CN103067203B - policy consistency auditing method, device and equipment - Google Patents

Abstract

The invention discloses a policy consistency audit method, device and equipment, belonging to the field of terminal equipment. The method includes: respectively calculating the characteristic values of the policy data of the network management server and the equipment, and each characteristic value of the policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the first The cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data; Compare the characteristic values of the policy data of the network management server and the device to obtain the audit results. By comparing the characteristic values of the policy data of the network management server and the equipment, the present invention can avoid errors in audit results caused by misjudgment of policies with different serial numbers but the same business content as inconsistencies, improve the accuracy of consistent audit results, and speed up Improve the speed of comparison and improve audit efficiency.

Description

Policy consistency audit method, device and equipment

technical field

The present invention relates to the field of terminal equipment, in particular to a policy consistency audit method, device and equipment.

Background technique

At present, Internet applications are increasing day by day, and problems such as viruses and Trojan horses that endanger the information security of enterprises and individual users are becoming more and more prominent, and network security has received great attention. Due to the increasing number of extranet security protection and intranet access control policies, the requirements for configuration, operation and maintenance of security policies are becoming increasingly strong, and policy management becomes more and more complex. Policy refers to the policy configuration of the firewall network, which can filter and inspect the content security of the data packets passing through the firewall according to the five-tuple (source address, source port, destination address, destination port, protocol). Whether the device configuration is consistent with the policy configured on the network management server affects the normal protection of the Internet. Therefore, the consistency audit of the policy is particularly important.

In the existing technology, the consistency audit strictly compares the configuration differences between the network management server and the device according to the policy serial number. If the policy serial number is different, the policy is considered to be different. For policies with the same serial number, it is necessary to further compare the characters of the object names referenced by the policy. string, if the strings are the same, the policies of the network management server and the device are considered to be consistent; if the strings are different, the policies of the network management server and the device are considered inconsistent.

In the process of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

In the auditing method of the prior art, when comparing according to the policy serial number, for policies with the same serial number, the scenario of repeatedly adding and deleting policies may occur, and once the modified policy reuses the previous policy serial number, the serial number will be different and business Policies with the same content are misjudged as inconsistencies and audit results are wrong, and when using strings for further comparison, in the case of a large number of public objects, the efficiency is low, and the problem of repeated comparisons will occur at the same time, and because only for The referenced object names are compared without caring about the content inside, and the comparison cannot be made for the case where the name has not changed but the content has changed, resulting in inaccurate audit results.

Contents of the invention

In order to solve the problems of low consistency audit efficiency and inaccurate audit results, embodiments of the present invention provide a policy consistency audit method, device, and equipment. Described technical scheme is as follows:

In one aspect, a policy consistency auditing method is provided, the method comprising:

Calculate the eigenvalues of the policy data of the network management server and the equipment respectively, the eigenvalues of each policy data include a first cyclic redundancy check value and a second cyclic redundancy check value; the first cyclic redundancy check The verification value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data;

Compare the characteristic values of the policy data of the network management server and the device to obtain the audit results.

Compare the characteristic values of the policy data of the network management server and equipment to obtain audit results, including:

Comparing the first cyclic redundancy code check value of the policy data of the network management server and the device, to determine the first policy data;

When it is determined through comparison that the policy data of the network management server and the device also include second policy data, comparing the second cyclic redundancy code check value of the second policy data of the network management server and the second policy data of the device , acquiring a difference between the second policy data of the network management server and the second policy data of the device.

Comparing the first cyclic redundancy code check value of the policy data of the network management server and the equipment, determining the first policy data, including:

Respectively sort the feature values of the policy data of the network management server and the device according to the configuration order;

Determining a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence is a policy data sequence based on the device's The strategy data is the same strategy data sequence as the first CRC check value determined by the benchmark;

Comparing the first sequence and the second sequence, determining the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

Calculate the characteristic values of the policy data of the network management server and the device respectively, including:

Obtain the policy data of the network management server and the device respectively;

According to the policy data of the network management server and equipment and the common objects referenced by each policy data, the characteristic value of the policy data of the network management server and equipment is calculated.

According to the policy data of the network management server and equipment and the public objects referenced by each policy data, calculating the characteristic value of the policy data of the network management server and equipment, including:

When the form of the policy data of the network management server and the device is different, convert the form of the policy data of the device into the form of the policy data of the network management server, according to the policy data of the network management server and the device and each policy data The reference relationship of public objects is used to calculate the characteristic value of the policy data of the network management server and equipment.

According to the policy data of the network management server and equipment and the public objects referenced by each policy data, calculating the characteristic value of the policy data of the network management server and equipment, including:

The first cyclic redundancy check value and the second cyclic redundancy check value of each policy data are calculated layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects.

In another aspect, a device for auditing policy consistency is provided, and the device includes:

The calculation module is used to calculate the eigenvalues of the policy data of the network management server and the equipment respectively, and the eigenvalues of each policy data include a first cyclic redundancy check value and a second cyclic redundancy check value; the first The cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data;

The comparison module is used to compare the characteristic values of the policy data of the network management server and the equipment, and obtain audit results.

The comparison module includes:

The first comparison unit is used to compare the first cyclic redundancy code check value of the policy data of the network management server and the device, and determine the first policy data;

The second comparing unit, when determining that the policy data of the network management server and the device also include the second policy data after comparison, the second cyclic redundancy code of the second policy data of the network management server and the second policy data of the device The verification value is compared to obtain the difference between the second policy data of the network management server and the second policy data of the device.

