provides a firewall rule processing method, the method includes:

Based on the information carried by the first firewall rule, determine the priority of the first firewall rule in the target firewall rule list; wherein the information carried by the first firewall rule includes at least the next firewall rule of the first firewall rule The identification (ID) information of the first firewall rule, and the state information of the previous firewall rule of the first firewall rule;

Inserting the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

In the above scheme, the method also includes:

Based on the information carried by the first firewall rule, the arrangement position of the first firewall rule in the target firewall rule list is determined.

In the above scheme, the method also includes:

When the target firewall rule list contains at least one other firewall rule except the first firewall rule, adjust the at least one other firewall rule in the target firewall rule list according to the priority of the first firewall rule The priority of the firewall rule.

In the above scheme, the method also includes:

Delete the second firewall rule from the target firewall rule list. In the above scheme, the method also includes:

When the target firewall rule list includes at least one remaining firewall rule except the second firewall rule, adjust the at least one item in the target firewall rule list according to the priority of the second firewall rule The priority of the remaining firewall rules.

In the above scheme, the method also includes:

receiving a request from a terminal device to access the target firewall rule list;

According to the request, the target firewall rule list is pushed to the terminal device.

The embodiment of the present invention further provides a firewall rule processing device, the device includes: a first determination module and an insertion module; wherein,

the first determining module, configured to determine the priority of the first firewall rule in the target firewall rule list based on information carried by the first firewall rule;

Wherein, the information carried by the first firewall rule includes at least the ID information of the next firewall rule of the first firewall rule and the state information of the previous firewall rule of the first firewall rule;

The inserting module is configured to insert the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

In the above solution, the apparatus further includes a second determination module configured to determine the arrangement position of the first firewall rule in the target firewall rule list based on the information carried by the first firewall rule.

In the above solution, the device further includes a first adjustment module for, when the target firewall rule list contains at least one other firewall rule except the first firewall rule, according to the priority of the first firewall rule. level, and adjust the priority of the at least one other firewall rule in the target firewall rule list.

In the above solution, the apparatus further includes a deletion module configured to delete the second firewall rule from the target firewall rule list.

In the above solution, the device further includes a second adjustment module for, when the target firewall rule list contains at least one remaining firewall rule except the second firewall rule, according to the priority of the second firewall rule. level, and adjust the priority of the at least one remaining firewall rule in the target firewall rule list.

In the above solution, the apparatus further includes a push module configured to receive a request from a terminal device to access the target firewall rule list; and push the target firewall rule list to the terminal device according to the request.

An embodiment of the present invention further provides a storage medium on which an executable program is stored, and when the executable program is executed by a processor, the steps in the foregoing technical solutions are implemented.

An embodiment of the present invention further provides an apparatus for processing firewall rules, including a memory, a processor, and an executable program stored in the memory and capable of being run by the processor, wherein the processor runs the executable program When performing the steps in the above technical solutions.

In the firewall rule processing method, device, and storage medium provided by the embodiments of the present invention, the firewall operation platform determines the priority of the first firewall rule in the target firewall rule list according to the information carried by the first firewall rule; The priority of the firewall rule in the target firewall rule list, and the first firewall rule is inserted into the target firewall rule list. Specifically, when the first firewall rule is inserted into the target firewall rule list, the firewall operation platform can directly control other firewalls in the target firewall rule list only according to the priority of the inserted first firewall rule. The priority of the rule is adjusted accordingly, and the adjusted target firewall rule list can be obtained. That is to say, the firewall rule list can be adjusted according to the priority adjustment of the firewall rules, and there is no need for other firewall rules in the firewall rule list to change the interval due to the adjustment of the priority, which improves the efficiency of the firewall rule maintenance process. , while simplifying maintenance procedures for firewall rules. In addition, the firewall operation platform completes the maintenance process of the firewall rule list, and sends the adjusted firewall rule list to the terminal device, which simplifies the interaction process with the terminal device and shortens the response time.

