CN112866008B

CN112866008B - NAT rule enabling attribute configuration method, NAT rule enabling attribute configuration device, electronic equipment and storage medium

Info

Publication number: CN112866008B
Application number: CN202011643827.6A
Authority: CN
Inventors: 马瑞武
Original assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Current assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Priority date: 2020-12-30
Filing date: 2020-12-30
Publication date: 2023-09-01
Anticipated expiration: 2040-12-30
Also published as: CN112866008A

Abstract

The application provides an enabling attribute configuration method, a device, electronic equipment and a storage medium of NAT rules, wherein each NAT rule comprises a first enabling attribute and a second enabling attribute, the first enabling attribute represents whether the second enabling attribute of the NAT rule needs to be modified, and the second enabling attribute represents whether the NAT rule is enabled, and the method comprises the following steps: under the condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled, determining whether the current moment is within a predetermined target time period; determining a second enabling attribute of the NAT rule to be detected; and when the current moment is determined to be within the target time period, configuring the second enabling attribute to be enabled. The process does not need to be judged manually or configured with the second enabling attribute of the rule to be detected manually, and is accurate in configuration, high in efficiency and low in cost.

Description

NAT rule enabling attribute configuration method, NAT rule enabling attribute configuration device, electronic equipment and storage medium

Technical Field

The present application relates to the field of network security technologies, and in particular, to a method, an apparatus, an electronic device, and a storage medium for configuring an enabling attribute of a NAT rule.

Background

With the rapid development of network technology, network security attracts a great deal of attention from the whole society, and network security communication devices are beginning to be deployed in large quantities into actual network environments. Network address translation (Network Address Translation, NAT) has the property of hiding private network topology, so NAT is supported by a large number of network security communication devices as an important line of security. As the number of NAT rules configured on the network security communications device increases, the problem of high costs of network maintenance and management becomes more and more prominent, and the management cost becomes higher and higher.

However, in the prior art, for each NAT rule, an administrator is required to analyze the enabling attribute of the NAT rule to manually configure the enabling attribute of the NAT rule at the current moment according to the analysis result, when the NAT rule to be managed is relatively large, the configuration cost of the enabling attribute of the NAT rule becomes very large, and the efficiency is very low by manually continuously deleting the enabling attribute of the NAT rule.

For example, when a company accesses the Internet during a working time, it needs to enable the NAT rule (i.e. the enabling attribute of the current moment of the NAT rule is configured to be enabled) to perform network address translation, and when the NAT rule is disabled during a non-working time (i.e. the enabling attribute of the current moment of the NAT rule is configured to be disabled), if an administrator needs to manually configure the enabling attribute of the NAT rule every day and every other day, the management and maintenance costs thereof become very high.

Disclosure of Invention

In view of this, an object of the embodiments of the present application is to provide a method, an apparatus, an electronic device, and a storage medium for configuring an enabling attribute of a NAT rule, so as to improve the configuration efficiency of a second enabling attribute of a NAT rule on the premise of reducing the configuration cost of the second enabling attribute of the NAT rule of a network security communication device.

In a first aspect, an embodiment of the present application provides an enabling attribute configuration method of NAT rules, where each NAT rule includes a first enabling attribute and has a second enabling attribute, where the first enabling attribute characterizes whether modification is required for a second enabling attribute of the NAT rule, and the second enabling attribute characterizes whether the NAT rule is enabled, and the method includes: under the condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled, determining whether the current moment is within a predetermined target time period; determining a second enabling attribute of the NAT rule to be detected; and when the current moment is determined to be within the target time period, configuring the second enabling attribute to be enabled.

In the implementation process, by presetting the target time period of the NAT rule to be detected and automatically determining whether the current moment is in the target time period under the condition that the first enabling attribute of the NAT rule to be detected is enabled, if so, the second enabling attribute of the NAT rule to be detected is automatically configured to be enabled, and the process does not need manual judgment or manual continuous configuration of the second enabling attribute of the NAT rule to be detected, so that the configuration is accurate, the efficiency is high, and the cost is low.

Based on the first aspect, in one possible design, the method further includes: the second enable attribute is configured to be disabled upon determining that the current time is not within the target time period.