The first comparison unit includes:

The sorting unit is used to sort the characteristic values of the policy data of the network management server and the device respectively according to the configuration order;

A sequence determining unit, configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence The second sequence is a strategy data sequence with the same first cyclic redundancy code check value determined based on the strategy data of the device;

The first policy determination unit is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

The calculation module includes:

An acquisition unit, configured to acquire the policy data of the network management server and the device respectively;

The calculation unit is used to calculate the characteristic value of the policy data of the network management server and the equipment according to the policy data of the network management server and the equipment and the common objects referenced by each policy data.

The calculation unit is used to convert the form of the policy data of the device into the form of the policy data of the network management server when the form of the policy data of the network management server and the device is different, according to the form of the policy data of the network management server and the device The policy data and the reference relationship of each public object of the policy data calculate the characteristic value of the policy data of the network management server and the device.

The calculation unit is used to calculate the first cyclic redundancy check value and the second cyclic redundancy check value of each policy data layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects.

In yet another aspect, a policy consistency auditing device is provided, and the device includes: a processor,

The processor is used to calculate the characteristic value of the policy data of the network management server and the device respectively, and the characteristic value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data ;

The processor is also used to compare the characteristic values of the policy data of the network management server and the equipment to obtain audit results.

The processor is configured to compare the first cyclic redundancy code check value of the policy data of the network management server and the device to determine the first policy data; When the second policy data is used, compare the second policy data of the network management server with the second cyclic redundancy check value of the second policy data of the device, and obtain the second policy data of the network management server and the second policy data of the device. Differences between policy data.

The processor is configured to respectively sort the characteristic values of the policy data of the network management server and the device according to the configuration sequence;

The processor is configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, the The second sequence is a strategy data sequence with the same first cyclic redundancy check value determined based on the strategy data of the device;

The processor is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

The processor is also used to respectively acquire the policy data of the network management server and the device;

The processor is further configured to calculate the characteristic value of the policy data of the network management server and the device according to the policy data of the network management server and the device and the common objects referenced by each policy data.

The processor is configured to convert the form of the policy data of the device into the form of the policy data of the network management server when the forms of the policy data of the network management server and the device are different, according to the form of the policy data of the network management server and the device The policy data of the network management server and the reference relationship of each public object of the policy data are calculated, and the characteristic values of the policy data of the network management server and the device are calculated.

The processor is configured to calculate the first cyclic redundancy check value and the second cyclic redundancy check value of each policy data layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects .

In the policy consistency auditing method, device and equipment provided by the embodiments of the present invention, the characteristic values of the policy data of the network management server and the equipment are respectively calculated, and the characteristic values of each policy data include the first cyclic redundancy code check value and The second cyclic redundancy check value; the first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the policy data The cyclic redundancy check value of the referenced public object; compare the characteristic value of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

Figure 1a is a flow chart of a policy consistency audit method provided in an embodiment of the present invention;

Fig. 1b is a schematic diagram of a policy consistency audit architecture provided in an embodiment of the present invention;

Fig. 2a is a flow chart of a policy consistency audit method provided in an embodiment of the present invention;

Fig. 2b is a schematic diagram of a policy consistency audit provided in an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a policy consistency auditing device provided in an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a policy consistency auditing device provided in an embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

Fig. 1a is a flow chart of a policy consistency audit method provided by an embodiment of the present invention. The execution subject in this embodiment is a network management server. Referring to Fig. 1a, the method flow includes:

101: Calculate the feature values of the policy data of the network management server and the device respectively, where the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the first cyclic redundancy check value The code check value is the cyclic redundancy code check value of the policy data, and the second cyclic redundancy code check value is the cyclic redundancy code check value of the public object referenced by the policy data;

Wherein, each cyclic redundancy code check value is calculated according to the data itself and a cyclic redundancy algorithm.

102: Compare the characteristic values of the policy data of the network management server and the device, and obtain an audit result.

In the method provided by the embodiment of the present invention, the feature values of the policy data of the network management server and the device are respectively calculated, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency.

Optionally, on the basis of the technical solution of the embodiment shown in Figure 1a, the step 102 "comparing the characteristic values of the policy data of the network management server and the device to obtain audit results" includes the following steps:

102A: Compare the first cyclic redundancy code check value of the policy data of the network management server and the device, and determine the first policy data;

Wherein, the first cyclic redundancy check value is calculated according to the service content of the policy data of the network management server, so the first cyclic redundancy check value corresponds to the actual meaning of the policy one by one, and since the service content includes Therefore, by comparing the first cyclic redundancy code check value of the policy data of the network management server and the device, it can be determined whether the business content of the policy data of the network management server and the device is consistent. When the first cyclic redundancy code check value of the policy data of the network management server and the device is the same, it is considered that the policy data of the network management server and the device are consistent, and the first policy data is the first cycle between the policy data of the network management server and the device. Policy data with the same redundancy code check value.

102B: When it is determined through comparison that the policy data of the network management server and the device also include the second policy data, check the second cyclic redundancy code value of the second policy data of the network management server and the second policy data of the device Performing a comparison to obtain a difference between the second policy data of the network management server and the second policy data of the device.

