CN112738114B - Configuration method of network security policy - Google Patents

Abstract

The invention discloses a configuration method of network security policy, which realizes the configuration of the policy according to the action of the policy, if the policy action is allowed, firstly judging whether a source network object and a target network object of the policy belong to the same network area, if yes, configuring the policy on the corresponding network security equipment; if not, configuring according to a specific network security strategy on the network security equipment where the source network object is located, and simultaneously releasing access of IP from all internal network segments to the network segment governed by the equipment according to a loose strategy configured on the network security equipment where the target network object is located; and if the policy action is rejection, configuring the policy only on the network security equipment where the source network object is located. The invention effectively reduces the number of network security strategies by configuring the security protection devices related to the network security strategies by using a unified principle, does not need to reduce the protection capability at all, well promotes the subsequent management and optimizes the working efficiency.

Description

Configuration method of network security policy

Technical Field

The invention relates to the technical field of network information security, in particular to a configuration method of a network security policy.

Background

With the rapid development of the internet, malicious behaviors on the network are increased more and more, and the network security policy is used as a main means for network security prevention and protection, so that the security of a network system is maintained and network resources are protected from being illegally accessed. For enterprises and public institutions, different network areas can be divided in enterprises, and according to related network security regulations, network security equipment needs to be deployed at the boundary of the network area for security protection, wherein a network security policy plays the most basic role in protection.

The existing configuration methods of the network security policy are generally divided into two types, one type is configured according to a large network segment, and the method has the advantages of simple policy, small quantity, difficulty in change and convenience for subsequent maintenance and management; the disadvantage is that the protection granularity is relatively coarse by taking a network segment as granularity, so that the protection capability of a network security strategy is directly reduced; the other is configured according to the detailed IP, and the method has the advantages that the configuration is carried out according to the requirement, and the protection capability is strong; the method has the disadvantages that the number of the strategies is large, and the strategies are configured according to needs, so that maintenance personnel are required to frequently change the configuration of the network security strategies under the scene that the updating of the access relation of the system application is fast, the operation is complicated, and the later maintenance management is troublesome.

Disclosure of Invention

The invention aims to provide a configuration method of a network security policy, which solves the problem that the existing configuration method of the network security policy cannot combine the characteristics of stronger protection capability and convenient operation, maintenance and management.

In order to achieve the purpose, the technical scheme adopted by the invention is as follows:

a configuration method of network security policy comprises the following steps:

(1) Preprocessing all network security policies to be configured; the network security policy comprises an active network object, a target network object, a port and an action;

(2) After preprocessing, configuring each strategy according to the action of the strategy, if the action of the strategy is allowed, firstly judging whether a source network object and a target network object of the strategy belong to the same network area, if so, configuring the strategy on corresponding network security equipment; if not, executing the step (3); if the policy action is rejection, configuring the policy only on the network security equipment where the source network object is located, and not configuring the policy on the network security equipment where the destination network object is located;

(3) Configuring according to a specific network security strategy on the network security equipment where the source network object is located, and simultaneously releasing the access of IP from all internal network segments to the network segment controlled by the equipment according to a loose strategy configured on the network security equipment where the target network object is located;

(4) And (4) recycling the steps (1) to (3).

Further, when each policy is configured, the larger the policy ID, the higher the priority.

Specifically, the pretreatment process in step (1) is as follows:

(a) Analyzing the IP contained in the source network object and the IP contained in the target network object in the network security policy;

(b) If the IP in the source network object belongs to the same network area and the IP in the target network object belongs to the same network area, executing the step (2); otherwise, performing different processing according to the IP attribution condition and then executing the step (2), specifically as follows:

case 1: if the IP of the source network object belongs to the same network area and the IP of the target network object does not belong to the same network area, splitting the strategy according to the network area to which the IP of the target network object belongs;

case 2: if the IP of the target network object belongs to the same network area, splitting the strategy according to the network area to which the IP of the source network object belongs;

case 3: the IP in the source network object does not belong to the same network area, the IP of the target network object does not belong to the same network area, the original strategy is split according to the network area to which the IP of the source network object belongs, the processed strategy is the same as the condition 1, and then the strategy is split by secondary processing according to the condition 1; or splitting the original policy according to the network region to which the IP of the target network object belongs, and then performing secondary processing splitting on the policy according to the case 2, where the processed policy is the same as that in the case 2.