In the implementation process, when the current moment is not in the target time period, the second enabling attribute is automatically configured to be disabled, so that other devices can access the network security communication device configured with the NAT rule to be detected in the time except the target time period.

Based on the first aspect, in one possible design, the configuring, when it is determined that the current time is within the target period of time, the second enabling attribute of the NAT rule to be detected as enabled includes: and when the current moment is determined to be within the target time period, if the second enabling attribute is determined not to be configured to be enabled, configuring the second enabling attribute to be enabled.

In the implementation process, when the current moment is determined to be within the target time period, the second enabling attribute needs to be configured as enabled, so that the defect that the configuration cost is increased by reconfiguring the second enabling attribute when the second enabling attribute is configured as enabled is avoided by configuring the second enabling attribute as enabled only when the second enabling attribute is determined to be not configured as enabled.

Based on the first aspect, in one possible design, the method further includes: and determining the target time period from the NAT rule to be detected.

In the implementation process, the target time period is set in the rule to be detected in advance, so that the target time period can be determined quickly and accurately.

Based on the first aspect, in one possible design, before the determining whether the current moment is within the predetermined target period of time under the condition that the first enabling attribute of the NAT rule to be detected is configured to be enabled, the method further includes: when an instruction that the NAT rule to be detected is configured is received, determining the first enabling attribute from the NAT rule to be detected; determining that the first enable attribute is configured to be enabled.

In the implementation process, when an instruction that the NAT rule to be detected is configured is received, the first enabling attribute is determined from the NAT rule to be detected, so that the defect that the load of the server is increased due to continuously obtaining the first attribute is avoided, and meanwhile, the obtained first enabling attribute is the latest enabling attribute under the condition that the NAT rule to be detected is reconfigured, and further, the fact that the second enabling attribute of the NAT rule to be detected can be accurately configured is ensured.

Based on the first aspect, in one possible design, the method further includes: receiving a message to be processed; and when the second enabling attribute of the NAT rule to be detected is determined to be enabling, processing the message according to the NAT rule to be detected.

In the implementation process, after receiving the message to be processed, if it is determined that the second enabling attribute of the NAT rule to be detected is enabled (i.e., the NAT rule is represented to be in an enabled state at the current time), the message is processed according to the NAT rule to be detected, so as to ensure network security.

In a second aspect, an embodiment of the present application provides an enabling attribute configuration apparatus for NAT rules, where each NAT rule includes a first enabling attribute and has a second enabling attribute, and the first enabling attribute characterizes whether modification is required to the second enabling attribute of the NAT rule, and the apparatus includes: a time validity determining unit, configured to determine, on a condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled, whether the current time is within a predetermined target time period; a second enabling attribute determining unit, configured to determine a second enabling attribute of the NAT rule to be detected; and the first configuration unit is used for configuring the second enabling attribute as enabling when the current moment is determined to be in the target time period.

Based on the second aspect, in one possible design, the apparatus further comprises: and a second configuration unit, configured to configure the second enabling attribute to be disabled when it is determined that the current time is not within the target time period.

Based on the second aspect, in one possible design, the first configuration unit is specifically configured to configure the second enable attribute to be enabled if it is determined that the second enable attribute is not configured to be enabled when it is determined that the current time is within the target time period.

Based on the second aspect, in one possible design, the apparatus further comprises: and the time period determining unit is used for determining the target time period from the NAT rule to be detected.

Based on the second aspect, in one possible design, the apparatus further comprises: a first enabling attribute determining unit, configured to determine, when receiving an instruction that the NAT rule to be detected is configured, the first enabling attribute from the NAT rule to be detected; and determining that the first enable attribute is configured to be enabled.

Based on the second aspect, in one possible design, the apparatus further comprises: the message processing unit is used for receiving the message to be processed; and when the second enabling attribute of the NAT rule to be detected is determined to be enabling, processing the message according to the NAT rule to be detected.

In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory connected to the processor, where the memory stores a computer program, and when the computer program is executed by the processor, causes the electronic device to perform the method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a storage medium having stored therein a computer program which, when run on a computer, causes the computer to perform the method of the first aspect.

Additional features and advantages of the application will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the embodiments of the application. The objectives and other advantages of the application will be realized and attained by the structure particularly pointed out in the written description and claims thereof as well as the appended drawings.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a flow chart of a method for configuring an enabling attribute of a network address translation (Network Address Translation, NAT) rule according to an embodiment of the present application.