When the first policy data includes all policy data in the network management server and the device, there is no need to compare the second policy data. At this time, there is no second policy data, that is, the policy data in the network management server and the device are consistent. Further comparison is required; when the first policy data does not include all policy data in the network management server and equipment, the policy data in the network management server and equipment are inconsistent, and all policy data in the network management server and equipment are divided into the first The data other than the policy data is used as the second policy data, and the network management server in the second policy data needs to be further compared with the second cyclic redundancy code check value in the policy data in the device.

The second cyclic redundancy code check value contains the cyclic redundancy code check value of the content of multiple referenced public objects. By comparing the second cyclic redundancy code check value, the policy data of the network management server and equipment can be found out The specific difference between the referenced public objects also finds out the specific difference between the policy data of the network management server and the device.

In the method provided by the embodiment of the present invention, the feature values of the policy data of the network management server and the device are respectively calculated, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency. Further, by comparing the first cyclic check code and the second cyclic check code respectively, the consistency audit results of the network management server and the equipment can be quickly obtained.

Further optionally, on the basis of the technical solution of the embodiment shown in Figure 1a, the step 102A "comparing the characteristic values of the policy data of the network management server and the device to obtain the audit result" includes the steps:

(1) Sorting the characteristic values of the policy data of the network management server and the device according to the order of configuration;

According to the order in which the policy data of the network management server and equipment are configured, the feature values of the policy data of the network management server and equipment are respectively sorted, so that the policy data comparison process of the network management server and equipment can be carried out in an orderly manner.

(2) Determining the first sequence and the second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence is A policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the device.

When the policy data of the network management server is used as the benchmark, according to the order of the policy data of the network management server, the first cyclic redundancy code check value in the policy data of the network management server and the first cyclic redundancy code of the policy data of the device one by one The check value is compared. Specifically, first find the policy data in the device that is the same as the first cyclic redundancy code check value of the first policy data in the policy data of the network management server. If the policy data is found in the device For policy data with the same first cyclic redundancy check value, record the order and position of the policy data in the policy data of the network management server and the policy data of the device, and then, between the positions of the recorded policy data in the device Search for the policy data with the same first cyclic redundancy check value as the second policy data in the policy data of the network management server; if no policy data with the same first cyclic redundancy check value is found in the device For the policy data, the policy data of the device is searched for the policy data having the same first cyclic redundancy code check value as the second policy data in the policy data of the network management server. Search for policy data with the same first cyclic redundancy code check value in the policy data of the device according to the search method of the first policy data, until all the policy data in the network management server are traversed and searched, and all of them have the same There is a one-to-one correspondence with the strategy data of the first cyclic redundancy check value.

When the policy data of the device is used as the benchmark, according to the order of the policy data of the device, the first cyclic redundancy code check value in the policy data of the device is checked one by one with the first cyclic redundancy code check value of the policy data of the network management server Specifically, first find out in the network management server the policy data with the same first cyclic redundancy code check value as the first policy data in the policy data of the device, if the network management server finds out the policy data with The policy data of the same first cyclic redundancy code check value records the order and position of the policy data in the policy data of the device and the policy data of the network management server, and then, between the positions of the recorded policy data in the network management server Search for the policy data with the same first cyclic redundancy code check value as the second policy data in the device policy data; if no policy data with the same first cyclic redundancy code check value is found in the network management server For the policy data, the policy data of the network management server is searched for the policy data having the same first cyclic redundancy code check value as the second policy data in the policy data of the device. Search for policy data with the same first cyclic redundancy code check value in the policy data of the network management server according to the search method of the first policy data, until all policy data in the device are traversed and searched, and all of them have the same There is a one-to-one correspondence with the strategy data of the first cyclic redundancy check value.

(3) Comparing the first sequence and the second sequence, and determining the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

In the process of obtaining the first sequence and the second sequence, the network management server and the device are respectively used as benchmarks, so the obtained first sequence and the second sequence have the same strategy of the first cyclic redundancy code check value The number of data may be different, and the policy data in a sequence with more policy data having the same first cyclic redundancy check value is determined as the first policy data. When the first policy data does not include all the policy data in the network management server and the device, use policy data other than the first policy data as the second policy data.

In the method provided by the embodiment of the present invention, the feature values of the policy data of the network management server and the device are respectively calculated, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency. Further, by comparing the first cyclic check code and the second cyclic check code respectively, the consistency audit results of the network management server and the equipment can be quickly obtained. Furthermore, by acquiring the first policy data, the consistent policy data in the network management server and the device can be obtained.

Optionally, on the basis of the technical solution of the embodiment shown in Figure 1a, step 101 "calculates the feature values of the policy data of the network management server and the device respectively, and each feature value of the policy data includes the first cyclic redundancy check value and a second cyclic redundancy check value; the first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the strategy The cyclic redundancy check value of the public object referenced by the data", including:

101A: Obtain the policy data of the network management server and the device respectively;

Wherein, the policy data includes the policy and the public objects referenced by the policy. Among them, the common objects include but not limited to: address set, time period, service set, etc. When the network management server receives the audit request sent by the device, it sends a request message to the network management server according to the device ID number in the audit request, and the network management server returns the policy data configured on the network management server for the device according to the ID in the request message; at the same time, the network management server The server sends a request message to the device, so that the device returns command line echo data of the policy configuration to the network management server after receiving the request message, wherein the command line echo data of the policy configuration includes policy data of the device.

101B: Calculate characteristic values of the policy data of the network management server and the device according to the policy data of the network management server and the device and the common objects referenced by each policy data.