Description of drawings

FIG. 1 is a schematic flowchart of an implementation of a firewall rule processing method according to an embodiment of the present invention;

2 is a schematic structural diagram of a firewall rule list according to an embodiment of the present invention;

3 is a schematic flowchart of a firewall rule list acquisition process according to an embodiment of the present invention;

4 is a schematic diagram of a process of inserting a firewall rule into a firewall rule list according to an embodiment of the present invention;

Fig. 5 is a schematic diagram of a flow chart for obtaining a firewall rule list in the prior art;

6 is a schematic diagram of a firewall rule storage structure in the prior art;

7 is a schematic diagram of a process of deleting a firewall rule from a firewall rule list according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a composition structure of a firewall rule processing apparatus according to an embodiment of the present invention;

FIG. 9 is a schematic diagram of a hardware structure of a firewall rule processing apparatus according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Embodiment 1.

In this embodiment of the present invention, a schematic diagram of the implementation flow of the firewall rule processing method is shown in FIG. 1 , including the following steps:

Step 101: Based on the information carried by the first firewall rule, determine the priority of the first firewall rule in the target firewall rule list; wherein, the information carried by the first firewall rule includes at least the following parameters of the first firewall rule. Identification ID information of a firewall rule and state information of the previous firewall rule of the first firewall rule;

Step 102: Insert the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

In step 101 in this embodiment of the present invention, the information carried by the first firewall rule includes at least ID information of the first firewall rule, ID information of a firewall rule following the first firewall rule, and the State information of the previous firewall rule of the first firewall rule. Further, information such as the ID information of the first firewall rule, the ID information of the next firewall rule of the first firewall rule, and the status information of the previous firewall rule of the first firewall rule can also be stored in the cloud. In the database of the platform, when the first firewall rule is inserted into the target firewall list, the firewall operation platform is fetched from the database of the cloud platform. The cloud platform generally refers to a cloud that can be used by a third-party provider, generally available through the Internet, and can provide services in today's entire open public network. A firewall rule is a cloud host access control policy based on an Internet Protocol (Internet Protocol, IP) address and port. Therefore, reasonable setting of firewall rules can greatly improve the security of cloud hosts, and at the same time, firewalls can be used to implement network access control between different projects.

Further, as shown in FIG. 2 , each firewall rule in the firewall rule list includes the ID information of the last firewall rule and its own ID information. For example, firewall rule 1 contains the ID information of firewall rule 2 and its own ID information. Then, it can be known that the last firewall rule of firewall rule 2 is firewall rule 3, and similarly, the last firewall rule of firewall rule 3 is firewall rule 4. In this way, the priority order of the firewall rule list can be maintained according to the information carried by the firewall rules.

Further, when the firewall operation platform obtains the information carried by the first firewall rule, it can determine the ID information of the next firewall rule of the first firewall rule, the ID information of the first firewall rule, and the first firewall rule. The priority field of the firewall rule can determine the priority of the first firewall rule in the target firewall rule list.

In step 102, the first firewall rule is the firewall rule to be inserted into the firewall rule list. According to the priority field of the first firewall rule, its priority can be specified. If there is no firewall rule in the target firewall rule list, the first firewall rule is directly inserted into the target firewall rule list, and the priority is 1, that is, the priority is the highest. If the target firewall rule list contains at least one other firewall rule except the first firewall rule, then insert the first firewall rule into the target firewall rule list, and perform an analysis on the target firewall rule list. The priority of the at least one other firewall rule in is adjusted. The priority of each firewall rule in the target firewall rule list is different.

Further, according to the priority of the first firewall rule, adjusting the priority of the at least one other firewall rule in the target firewall rule list includes:

If the priority of the first firewall rule in the target firewall rule list is the lowest, the priority of the at least one other firewall rule in the target firewall rule list remains unchanged;

If the priority of the first firewall rule in the target firewall rule list is the highest, the priority of the at least one other firewall rule in the target firewall rule list is increased by 1;

If the priority of the first firewall rule in the target firewall rule list is in the middle, the priority in the target firewall rule list is higher than the priority of the previous firewall rule of the first firewall rule. The priority of the firewall rule is incremented by 1.