Fig. 2 is a schematic structural diagram of an enabling attribute configuration device of NAT rule according to an embodiment of the present application.

Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Icon: enabling attribute configuration means of the 200-NAT rule; 210-a time validity determination unit; 220-a second enabling attribute determination unit; 230-a first configuration unit; 300-an electronic device; 301-a processor; 302-memory; 303-communication interface.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only to distinguish the description, and are not to be construed as indicating or implying relative importance.

Referring to fig. 1, fig. 1 is a flowchart of a method for configuring an enabling attribute of a NAT rule according to an embodiment of the present application. Each NAT rule includes a first enable attribute and has a second enable attribute. The first enabling attribute characterizes whether a modification to a second enabling attribute of the NAT rule is required. The second enabling attribute characterizes whether the NAT rule is enabled. The flow shown in fig. 1 will be described in detail, and the method includes: S11-S13.

S11: and determining whether the current moment is within a predetermined target time period or not under the condition that the first enabling attribute of the NAT rule to be detected is configured to be enabled.

S12: and determining a second enabling attribute of the NAT rule to be detected.

S13: and when the current moment is determined to be within the target time period, configuring the second enabling attribute to be enabled.

The above method is described in detail below.

As an embodiment, before S11, the method further includes: when an instruction that the NAT rule to be detected is configured is received, determining the first enabling attribute from the NAT rule to be detected; determining that the first enable attribute is configured to be enabled.

Specifically, when receiving the instruction, the network security communication device configured with the NAT rule to be detected determines the first enable attribute from the NAT rule to be detected, and determines that the first enable attribute is configured to be enabled.

The NAT rule to be detected is any configured NAT rule in the network security communication equipment.

It can be understood that the NAT rule to be detected includes the first enabling attribute and has a second enabling attribute; when the NAT rule to be detected is configured to be completed, the first enabling attribute in the NAT rule to be detected is characterized to be configured to be completed, and the initial attribute of the second enabling attribute of the NAT rule to be detected is configured to be completed, wherein the initial attribute of the second enabling attribute and the first enabling attribute are configured to be enabled.

It should be noted that, after the modification of the NAT rule a is completed (i.e. it may be considered that the NAT rule a does not exist), the modified NAT rule is obtained, that is, the modified NAT rule is configured, and at this time, the first enabling attribute is determined from the modified NAT rule.

Wherein the first enabling attribute and the second enabling attribute may be enabled or disabled; the first enabling attribute characterizes whether a modification to a second enabling attribute of the NAT rule is required, and the second enabling attribute characterizes whether the NAT rule is enabled.

For any NAT rule, when the first enabling attribute of the NAT rule is forbidden, the second enabling attribute of the NAT rule is characterized in that modification is not needed, namely the second enabling attribute of the NAT rule is forbidden all the time; when the first enabling attribute of the NAT rule is enabled, a second enabling attribute characterizing the NAT rule may need to be modified.

When the second enabling attribute of the NAT rule is enabling, characterizing that the NAT rule is enabled; and when the second enabling attribute of the NA rule is forbidden, characterizing that the NAT rule is forbidden.

As an embodiment, before S11, the method further includes: and determining the target time period from the NAT rule to be detected.

Specifically, after determining that the first enabling attribute of the NAT rule to be detected is configured to be enabled, the target time period is determined from the NAT rule to be detected.

Or after determining that the first enabling attribute of the NAT rule to be detected is configured as enabling, determining whether the NAT rule to be detected has a time attribute, and if so, extracting the target time period from the NAT rule to be detected. It can be understood that if the NAT rule to be detected does not exist, the period of time corresponding to the NAT rule to be detected cannot be acquired, and meanwhile, the second enabling attribute of the NAT rule to be detected does not need to be modified.

Or after determining that the first enabling attribute of the NAT rule to be detected is configured to be enabled, determining the target time period from the NAT rule to be detected based on a preset time interval or periodically.

Or after determining that the first enabling attribute of the NAT rule to be detected is configured to be enabled, searching out a target time period corresponding to the NAT rule to be detected from the corresponding relation between the pre-stored NAT rule and the time period.