The policy data can include various referenced objects, as well as referenced public objects. For referenced objects, such as address IP, service http, etc., the cyclic redundancy check value can be directly calculated. For referenced public objects, the The cyclic redundancy check value of the public object name and the cyclic redundancy check value of the public object content need to be calculated. For a strategy, the top layer is the strategy, the lower layer can be the sub-strategy of the strategy, and the lower layer can be the public object referenced by the sub-strategy. If the public object references other objects, there can also be data in the lower layer. Each Strategies can be divided into different levels according to their own reference relationship. When calculating the eigenvalues of the policy data of the network management server and equipment, two types of eigenvalues need to be calculated. The first type is the first cyclic redundancy check value, and the second type is the second cyclic redundancy check value. Wherein, the characteristic value of a policy data includes a first cyclic redundancy check value having a plurality of cyclic redundancy check values, and the characteristic value may also include at least one second cyclic redundancy check value, The number of second cyclic redundancy check values included in the feature value of the policy data is determined by the number of common objects referenced by each policy data, and there may be at least one second cyclic redundancy check in a feature value value, and may not have a second cyclic redundancy check value, but the characteristic value of the policy data only contains a first cyclic redundancy check value, and the first cyclic check code is the top layer of the policy data The cyclic redundancy check value for the policy.

In the method provided by the embodiment of the present invention, the feature values of the policy data of the network management server and the device are respectively calculated, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency. Further, by comparing the first cyclic check code and the second cyclic check code respectively, the consistency audit results of the network management server and the device can be quickly obtained. By calculating the first cyclic check code and the second cyclic check code, the time used for consistency comparison can be shortened.

Further optionally, on the basis of the technical solution of the embodiment shown in Figure 1a, in step 101B, "calculate the network management server's and the characteristic value of the policy data of the device", including: when the form of the policy data of the network management server and the device is different, converting the form of the policy data of the device into the form of the policy data of the network management server, according to the The policy data of the network management server and the device and the reference relationship of each public object of the policy data are calculated, and the characteristic values of the policy data of the network management server and the device are calculated.

During the consistency audit process, the network management server obtains the command line echo data of the policy configuration from the device, wherein the command line echo data of the policy configuration includes the policy data of the device. When the form of the policy data of the network management server and the device is different, convert the form of the policy data of the device into the form of the policy data of the network management server, according to the policy data of the network management server and the device and each policy data The reference relationship of public objects is used to calculate the characteristic value of the policy data of the network management server and equipment. Specifically, after the network management server receives the policy data sent by the device, it judges whether the form of the policy data of the network management server and the device is the same, if yes, directly calculates the characteristic value of the policy data of the network management server and the device; The command line echo data of the policy data configuration, analyze the command line of the policy data, convert it into the form of the policy data of the network management server, and then calculate the characteristic value of the policy data of the network management server and equipment.

Further optionally, on the basis of the technical solution of the embodiment shown in Figure 1a, in step 101B, "calculate the network management server's and the characteristic value of the policy data of the device", including: according to the reference relationship hierarchy of each policy data and public object, calculate the first cyclic redundancy code check value and the second cyclic redundancy check value of each policy data layer by layer from bottom to top The remaining code check value.

Specifically, according to the reference relationship levels of each policy data and public object, first calculate the cyclic redundancy code check value of the public object referenced by each policy data in the lower layer as the second cyclic redundancy code check value, and then According to the hierarchical logical relationship, the objects and business data referenced by the upper layer are calculated, and the second cyclic redundancy code check value and the calculated cyclic redundancy code check value of the upper layer policy data are used as the first cyclic redundancy code check value. Check value, the first cyclic redundancy check value includes at least one second cyclic redundancy check value, the obtained first cyclic redundancy check value and the business meaning actually represented by the policy data are in one-to-one correspondence of. When calculating the first cyclic redundancy check value, you only need to calculate it according to the configuration order. For directly referenced objects, calculate the corresponding cyclic redundancy check value. For referenced public objects, you need to calculate the public object The CRC value of the name and the CRC value of the public object content. For example, if the strategy only references public objects, the format of the first cyclic redundancy check value of the strategy is:

The cyclic redundancy check value of the name of the public object 1 referenced by the policy data + the cyclic redundancy check value of the content of the public object 1 referenced by the policy data + ... + the cycle of the name of the public object N referenced by the policy data Redundancy code check value + cyclic redundancy code check value of the content of the public object N referenced by the policy data.

Among them, the cyclic redundancy check value of the name of each public object in the first cyclic redundancy check value of the policy is adjacent to the cyclic redundancy check value of the public object, and the cyclic redundancy check value of the name of each public object The residual code check value and the cyclic redundancy code check value of public objects are calculated according to the order in which they are configured in the policy.

For example, if a policy references both public objects and objects such as IP and service directly, the format of the first cyclic redundancy check value of the policy is:

The cyclic redundancy check value of the name of the public object 1 referenced by the policy data + the cyclic redundancy check value of the content of the public object 1 referenced by the policy data + ... + the cycle of the name of the public object N referenced by the policy data Redundancy code check value + cyclic redundancy check value of the content of the public object N referenced by the policy data + cyclic redundancy check value of IP + cyclic redundancy check value of the service.