Further, the firewall operation platform may determine the arrangement position of the first firewall rule in the target firewall rule list based on the information carried by the first firewall rule. specific:

If the information carried by the first firewall rule is that the ID information of the next firewall rule is empty and the previous firewall rule is not empty, then the first firewall is ranked at the end of the target firewall rule list;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is empty and the previous firewall rule is empty, the target firewall list is empty, and the first firewall is in the target firewall rule list. the first rule;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is not empty and the previous firewall rule is empty, then the first firewall is ranked first in the target firewall rule list;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is not empty and the previous firewall rule is not empty, the first firewall is ranked in the middle of the target firewall rule list.

Further, the process of inserting the first firewall rule into the target firewall rule list is completed in the firewall operation platform. As shown in FIG. 3 , the firewall operation platform receives the request sent by the terminal device to access the firewall rule list, and pushes the firewall rule list to the terminal device.

The process of inserting firewall rule A into target firewall rule list B will be described in detail below with reference to an example.

As shown in Figure 4, when the identification information of the latter firewall rule is empty, and the preceding firewall rule of firewall rule A is not empty, then firewall rule A is ranked last in target firewall rule list B with the lowest priority. Then, the firewall operation platform sets the identification information of the last firewall rule of the preceding firewall rule of firewall rule A as the identification information of firewall rule A, and adds 1 to the priority of the preceding firewall rule of firewall rule A as the priority of firewall rule A. ;

When the identification information of the latter firewall rule is empty, and the preceding firewall rule of firewall rule A is empty, the target firewall rule list B is empty, that is, firewall rule A is the first rule. Then, the firewall operation platform sets the priority of firewall rule A to 1;

When the identification information of the latter firewall rule is not empty and the preceding firewall rule of firewall rule A is empty, then firewall rule A is the rule with the highest priority. Then, the firewall operation platform updates the priority of all firewall rules in the target firewall rule list B, plus 1, and then sets the priority of firewall rule A to 1;

When the identification information of the latter firewall rule is not empty and the preceding firewall rule of firewall rule A is not empty, then the insertion sequence of firewall rule A is in the middle of the target firewall rule list B, then the firewall operation platform sets firewall rule A The identification information of the last firewall rule of the preceding firewall rule is set to the identification information of firewall rule A, and the priority of all firewall rules whose update priority is greater than the priority of the preceding firewall rule of firewall rule A is increased by 1, and the priority of firewall rule A is set. The priority is the priority of the preceding firewall rule of firewall rule A plus 1.

Among them, the firewall rule with priority 1 in the firewall rule list B has the highest priority, and the larger the value, the lower the priority.

Here, compared with the technical solutions of the embodiments of the present invention, when multiple firewall rules are set for the same IP in the prior art, the priority of the set firewall rules can be set. As shown in Figure 5, when the firewall rules are displayed to the terminal device, the firewall rule list is obtained from the firewall device instead of the firewall operation platform side. After the firewall rule list reaches the firewall operation platform side, the firewall operation platform is added to the firewall rules if necessary. Additional information on the side. For example, the resource information bound to the IP in the firewall rule. Finally, sort the priority of firewall rules and return to the page for display. The entire process needs to sort and prioritize the firewall rules returned by the firewall device, and add rule information on the firewall operation platform side.

As shown in FIG. 6 , in the prior art solution, firewall rules are stored in the hardware of the device layer. By partitioning hardware devices into sequential intervals, firewall rules are stored in these intervals, maintaining the priority order of firewall rules. New firewall rules are inserted into different zones according to their priorities. When the number of firewall rules in a zone to be inserted by a firewall rule reaches the maximum value, all firewall rules with a lower priority than the firewall rules in the zone need to be backward. Move an interval to make room for the new firewall rule to be inserted.