The preset time interval is set according to the user demand.

In an actual implementation process, S11 may be implemented in such a manner that, after determining that the first enable attribute of the NAT rule to be detected is configured to be enabled for the first time, it is determined whether the current time is within a predetermined target period based on a preset time interval or not.

In an actual implementation process, S12 may be implemented in a manner of determining the second enabling attribute of the NAT rule to be detected based on a preset interval or periodically.

As an implementation manner, S12 may be implemented in the following manner, where the second enabling attribute corresponding to the NAT rule to be detected is found out from the correspondence between the pre-stored NAT rule and the second enabling attribute.

As one embodiment, S13 includes: and when the current moment is determined to be within the target time period, if the second enabling attribute is determined not to be configured to be enabled, configuring the second enabling attribute to be enabled.

Specifically, when it is determined that the current time is within the target time period, if it is determined that the second enable attribute is configured to be disabled, the second enable attribute is configured to be enabled.

As an embodiment, S13 may be implemented in such a manner that, when it is determined that the current time is within the target period, the second enable attribute of the NAT rule to be detected is reconfigured to be enabled, regardless of whether the second enable attribute is enabled or disabled.

As an embodiment, the method further comprises: the second enable attribute is configured to be disabled upon determining that the current time is not within the target time period.

Specifically, when it is determined that the current time is not within the target time period, if it is determined that the second enable attribute is not configured to be disabled, the second enable attribute is configured to be disabled.

Or when the current moment is not in the target time period, reconfiguring the second enabling attribute of the NAT rule to be detected to be disabled no matter the second enabling attribute is enabled or disabled.

As an embodiment, the method further comprises the step of: a1 and A2.

A1: and receiving a message to be processed.

In an actual implementation process, A1 may be implemented as follows, where a network security communication device configured with a NAT rule to be detected receives a message to be processed in real time or periodically.

A2: and when the second enabling attribute of the NAT rule to be detected is determined to be enabling, processing the message according to the NAT rule to be detected.

And acquiring a second enabling attribute of the NAT rule to be detected, and processing the message according to the NAT rule to be detected when the second enabling attribute is determined to be enabled.

Referring to fig. 2, fig. 1 is a block diagram illustrating a NAT device 400 according to an embodiment of the application. Each NAT rule includes a first enable attribute and has a second enable attribute. The first enabling attribute characterizes whether a modification to a second enabling attribute of the NAT rule is required. The block diagram of fig. 2 will be described, and the apparatus includes:

the time validity determining unit 210 is configured to determine whether the current moment is within a predetermined target time period under a condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled.

A second enabling attribute determining unit 220, configured to determine a second enabling attribute of the NAT rule to be detected.

A first configuration unit 230, configured to configure the second enabling attribute to be enabled when it is determined that the current time is within the target time period.

As an embodiment, the apparatus further comprises: and a second configuration unit, configured to configure the second enabling attribute to be disabled when it is determined that the current time is not within the target time period.

As an implementation manner, the first configuration unit 230 is specifically configured to, when determining that the current time is within the target period, configure the second enable attribute to be enabled if it is determined that the second enable attribute is not configured to be enabled.

As an embodiment, the apparatus further comprises: and the time period determining unit is used for determining the target time period from the NAT rule to be detected.

As an embodiment, the apparatus further comprises: a first enabling attribute determining unit, configured to determine, when receiving an instruction that the NAT rule to be detected is configured, the first enabling attribute from the NAT rule to be detected; and determining that the first enable attribute is configured to be enabled.

As an embodiment, the apparatus further comprises: the message processing unit is used for receiving the message to be processed; and when the second enabling attribute of the NAT rule to be detected is determined to be enabling, processing the message according to the NAT rule to be detected.

For the process of implementing the respective functions by the functional units in this embodiment, please refer to the content described in the embodiment shown in fig. 1, which is not described herein again.

Referring to fig. 3, fig. 3 is a schematic structural diagram of an electronic device 300 according to an embodiment of the present application, where the electronic device may be a network security communication device in the above embodiment, and the electronic device 300 may be a personal computer (personal computer, PC), a tablet computer, a smart phone, a personal digital assistant (personal digital assistant, PDA), or the like.