Compared with the prior art, the invention has the following beneficial effects:

the invention considers the configuration strategy of the network security equipment associated with the network security strategy when configuring the network security strategy, namely: the configuration is performed by using a unified principle (the strict in-and-out) among safety protection devices involved in the network safety strategy. Therefore, the invention not only ensures the effectiveness of the strategies, but also greatly reduces the number of the strategies (tests show that half of the configuration items of the network security strategies can be reduced to the maximum extent), and the protection capability does not need to be reduced at all, thereby laying a good foundation for the subsequent management and optimization work efficiency of the network security strategies.

Drawings

FIG. 1 is a schematic flow chart of the present invention.

Detailed Description

The invention discloses a configuration method of network security policies, which has the core idea that all the policies related to the network security policies are preprocessed and configured according to the strict 'wide-in' principle by analyzing the network security protection equipment related to each network security policy, and the specific flow is shown in figure 1.

Firstly, preprocessing all network security policies to be configured; the network security policy includes an active network object, a destination network object, a port, and an action.

The invention preprocesses the strategy, aiming at leading the IP in the source network object and the IP in the target network object to belong to the same network area, the processing mode is that the IP contained in the source network object and the IP contained in the target network object in the network security strategy are analyzed, then different processing is carried out according to the IP attribution condition, which comprises the following steps:

case 1: splitting the strategy according to the network area to which the IP of the target network object belongs if the IP of the source network object belongs to the same network area and the IP of the target network object does not belong to the same network area;

case 2: if the IP of the target network object belongs to the same network area, splitting the strategy according to the network area to which the IP of the source network object belongs;

case 3: the IP in the source network object does not belong to the same network area, the IP of the target network object does not belong to the same network area, the original strategy is split according to the network area to which the IP of the source network object belongs, the processed strategy is the same as the condition 1, and then the strategy is split by secondary processing according to the condition 1; or splitting the original strategy according to the network area to which the IP of the target network object belongs, wherein the processed strategy is the same as the case 2, and then splitting the strategy by secondary processing according to the case 2;

case 4: the IP in the source network object belongs to the same network object, and the IP in the target network object belongs to the same network area without processing.

Then, the configuration of each strategy is realized according to the action of the strategy, if the action of the strategy is allowed, whether the source network object and the target network object of the strategy belong to the same network area is judged, if yes, the strategy is configured on the corresponding network security equipment; if not, the network security equipment (such as a firewall) of the source network object is configured according to a specific network security strategy, and meanwhile, the network security equipment of the target network object is configured with a loose strategy to release the access of the IP from all internal network segments to the network segment controlled by the equipment.

If the policy action is rejection, the policy is configured only on the network security device where the source network object is located, and the policy is not configured on the network security device where the destination network object is located.

The present invention is further illustrated by the following examples, which include, but are not limited to, the following examples.

Examples

The scenario of multiple firewalls can be extended, illustrated with three firewalls.

Assume that the network area governed by the firewall F1 is 1.1.0.0/16, the network area governed by the firewall F2 is 1.2.0.0/16, and the network area governed by the firewall F3 is 1.3.0.0/16.

According to the service scenario, the following network security policies need to be configured:

(1)permit src host 1.1.1.1/31to dst host 1.1.2.1tcp port 3306

(2)permit src host 1.1.2.1to dst host 1.2.2.1tcp port 3306

(3)deny src host 1.1.1.1to dst host 1.1.3.1tcp port 443

(4)permit src host 1.2.1.1and 1.3.1.1to host 1.2.10.1tcp port 22

initially, three firewalls were configured with default rejection policies, as shown in table 1:

TABLE 1

For the first policy, because the source network object and the destination network object are both on the firewall F1, the policy is directly configured on the firewall F1, a default rejection policy is added, and after the configuration is completed, the network security policy on the current firewall F1 is as follows

Shown in Table 2:

