Firewall rule updating method based on bigraph

Abstract

The invention discloses a firewall rule updating method based on a bigraph. According to the method, firstly, the bigraph expressing firewall rules is established according to the firewall rules, then the update needs of the firewall rules are matched with the bigraph expressing the firewall rules, and the update needs of the firewall rules are confirmed, and the firewall rules are updated. According to the firewall rule updating method based on the bigraph, updating of the firewall rules is converted into the operation of carrying out modification on edges and vertexes in the bigraph of the firewall rules, and the bigraph of the firewall rules clearly expresses the relations among all rules in a firewall. When unexpected results are generated in firewall rule updating process, a manager is reminded to correct the update needs in time, and errors caused by carelessness can be avoided. Meanwhile, according to the update requests confirmed by the manager and the current firewall rules, the updating of the firewall rules is completed by automatically generating optimal updating instructions, and rules in the updated firewall are made to be as few as possible to meet requirements of a user on updating of the firewall.

Description

technical field [0001] The invention belongs to the field of network security, and mainly relates to a method for updating firewall rules based on a bipartite graph. Background technique [0002] Firewall access control is one of the most important core strategies to ensure network security. The access control list (Access Control List, ACL) is a list of instructions for routers and switch interfaces. It plays a key role in protecting network equipment and servers. As the first checkpoint for the external network to enter the enterprise intranet, the access control list on the router has become an effective means to protect the security of the intranet. [0003] At present, there is no firewall update method designed to meet the firewall update requirements. The method proposed in the paper "Change-Impact Analysis of Firewall Policies" by Professor Alex Liu of Michigan State University helps firewall administrators understand what kind of impact the modification will have. ...

AI Technical Summary

Problems solved by technology

[0010] The present invention provides a firewall rule update method based on a bipartite graph, which aims to solve the problem that there is no firewall update method designed for firewall update requirements at present, which cannot help firewall managers confirm update requirements, and avoid introducing new errors due to carelessness. At the same time, it is impossible to generate the optimal update command to complete the update according to the update requirements and the current firewall rules.

Images