It can be seen that the firewall rules are stored on the firewall device side. To obtain the firewall rule list, the terminal device needs to exchange information with the firewall operation platform and the firewall device side. The firewall operation platform sets the order of the firewall rule list and sends it to the terminal device. The terminal device obtains a lot of interactive information about the firewall rule list, and the request chain is long. In addition, when inserting or deleting firewall rules from the firewall rule list, the priority order of the firewall rules needs to be maintained on the firewall operation platform side. When a new firewall rule is inserted, the firewall rules in multiple sections may be changed, and the firewall rule insertion process is relatively complicated and inefficient.

It can be seen that in the above-mentioned prior art, the terminal device needs to interact with the firewall operation platform and the firewall device to obtain the firewall rule list. In addition, in the process of inserting the firewall rule into the firewall rule list or deleting the firewall rule from the firewall rule list, it is necessary to adjust the interval of the firewall rule in the firewall list. In the above-mentioned prior art, it is impossible to adjust the priority of other firewall rules in the firewall rule list only according to the priority of the inserted firewall rule, and obtain the adjusted firewall rule list. At the same time, the firewall rule list cannot be saved in the firewall operation platform, so that the terminal device can obtain the firewall rule list only by interacting with the firewall operation platform.

However, in this embodiment, the process of inserting the firewall rules into the firewall rule list is implemented on the firewall operation platform. Specifically, by adding a priority field to the first firewall rule, the priority of the first firewall rule in the target firewall list is directly determined according to the information carried by the first firewall rule. The firewall operation platform correspondingly adjusts the priorities of other firewall rules in the target firewall rule list according to the priority of the first firewall rule. And there is no need to readjust the storage interval for each firewall rule in the firewall rule list. It can be seen that the process of inserting firewall rules is simplified. Further, the firewall operation platform directly pushes the target firewall rule list inserted into the first firewall rule to the terminal device, which simplifies the interaction process with the terminal device.

Embodiment two,

In this embodiment, the process of deleting the firewall rule from the firewall rule list by the firewall operation platform is described in detail.

Here, when the firewall operation platform needs to delete the firewall rule from the firewall rule list, the following situations will occur. Specifically, when the target firewall rule list only contains the second firewall rule, then after deleting the second firewall rule, the target firewall rule list is empty; when the target firewall rule list When at least one remaining firewall rule is included in the target firewall rule list, the priority of at least one remaining firewall rule in the target firewall rule list is adjusted according to the priority of the second firewall rule.

Further, the firewall operation platform adjusts the priority of the at least one remaining firewall rule in the target firewall rule list according to the priority of the second firewall rule, including:

If the priority of the second firewall rule in the target firewall rule list is 1, that is, the priority is the highest, then reduce the priority of each firewall rule with a priority greater than 1 in the target firewall rule list by 1;

If the priority of the second firewall rule in the target firewall rule list is the lowest, the priority of at least one remaining firewall rule in the target firewall rule list remains unchanged;

If the priority of the second firewall rule is in the middle in the target firewall rule list, the priority of each firewall rule whose priority is greater than the second firewall rule is decreased by 1.

Further, the firewall operation platform may determine the arrangement position of the second firewall rule in the target firewall rule list based on the information carried by the second firewall rule. specific:

If the priority of the second firewall rule is 1, the second firewall rule is ranked first in the target firewall rule list;

If the priority of the second firewall rule is not 1 and the information carried by the second firewall rule is that the next firewall rule ID information is empty, then the second firewall rule is ranked at the end of the target firewall rule list;

If the priority of the second firewall rule is not 1 and the information carried by the second firewall rule is the next firewall rule ID information is not empty, the second firewall rule is ranked in the middle of the target firewall rule list Location.

Further, the process of deleting the second firewall rule from the target firewall rule list is completed in the firewall operation platform.