The cyclic redundancy check value of the name of each public object in the second cyclic redundancy check value of the policy is adjacent to the cyclic redundancy check value of the public object, and the cyclic redundancy code of the name of each public object The check value and the cyclic redundancy check value of the public object, the cyclic redundancy check value of the IP, and the cyclic redundancy check value of the service are calculated according to the order in which they are configured in the policy.

Figure 1b is a schematic diagram of a policy consistency audit architecture provided in the embodiment of the present invention, see Figure 1b, in Figure 1b, in the audit preparation stage, after obtaining the policy data of the network management server and equipment, the policy data of the equipment is analyzed , converted into data in the same form as the policy data of the network management server, and then calculate the cyclic redundancy check value of the public object, that is, the second cyclic redundancy check value, such as the service set and address set shown in the figure and other sets, and then calculate the cyclic redundancy check value of the strategy of the upper layer according to the reference relationship, that is, the first cyclic redundancy check value. In the audit process, first compare the first cyclic redundancy code check value to obtain the first policy data, when the first cyclic redundancy code check value is compared with the second cyclic redundancy code check value of the public object, First compare the second cyclic redundancy check value of the name of the service set, address set and other sets, find out the sets with different second cyclic redundancy check values, and then check the second cyclic redundancy check value of the content of the set Code check value to obtain specific inconsistent data.

Fig. 2a is a flow chart of a policy consistency audit method provided by an embodiment of the present invention. The execution subject in this embodiment is a network management server. Referring to Fig. 2a, the method flow includes:

201: The network management server obtains the policy data of the network management server and the device respectively;

202: Convert the form of the policy data of the device into the form of the policy data of the network management server;

In the embodiment of the present invention, the policy data of the network management server is different from the policy data of the device as an example for illustration.

203: Calculate characteristic values of the policy data of the network management server and the device according to the policy data of the network management server and the device and the common objects referenced by each policy data;

The first cyclic redundancy check value and the second cyclic redundancy check value of each policy data are calculated layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects. The feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the first cyclic redundancy check value is the cyclic redundancy check of the policy data value, the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data.

In order to enable those skilled in the art to better understand the process of calculating the feature value of the policy data, an example is given below. For example, the form of a policy data is:

Policy100sourceaddress-setaddrset002destinationaddrset_serverservicehttpftp

addrset002

item12.2.2.0/24

item23.3.3.0/24

addrset_server

item15.5.5.0/24

item25.5.6.0/24

Among them, 100 is the serial number of the policy, addrset002 is the source address service set referenced by the policy, addrset_server is the destination address service set referenced by the policy, httpftp is the service used by the protocol, 2.2.2.0/24 and 3.3.3.0/24 is the address content in the source address service set referenced by the policy, and 5.5.5.0/24 and 5.5.6.0/24 are the address content in the destination address service set referenced by the policy.

Since the policy references two public objects, namely addrset002 and addrset_server, two second CRC values will be obtained. When calculating the second cyclic redundancy check value of this strategy, it is necessary to calculate the cyclic redundancy check values of 2.2.2.0/24 and 3.3.3.0/24 respectively, and then add the two values together as The second cyclic redundancy check value of the content of addrset002, similarly, it is necessary to calculate the cyclic redundancy check value of 5.5.5.0/24 and 5.5.6.0/24 respectively, and then add the two values together, Second cyclic redundancy check value as content of addrset_server. After calculating the second cyclic redundancy check value, then calculate the first cyclic redundancy check value of the strategy, the composition of the first cyclic redundancy check value of the strategy is:

The cyclic redundancy check value of the name of addrset002+the cyclic redundancy check value of the content of addrset002+the cyclic redundancy check value of the name of addrset_server+the cyclic redundancy check value of the content of addrset_server+httpftp Cyclic redundancy check value.

204: respectively sort the characteristic values of the policy data of the network management server and the device according to the configuration order;

According to the order in which the policy data of the network management server and equipment are configured, the feature values of the policy data of the network management server and equipment are respectively sorted, so that the policy data comparison process of the network management server and equipment can be carried out in an orderly manner.

205: Determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence is a policy data sequence based on The policy data of the device is a policy data sequence with the same first cyclic redundancy code check value determined by the benchmark;

In the process of determining the first sequence and the second sequence, it is necessary to use the policy data of the network management server and the device as a benchmark, and compare the policy data of the network management server and the device one by one until all have the same first cyclic redundancy One-to-one correspondence between the strategy data of the code check value, and obtain the strategy data sequence with the same first cyclic redundancy code check value.

For example, the policy data in the network management server is EABC, and the policy data in the device is CABD, then take the policy E from the policy data in the network management server based on the policy data in the network management server, and obtain the first cyclic redundancy code of E The check value is compared with the first cyclic redundancy code check value in the policy data in the device. From the comparison, it can be known that E in the policy data of the network has no corresponding policy in the policy data of the device. After comparing the E of the network management server, obtain the first cyclic redundancy check value of the next policy A of the network management server, and compare it with the first cyclic redundancy check value in each policy data in the device, when When comparing to A in the device, a strategy with the same first cyclic redundancy check value is found, and the sequence and position of the strategy A with the same first cyclic redundancy check value in the network management server and the device are recorded. Obtain the first cyclic redundancy check value of B in the network management server, compare it with the policy data below A in the device, and obtain the policy B with the same first cyclic redundancy check value in the device, record The order and position of policies B with the same first cyclic redundancy check value in the network management server and equipment. Finally, obtain the first cyclic redundancy check value of C in the network management server, and compare it with the policy data below B in the device. The comparison shows that C in the policy data of the network does not correspond to the policy data of the device strategy. After the comparison, the policies with the same first cyclic redundancy check value are matched one by one, and the obtained data are shown in Table 1:

Table 1

Network management server equipment E. C A A B B C D.