TABLE 2

For the second policy, since the source network object and the destination network object are respectively on the firewalls F1 and F2, and the policy action is pass (allowed), a detailed policy is configured on the wall F1 where the source network object is located, a loose policy is configured on the wall F2 where the destination network object is located, and the policies of the firewalls F1 and F2 after configuration are shown in table 3:

TABLE 3

For the third policy, the source network object and the destination network object are respectively in the firewalls F1 and F3, and the action is rejection, so the rejection policy of the detail IP is configured on the firewall F1, the configuration of the policy is not performed on the firewall F3, and after the configuration is completed, as shown in table 4:

TABLE 4

For the fourth policy, because the IP in the source network object does not belong to the same firewall, the policy is preprocessed and split into two policies 4.1 and 4.2:

4.1：permit src host 1.2.1.1to host 1.2.10.1tcp port 22

4.2：permit src host 1.3.1.1to host 1.2.10.1tcp port 22

for 4.1, the source network object and the destination network object belong to the same firewall F2, so that the policy configuration only needs to be performed on F2 according to 4.1;

for 4.2, the source network object and the destination network object do not belong to the same firewall, so it is sufficient to configure a detailed policy on the wall F3 where the source and destination network objects are located, and to configure a rough policy on the wall F2 where the destination network object is located, and the configuration is completed as shown in table 5:

TABLE 5

The larger the policy ID is, the higher the priority is in this embodiment.

Through the ingenious design, the configuration of the network security policy has the characteristics of strong protection capability and convenient operation and maintenance management, and lays a good foundation for the subsequent management and optimization work efficiency of the network security policy. The scheme of the invention seems to be simple, is not easy to think of in fact, and can break through the limitation of the prior art by the simplest and most effective means only by deeply researching the network security characteristics and combining practice and theory, thereby realizing the maximization of the effect. Therefore, compared with the prior art, the invention has outstanding substantive features and remarkable progress.

The above-mentioned embodiments are only preferred embodiments of the present invention, and should not be construed as limiting the scope of the present invention, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.

Claims (3)

1. A configuration method of network security policy is characterized by comprising the following steps:

(1) Preprocessing all network security policies to be configured; the network security policy comprises an active network object, a target network object, a port and an action;

(2) After preprocessing, configuring each strategy according to the action of the strategy, if the action of the strategy is allowed, firstly judging whether a source network object and a target network object of the strategy belong to the same network area, if so, configuring the strategy on corresponding network security equipment; if not, executing the step (3); if the policy action is rejection, configuring the policy only on the network security equipment where the source network object is located, and not configuring the policy on the network security equipment where the destination network object is located;

(3) Configuring according to the detailed strategy on the network security equipment where the source network object is located, and simultaneously releasing the access of the IP from all internal network segments to the network segment controlled by the network security equipment where the target network object is located according to the loose strategy configured on the network security equipment where the target network object is located;

(4) And (4) recycling the steps (1) to (3).

2. The method of claim 1, wherein the higher the policy ID, the higher the priority when configuring each policy.

3. The method for configuring network security policy according to claim 1 or 2, wherein the preprocessing in step (1) is performed as follows:

(a) Analyzing the IP contained in the source network object and the IP contained in the target network object in the network security policy;

(b) If the IP in the source network object belongs to the same network area and the IP in the target network object belongs to the same network area, executing the step (2); otherwise, performing different processing according to the IP attribution condition and then executing the step (2), specifically as follows:

case 1: splitting the strategy according to the network area to which the IP of the target network object belongs if the IP of the source network object belongs to the same network area and the IP of the target network object does not belong to the same network area;

case 2: if the IP of the target network object belongs to the same network area, splitting the strategy according to the network area to which the IP of the source network object belongs;

case 3: the IP in the source network object does not belong to the same network area, the IP of the target network object does not belong to the same network area, the original strategy is split according to the network area to which the IP of the source network object belongs, the processed strategy is the same as the condition 1, and then the strategy is split by secondary processing according to the condition 1; or splitting the original policy according to the network region to which the IP of the target network object belongs, and then performing secondary processing splitting on the policy according to the case 2, where the processed policy is the same as that in the case 2.

Images