The following is a detailed description of the process of deleting firewall rule C from target firewall rule list B with reference to an example.

As shown in Figure 7, when the priority of firewall rule C is 1, the firewall rule C is the rule with the highest priority in the target firewall rule list B, and the firewall operation platform sets the priority of all rules with a priority greater than 1 to decrease by 1 ;

When the priority of firewall rule C is not 1, and the identification information of the next firewall rule of firewall rule C is empty, then firewall rule C is the rule with the lowest priority in target firewall rule list B, then the firewall operation platform sets the firewall rule The identification information of the last firewall rule of the preceding firewall rule of C is empty;

When the priority of firewall rule C is not 1, and the identification information of the next firewall rule of firewall rule C is not empty, then firewall rule C is in the middle of target firewall rule list B, then the firewall operation platform will The identification information of the last firewall rule of the preceding firewall rule is set to the identification information of the subsequent firewall rule of firewall rule C, and the priority of all firewall rules whose priority is greater than that of firewall rule C in target firewall rule list B is set minus 1.

Further, the insertion of firewall rules into the firewall rule list and the deletion of firewall rules from the firewall rule list are completed on the firewall operation platform. That is to say, the maintenance process of firewall rules is implemented on the firewall operation platform. When the target terminal device queries the firewall rule list, it directly sends a request to the firewall operation platform, and the firewall operation platform receives the request from the target user terminal to access the target firewall rule list; The target firewall rule list is pushed to the target user terminal, which simplifies the sorting process of the firewall rule list.

In this embodiment, the firewall operation platform implements the process of deleting the firewall rule from the firewall rule list, and adjusts the priority of at least one remaining firewall rule in the firewall rule list. Further, the adjustment process of the firewall rules does not involve the adjustment of the interval where the firewall rules are located, so that the deletion process of the firewall rules is simplified.

Embodiment three,

In order to realize the above firewall rule processing method, an embodiment of the present invention further provides a firewall rule processing device. The schematic diagram of the composition structure of the device is shown in FIG. 8 , including: a first determination module 81 and an insertion module 82; wherein,

The first determining module 81 is configured to determine the priority of the first firewall rule in the target firewall rule list based on the information carried by the first firewall rule;

Wherein, the information carried by the first firewall rule includes at least the ID information of the next firewall rule of the first firewall rule and the status information of the previous firewall rule of the first firewall rule; further, the first firewall rule Information such as the ID information of a firewall rule, the ID information of the next firewall rule of the first firewall rule, and the status information of the previous firewall rule of the first firewall rule can be stored in the database of the cloud platform. When a firewall rule is inserted into the target firewall list, the firewall operation platform retrieves it from the database of the cloud platform.

The inserting module 82 is configured to insert the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

Here, according to the priority field of the first firewall rule, its priority can be specified. If there is no firewall rule in the target firewall rule list, the first firewall rule is directly inserted into the target firewall rule list, and the priority is 1, that is, the priority is the highest.

Here, the apparatus further includes a second determining module, configured to determine the arrangement position of the first firewall rule in the target firewall rule list based on the information carried by the first firewall rule.

Specifically, if the information carried by the first firewall rule is that the ID information of the next firewall rule is empty and the previous firewall rule is not empty, then the first firewall is ranked at the end of the target firewall rule list;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is empty and the previous firewall rule is empty, the target firewall list is empty, and the first firewall is in the target firewall rule list. the first rule;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is not empty and the previous firewall rule is empty, then the first firewall is ranked first in the target firewall rule list;

If the information carried by the first firewall rule is that the ID information of the next firewall rule is not empty and the previous firewall rule is not empty, the first firewall is ranked in the middle of the target firewall rule list.