It can be seen from Table 1 that the first sequence consists of A of the network management server and A of the device, B of the network management server and B of the device.

Based on the policy data of the device, compare the policy data in the device with the policy data in the network management server one by one. One-to-one correspondence with the verification strategy, the obtained data is shown in Table 2:

Table 2

equipment Network management server N/A E. N/A A N/A B C C A N/A B N/A D. N/A

It can be seen from Table 2 that the second sequence is composed of C of the device and C of the network management server, where N/A means empty.

206: Compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data;

In the example in step 205, it can be seen from Table 1 that the number of policy data with the same first cyclic redundancy check value in the first sequence is 2, that is, A in the network management server and A in the device A corresponds to A, and B on the network management server corresponds to B on the device. As can be seen from Table 2, the number of policy data with the same first cyclic redundancy check value in the second sequence is 1, that is, C in the device corresponds to C in the network management server. By comparison, the first There are many strategy data in a sequence having the same first cyclic redundancy check value, so each strategy data in the first sequence is used as the first strategy data.

Steps 204-206 are a process of comparing the first cyclic redundancy code check value of the policy data of the network management server and the device to determine the first policy data.

207: When it is determined through comparison that the policy data of the network management server and the device also include second policy data, check the second cyclic redundancy check value of the second policy data of the network management server and the second policy data of the device Performing a comparison to obtain a difference between the second policy data of the network management server and the second policy data of the device.

When the first policy data includes all policy data in the network management server and the device, there is no need to compare the second policy data. At this time, there is no second policy data, that is, the policy data in the network management server and the device are consistent. Further comparison is required; when the first policy data does not include all policy data in the network management server and equipment, the policy data in the network management server and equipment are inconsistent, and all policy data in the network management server and equipment are included in the first policy The data other than data is used as the second policy data, and the network management server in the second policy data needs to be further compared with the second cyclic redundancy code check value in the policy data in the device.

On the basis of the example in step 206, since the first policy data does not include all the policy data in the network management server and equipment, it is necessary to compare the second policy data, so all policy data in the network management server and equipment except the first Data other than the policy data is used as the second policy data. It can be seen from Table 1 that the second policy data consists of E of the network management server and C of the device, C of the network management server and D of the device. After obtaining the second policy data, for the policy data of the corresponding network management server and device, it is necessary to further compare the second cyclic redundancy check value of the network management server's E and the device's C, and the network management server's C and The second cyclic redundancy code check value of the D of equipment finds out the difference in the policy data in the network management server and the equipment, for the policy data of the network management server and the equipment that do not have corresponding relationship, as the 2nd, 2nd in table 2 Lines 3, 4, 6, 7, and 8 are all cases where the policy data is empty, so there is no need to compare, and the policy data is directly used as the difference data.

Steps 203-207 are the process of comparing the characteristic values of the policy data of the network management server and the equipment, and obtaining the audit results.

Figure 2b is a schematic diagram of a policy consistency audit provided by an embodiment of the present invention, see Figure 2b, in which the policy reference relationship is divided into three levels, the first level is the policy, and the second level is the sub-policy (as shown in Figure 2b service sub-policy (fwpolicy), network protocol sub-policy (ipspolicy) and resolution sub-policy (dpipolicy)), the third layer is public objects (source address, destination address, service, time period as shown in Figure 2b , exception signatures, signature sets, application protocol sets, etc.). The public object of the third layer can also have a referenced public object (custom signature as shown in Figure 2b), when comparing, first compare the first cyclic redundancy check code of the first layer policy of the network management server and the device When the value of the first cyclic redundancy check code is different, then compare the second cyclic redundancy check value of the sub-strategy of the second layer of the network management server and the device, if the second cyclic redundancy check value of the sub-strategy of the second layer The redundancy code check value is the same, then no further comparison is made, if the second cyclic redundancy code check value of the sub-strategies of the second layer is different, find out the sub-strategies with different second cyclic redundancy code check values, and compare The network management server and the second cyclic redundancy code check value of the third-layer public object corresponding to the sub-policy of the device find out the public objects with different second cyclic redundancy code check values.

In the method provided by the embodiment of the present invention, the feature values of the policy data of the network management server and the device are respectively calculated, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency.

Figure 3 is a policy consistency audit device provided in the embodiment of the present invention, referring to Figure 3, the device includes:

The calculation module 301 is used to calculate the characteristic value of the policy data of the network management server and the device respectively, and the characteristic value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the first A cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data;

The comparison module 302 is configured to compare the characteristic values of the policy data of the network management server and the equipment, and obtain audit results.

The comparison module 302 includes:

The first comparison unit is used to compare the first cyclic redundancy code check value of the policy data of the network management server and the device, and determine the first policy data;

The second comparing unit, when determining that the policy data of the network management server and the device also include the second policy data after comparison, the second cyclic redundancy code of the second policy data of the network management server and the second policy data of the device The verification value is compared to obtain the difference between the second policy data of the network management server and the second policy data of the device.