Further, the apparatus further includes a first adjustment module for, when the target firewall rule list contains at least one other firewall rule except the first firewall rule, according to the priority of the first firewall rule , adjusting the priority of the at least one other firewall rule in the target firewall rule list. Further, the first adjustment module is specifically used for:

If the priority of the first firewall rule in the target firewall rule list is the lowest, the priority of the at least one other firewall rule in the target firewall rule list remains unchanged;

If the priority of the first firewall rule in the target firewall rule list is the highest, the priority of the at least one other firewall rule in the target firewall rule list is increased by 1;

If the priority of the first firewall rule in the target firewall rule list is in the middle, the priority in the target firewall rule list is higher than the priority of the previous firewall rule of the first firewall rule. The priority of the firewall rule is incremented by 1.

Further, based on the information carried by the second firewall rule, determine the arrangement position of the second firewall rule in the target firewall rule list, specifically:

If the priority of the second firewall rule is 1, the second firewall rule is ranked first in the target firewall rule list;

If the priority of the second firewall rule is not 1 and the information carried by the second firewall rule is that the next firewall rule ID information is empty, then the second firewall rule is ranked at the end of the target firewall rule list;

If the priority of the second firewall rule is not 1 and the information carried by the second firewall rule is the next firewall rule ID information is not empty, the second firewall rule is ranked in the middle of the target firewall rule list Location.

Here, the apparatus further includes a deletion module configured to delete the second firewall rule from the target firewall rule list.

Further, the apparatus further includes a second adjustment module for, when the target firewall rule list contains the at least one remaining firewall rule except the second firewall rule, according to the second firewall rule Priority, adjust the priority of at least one remaining firewall rule in the target firewall rule list. Further, the second adjustment module is specifically used for:

If the priority of the second firewall rule in the target firewall rule list is 1, that is, the priority is the highest, then reduce the priority of each firewall rule with a priority greater than 1 in the target firewall rule list by 1;

If the priority of the second firewall rule in the target firewall rule list is the lowest, the priority of the at least one remaining firewall rule in the target firewall rule list remains unchanged;

If the priority of the second firewall rule is in the middle in the target firewall rule list, the priority of each firewall rule whose priority is greater than the second firewall rule is decreased by 1.

Further, the apparatus further includes a push module, configured to receive a request from a terminal device to access the target firewall rule list; according to the request, push the target firewall rule list to the terminal device.

In practical applications, the first determination module 81, the insertion module 82, the second determination module, the first adjustment module, the deletion module, the second adjustment module and the push module can all be controlled by a central processing unit (CPU, Central Processing Unit), Micro Processor (MPU, Micro Processor Unit), Digital Signal Processor (DSP, Digital Signal Processor), or Field Programmable Gate Array (FPGA, Field Programmable Gate Array) etc.

It should be noted that: when the firewall rule processing apparatus provided by the above embodiment performs firewall rule processing, only the division of the above program modules is used as an example for illustration. In practical applications, the above processing can be allocated to different program modules as required. Completion means dividing the internal structure of the device into different program modules to complete all or part of the processing described above. In addition, the firewall rule processing apparatus and the firewall rule processing method embodiments provided by the above embodiments belong to the same concept, and the specific implementation process thereof is detailed in the method embodiments, which will not be repeated here.

To implement the above method, an embodiment of the present invention further provides another firewall rule processing device, the device includes a memory, a processor, and an executable program stored in the memory and capable of being run by the processor, the processor running When the executable program is executed, do the following:

Based on the information carried by the first firewall rule, determine the priority of the first firewall rule in the target firewall rule list; wherein the information carried by the first firewall rule includes at least the next firewall rule of the first firewall rule ID information and the state information of the previous firewall rule of the first firewall rule;

Inserting the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

When the processor is further configured to run the executable program, the following operations are performed:

Based on the information carried by the first firewall rule, the arrangement position of the first firewall rule in the target firewall rule list is determined.