The first comparison unit includes:

The sorting unit is used to sort the characteristic values of the policy data of the network management server and the device respectively according to the configuration order;

A sequence determining unit, configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence The second sequence is a strategy data sequence with the same first cyclic redundancy code check value determined based on the strategy data of the device;

The first policy determination unit is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

The calculation module 301 includes:

An acquisition unit, configured to acquire the policy data of the network management server and the device respectively;

The calculation unit is used to calculate the characteristic value of the policy data of the network management server and the equipment according to the policy data of the network management server and the equipment and the common objects referenced by each policy data.

The calculation unit is used to convert the form of the policy data of the device into the form of the policy data of the network management server when the form of the policy data of the network management server and the device is different, according to the form of the policy data of the network management server and the device The policy data and the reference relationship of each public object of the policy data calculate the characteristic value of the policy data of the network management server and the device.

The calculation unit is used to calculate the first cyclic redundancy check value and the second cyclic redundancy check value of each policy data layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects.

The device provided by the embodiment of the present invention calculates the feature values of the policy data of the network management server and the equipment respectively, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency.

Fig. 4 is a policy consistency auditing device provided in an embodiment of the present invention, referring to Fig. 4, the device includes: a processor,

The processor 401 is configured to separately calculate the characteristic values of the policy data of the network management server and the device, and each characteristic value of the policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data value;

The processor 401 is further configured to compare the characteristic values of the policy data of the network management server and the device, and obtain an audit result.

The processor 401 is configured to compare the first cyclic redundancy check value of the policy data of the network management server and the device to determine the first policy data; when it is determined through comparison that the policy data of the network management server and the device also include For the second policy data, compare the second policy data of the network management server with the second cyclic redundancy code check value of the second policy data of the device, and obtain the second policy data of the network management server and the first policy data of the device The difference between the two strategy data.

The processor 401 is configured to respectively sort the characteristic values of the policy data of the network management server and the device according to the order of configuration;

The processor 401 is configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the The second sequence is a strategy data sequence with the same first cyclic redundancy code check value determined based on the strategy data of the device;

The processor 401 is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data.

The processor 401 is further configured to respectively acquire policy data of the network management server and the device;

The processor 401 is further configured to calculate the characteristic value of the policy data of the network management server and the device according to the policy data of the network management server and the device and the common objects referenced by each policy data.

The processor 401 is configured to convert the form of the policy data of the device into the form of the policy data of the network management server when the forms of the policy data of the network management server and the device are different, according to the form of the policy data of the network management server and the The policy data of the device and the reference relationship of each public object of the policy data are used to calculate the characteristic value of the network management server and the policy data of the device.

The processor 401 is configured to calculate the first cyclic redundancy check value and the second cyclic redundancy check value of each policy data layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects value.

The device provided by the embodiment of the present invention calculates the feature values of the policy data of the network management server and the device respectively, and the feature value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; The first cyclic redundancy check value is the cyclic redundancy check value of the policy data, and the second cyclic redundancy check value is the cyclic redundancy check value of the public object referenced by the policy data. The verification value; compare the characteristic values of the policy data of the network management server and the device to obtain the audit result. By adopting the technical solution provided by the embodiment of the present invention, it is possible to avoid errors in audit results caused by misjudgment of policies with different serial numbers and the same business content as inconsistencies, and improve the accuracy of consistent audit results. At the same time, by comparing the characteristic values, Speed up the comparison and improve audit efficiency.

It should be noted that: the policy consistency auditing device provided by the above-mentioned embodiment only uses the division of the above-mentioned functional modules as an example during the policy consistency audit. In practical applications, the above-mentioned functions can be assigned to different function modules according to needs Module completion means that the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the policy consistency auditing device provided by the above embodiment and the policy consistency auditing method embodiment belong to the same idea, and its specific implementation process is detailed in the method embodiment, and will not be repeated here.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (12)