When the processor is further configured to run the executable program, the following operations are performed:

When the target firewall rule list contains at least one other firewall rule except the first firewall rule, adjust the at least one other firewall rule in the target firewall rule list according to the priority of the first firewall rule When the processor is further configured to run the executable program, it performs the following operations:

Delete the second firewall rule from the target firewall rule list. When the processor is further configured to run the executable program, the following operations are performed:

When the target firewall rule list contains at least one remaining firewall rule except the second firewall rule, adjust at least one remaining firewall rule in the target firewall rule list according to the priority of the second firewall rule priority.

When the processor is further configured to run the executable program, the following operations are performed:

receiving a request from a terminal device to access the target firewall rule list;

According to the request, the target firewall rule list is pushed to the terminal device.

The hardware structure of the firewall rule processing apparatus is further described below by taking the example that the firewall rule processing apparatus is implemented as a server or a terminal for firewall rule processing.

9 shows a schematic diagram of the hardware structure of a firewall rule processing apparatus according to an embodiment of the present invention, and the firewall rule processing apparatus 900 shown in FIG. Various components in the firewall rule processing apparatus 900 are coupled together through a bus system 905 . It can be understood that the bus system 905 is used to implement the connection communication between these components. In addition to the data bus, the bus system 905 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 905 in FIG. 9 .

The user interface 903 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen, and the like.

It will be appreciated that the memory 902 may be either volatile memory or non-volatile memory, and may include both volatile and non-volatile memory.

The memory 902 in the embodiment of the present invention is used for storing various types of data to support the operation of the firewall rule processing apparatus 900 . Examples of these data include: any computer program for operating on the firewall rule processing apparatus 900 , such as the executable program 9021 , and the program implementing the method of the embodiment of the present invention may be included in the executable program 9021 .

The methods disclosed in the foregoing embodiments of the present invention may be applied to the processor 901 or implemented by the processor 901 . The processor 901 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above-mentioned method may be completed by an integrated logic circuit of hardware in the processor 901 or an instruction in the form of software. The above-mentioned processor 901 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The processor 901 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in combination with the embodiments of the present invention can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 902, and the processor 901 reads the information in the memory 902, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, an embodiment of the present invention further provides a storage medium on which an executable program is stored, and when the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are performed:

Based on the information carried by the first firewall rule, determine the priority of the first firewall rule in the target firewall rule list; wherein the information carried by the first firewall rule includes at least the next firewall rule of the first firewall rule ID information and the state information of the previous firewall rule of the first firewall rule;

Inserting the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list.

When the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are also performed:

Based on the information carried by the first firewall rule, the arrangement position of the first firewall rule in the target firewall rule list is determined.

When the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are also performed:

When the target firewall rule list contains at least one other firewall rule except the first firewall rule, adjust the at least one other firewall rule in the target firewall rule list according to the priority of the first firewall rule The priority of the firewall rule.

When the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are also performed:

Delete the second firewall rule from the target firewall rule list. When the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are also performed:

When the target firewall rule list contains at least one remaining firewall rule except the second firewall rule, adjust the at least one remaining firewall rule in the target firewall rule list according to the priority of the second firewall rule The priority of the firewall rule.

When the executable program is run by the processor 901 of the firewall rule processing apparatus 900, the following operations are also performed:

receiving a request from a terminal device to access the target firewall rule list;

According to the request, the target firewall rule list is pushed to the terminal device.

As will be appreciated by those skilled in the art, embodiments of the present invention may be provided as a method, system, or executable program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of an executable program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and executable program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by executable program instructions. These executable program instructions may be provided to a general purpose computer, a special purpose computer, an embedded processor or a processor of a reference programmable data processing apparatus to produce a machine such that the instructions executed by the computer or a processor of a reference programmable data processing apparatus produce a Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

The executable program instructions may also be stored in a computer-readable memory capable of directing a computer or reference programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the The instruction means implement the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These executable program instructions may also be loaded onto a computer or reference programmable data processing apparatus, such that a series of operational steps are performed on the computer or reference programmable apparatus to produce a computer-implemented process for execution on the computer or reference programmable apparatus The instructions provide steps for implementing the functions specified in one or more of the flowcharts and/or one or more blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (12)