1. A policy consistency auditing method, is characterized in that, described method comprises: Calculate the eigenvalues of the policy data of the network management server and the equipment respectively, the eigenvalues of each policy data include a first cyclic redundancy check value and a second cyclic redundancy check value; the first cyclic redundancy check The verification value is the cyclic redundancy check value of the policy data, the first cyclic redundancy check value is calculated according to the business content of the policy data, and the second cyclic redundancy check value is the policy data a cyclic redundancy check value of the referenced public object, the second cyclic redundancy check value comprising a cyclic redundancy check value of the contents of the plurality of referenced public objects; Compare the characteristic values of the policy data of the network management server and the device to obtain the audit results; The respectively calculating the characteristic value of the policy data of the network management server and the equipment includes: Obtain the policy data of the network management server and the device respectively; According to the policy data of the network management server and equipment and the public objects referenced by each policy data, calculate the characteristic value of the policy data of the network management server and equipment; The comparison of the characteristic values of the policy data of the network management server and the equipment to obtain the audit results includes: Comparing the first cyclic redundancy code check value of the policy data of the network management server and the device, to determine the first policy data; When it is determined through comparison that the policy data of the network management server and the device also include second policy data, comparing the second cyclic redundancy code check value of the second policy data of the network management server and the second policy data of the device , acquiring a difference between the second policy data of the network management server and the second policy data of the device. 2. The method according to claim 1, characterized in that, comparing the first cyclic redundancy check value of the strategy data of the network management server and the equipment, determining the first strategy data, comprising: Respectively sort the feature values of the policy data of the network management server and the device according to the configuration order; Determining a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence is a policy data sequence based on the device's The strategy data is the same strategy data sequence as the first CRC check value determined by the benchmark; Comparing the first sequence and the second sequence, determining the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data. 3. The method according to claim 1, characterized in that, according to the policy data of the network management server and equipment and the public objects referenced by each policy data, calculating the characteristic value of the policy data of the network management server and equipment, including : When the form of the policy data of the network management server and the device is different, convert the form of the policy data of the device into the form of the policy data of the network management server, according to the policy data of the network management server and the device and each policy data The reference relationship of public objects is used to calculate the characteristic value of the policy data of the network management server and equipment. 4. The method according to claim 1, characterized in that, according to the policy data of the network management server and equipment and the public objects referenced by each policy data, calculating the characteristic value of the policy data of the network management server and equipment, including : The first cyclic redundancy check value and the second cyclic redundancy check value of each policy data are calculated layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects. 5. A policy consistency auditing device, characterized in that the device comprises: The calculation module is used to calculate the eigenvalues of the policy data of the network management server and the equipment respectively, and the eigenvalues of each policy data include a first cyclic redundancy check value and a second cyclic redundancy check value; the first The cyclic redundancy check value is the cyclic redundancy check value of the policy data, the first cyclic redundancy check value is calculated according to the business content of the policy data, and the second cyclic redundancy check The value is the cyclic redundancy check value of the public object referenced by the policy data, and the second cyclic redundancy check value includes the cyclic redundancy check value of the contents of multiple referenced public objects; The comparison module is used to compare the characteristic value of the policy data of the network management server and the equipment, and obtain the audit result; The calculation module includes: An acquisition unit, configured to acquire the policy data of the network management server and the device respectively; A calculation unit, configured to calculate characteristic values of the policy data of the network management server and equipment according to the policy data of the network management server and equipment and the common objects referenced by each policy data; The comparison module includes: The first comparison unit is used to compare the first cyclic redundancy code check value of the policy data of the network management server and the device, and determine the first policy data; The second comparing unit, when determining that the policy data of the network management server and the device also include the second policy data after comparison, the second cyclic redundancy code of the second policy data of the network management server and the second policy data of the device The verification value is compared to obtain the difference between the second policy data of the network management server and the second policy data of the device. 6. The device according to claim 5, wherein the first comparison unit comprises: The sorting unit is used to sort the characteristic values of the policy data of the network management server and the device respectively according to the configuration order; A sequence determining unit, configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, and the second sequence The second sequence is a strategy data sequence with the same first cyclic redundancy code check value determined based on the strategy data of the device; The first policy determination unit is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data. 7. The device according to claim 5, wherein the calculation unit is configured to convert the form of the policy data of the device into the form of the policy data of the network management server when the form of the policy data of the network management server is different In the form of the policy data of the server, the characteristic value of the policy data of the network management server and the equipment is calculated according to the policy data of the network management server and the equipment and the reference relationship of each public object of the policy data. 8. The device according to claim 5, wherein the calculation unit is used to calculate the first cyclic redundancy of each policy data layer by layer from bottom to top according to the reference relationship hierarchy of each policy data and public object A code check value and a second cyclic redundancy code check value. 9. A policy consistency auditing device, characterized in that the device comprises: a processor, The processor is used to calculate the characteristic value of the policy data of the network management server and the device respectively, and the characteristic value of each policy data includes a first cyclic redundancy check value and a second cyclic redundancy check value; the The first cyclic redundancy code check value is the cyclic redundancy code check value of the policy data, the first cyclic redundancy code check value is calculated according to the business content of the policy data, and the second cyclic redundancy code check value The check value is the cyclic redundancy check value of the public object referenced by the policy data, and the second cyclic redundancy check value includes the cyclic redundancy check value of the contents of multiple referenced public objects; The processor is also used to compare the characteristic values of the policy data of the network management server and the equipment to obtain audit results; The processor is further configured to separately obtain policy data of the network management server and equipment; and calculate the characteristics of the policy data of the network management server and equipment according to the policy data of the network management server and equipment and the public objects referenced by each policy data value; The processor is also used to compare the first cyclic redundancy code check value of the policy data of the network management server and the device to determine the first policy data; when it is determined that the policy data of the network management server and the device also include For the second policy data, compare the second policy data of the network management server with the second cyclic redundancy code check value of the second policy data of the device, and obtain the second policy data of the network management server and the first policy data of the device The difference between the two strategy data. 10. The device according to claim 9, wherein the processor is configured to sort the characteristic values of the policy data of the network management server and the device respectively according to a configuration order; The processor is configured to determine a first sequence and a second sequence, the first sequence is a policy data sequence with the same first cyclic redundancy code check value determined based on the policy data of the network management server, the The second sequence is a strategy data sequence with the same first cyclic redundancy check value determined based on the strategy data of the device; The processor is configured to compare the first sequence and the second sequence, and determine the policy data in the sequence containing more policy data with the same first cyclic redundancy check value as the first policy data. 11. The device according to claim 9, wherein the processor is configured to convert the form of the policy data of the device into the In the form of the policy data of the network management server, the characteristic value of the policy data of the network management server and the device is calculated according to the policy data of the network management server and the device and the reference relationship of each public object of the policy data. 12. The device according to claim 9, wherein the processor is configured to calculate the first cyclic redundancy of each policy data layer by layer from bottom to top according to the reference relationship levels of each policy data and public objects. A residual code check value and a second cyclic redundancy code check value.