1. A method for processing firewall rules, the method comprising:

determining the priority of the first firewall rule in a target firewall rule list based on information carried by the first firewall rule; the information carried by the first firewall rule at least comprises identification ID information of a firewall rule behind the first firewall rule and state information of a firewall rule before the first firewall rule;

inserting the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list;

the method further comprises the following steps:

when the target firewall rule list contains at least one other firewall rule except the first firewall rule, if the first firewall rule has the lowest priority in the target firewall rule list, the priority of the at least one other firewall rule in the target firewall rule list is unchanged;

if the first firewall rule has the highest priority in the target firewall rule list, adding 1 to the priority of the at least one other firewall rule in the target firewall rule list;

and if the priority of the first firewall rule in the target firewall rule list is arranged in the middle, adding 1 to the priority of each firewall rule of which the priority in the target firewall rule list is greater than the priority of the previous firewall rule of the first firewall rule.

2. The method of claim 1, further comprising:

and determining the arrangement position of the first firewall rule in the target firewall rule list based on the information carried by the first firewall rule.

3. The method of claim 1, further comprising:

and deleting the second firewall rule from the target firewall rule list.

4. The method of claim 3, further comprising:

when the target firewall rule list contains at least one remaining firewall rule except the second firewall rule, the priority of the at least one remaining firewall rule in the target firewall rule list is adjusted according to the priority of the second firewall rule.

5. The method according to any one of claims 1 to 4, further comprising:

receiving a request of terminal equipment for accessing the target firewall rule list;

and pushing the target firewall rule list to the terminal equipment according to the request.

6. A firewall rule processing apparatus, characterized in that the apparatus comprises: a first determining module and an inserting module; wherein,

the first determining module is used for determining the priority of the first firewall rule in a target firewall rule list based on the information carried by the first firewall rule;

the information carried by the first firewall rule at least comprises ID information of a later firewall rule of the first firewall rule and state information of a previous firewall rule of the first firewall rule;

the inserting module is used for inserting the first firewall rule into the target firewall rule list according to the priority of the first firewall rule in the target firewall rule list;

the device further comprises a first adjusting module, configured to, when the target firewall rule list includes at least one other firewall rule except the first firewall rule, if the first firewall rule has the lowest priority in the target firewall rule list, leave the priority of the at least one other firewall rule in the target firewall rule list unchanged;

if the first firewall rule has the highest priority in the target firewall rule list, adding 1 to the priority of the at least one other firewall rule in the target firewall rule list;

and if the priority of the first firewall rule in the target firewall rule list is arranged in the middle, adding 1 to the priority of each firewall rule of which the priority in the target firewall rule list is greater than the priority of the previous firewall rule of the first firewall rule.

7. The apparatus of claim 6, further comprising a second determining module configured to determine an arrangement position of the first firewall rule in the target firewall rule list based on information carried by the first firewall rule.

8. The apparatus of claim 6, further comprising a deletion module configured to delete the second firewall rule from the target firewall rule list.

9. The apparatus of claim 8, further comprising a second adjusting module configured to adjust the priority of at least one remaining firewall rule in the target firewall rule list according to the priority of the second firewall rule when the target firewall rule list contains at least one remaining firewall rule except the second firewall rule.

10. The apparatus according to any one of claims 6 to 9, wherein the apparatus further comprises a push module configured to receive a request from a terminal device to access the target firewall rule list; and pushing the target firewall rule list to the terminal equipment according to the request.

11. A storage medium having stored thereon an executable program, the executable program when executed by a processor implementing the steps of the method of any one of claims 1 to 5.

12. A firewall rule processing apparatus comprising a memory, a processor and an executable program stored on the memory and executable by the processor, wherein the steps of the method according to any one of claims 1 to 5 are performed when the executable program is executed by the processor.

Images