The electronic device 300 may include: memory 302, process 301, communication interface 303, and a communication bus for enabling the connected communication of these components.

The Memory 302 is used for storing various data such as the computer program instructions corresponding to the NAT rule enabling attribute configuration method and apparatus provided by the embodiments of the present application, where the Memory 302 may be, but is not limited to, a random access Memory (Random Access Memory, RAM), a Read Only Memory (ROM), a programmable Read Only Memory (Programmable Read-Only Memory, PROM), an erasable Read Only Memory (Erasable Programmable Read-Only Memory, EPROM), an electrically erasable Read Only Memory (Electric Erasable Programmable Read-Only Memory, EEPROM), and the like.

The processor 301 is configured to read and execute a corresponding computer program instruction of an enabling attribute configuration method and apparatus of a NAT rule stored in the memory, so as to determine whether the current moment is within a predetermined target time period under a condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled; determining a second enabling attribute of the NAT rule to be detected; and when the current moment is determined to be within the target time period, configuring the second enabling attribute to be enabled.

The processor 301 may be an integrated circuit chip, and has signal processing capability. The processor 301 may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The disclosed methods, steps, and logic blocks in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

A communication interface 303 for receiving or transmitting data.

In addition, the embodiment of the application also provides a storage medium, in which a computer program is stored, which when run on a computer, causes the computer to execute the method provided by any one of the embodiments of the application.

In summary, according to the method, the device, the electronic device and the storage medium for configuring the enabling attribute of the NAT rule provided by the embodiments of the present application, by presetting the target time period of the NAT rule to be detected, and automatically determining whether the current moment is within the target time period under the condition that the first enabling attribute of the NAT rule to be detected is enabled, if so, automatically configuring the second enabling attribute of the NAT rule to be detected as enabled, wherein the above process does not need to manually judge, and does not need to manually and continuously configure the second enabling attribute of the NAT rule to be detected, so that the configuration is accurate, the efficiency is high, and the cost is low.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The apparatus embodiments described above are merely illustrative, for example, of the flowcharts and block diagrams in the figures that illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based devices which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present application may be integrated together to form a single part, or each module may exist alone, or two or more modules may be integrated to form a single part.

Claims

1. An enabling attribute configuration method of NAT rules, each NAT rule including a first enabling attribute and having a second enabling attribute, the first enabling attribute characterizing whether modification of the second enabling attribute of the NAT rule is required, and the second enabling attribute characterizing whether the NAT rule is enabled, the method comprising:

under the condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled, determining whether the current moment is within a predetermined target time period;

determining a second enabling attribute of the NAT rule to be detected;

configuring the second enabling attribute to be enabled when the current moment is determined to be within the target time period;

wherein the determining the second enabling attribute of the NAT rule to be detected includes:

searching a second enabling attribute corresponding to the NAT rule to be detected from the corresponding relation between the pre-stored NAT rule and the second enabling attribute;

wherein before determining whether the current moment is within the predetermined target time period under the condition that the first enabling attribute of the NAT rule to be detected is configured to be enabled, the method further includes:

when an instruction that the NAT rule to be detected is configured is received, determining the first enabling attribute from the NAT rule to be detected;

determining that the first enable attribute is configured to be enabled;

after determining that the first enabling attribute of the NAT rule to be detected is configured to be enabled, determining whether the NAT rule to be detected has a time attribute, and if so, extracting the target time period from the NAT rule to be detected.

2. The method according to claim 1, wherein the method further comprises:

the second enable attribute is configured to be disabled upon determining that the current time is not within the target time period.

3. The method of claim 1, wherein the configuring the second enable attribute of the NAT rule to be detected to enable when the current time is determined to be within the target time period comprises:

and when the current moment is determined to be within the target time period, if the second enabling attribute is determined not to be configured to be enabled, configuring the second enabling attribute to be enabled.

4. The method according to claim 1, wherein the method further comprises:

receiving a message to be processed;

and when the second enabling attribute of the NAT rule to be detected is determined to be enabling, processing the message according to the NAT rule to be detected.

5. An enabling attribute configuration apparatus for NAT rules, each NAT rule including a first enabling attribute and having a second enabling attribute, the first enabling attribute characterizing whether modification of the second enabling attribute of the NAT rule is required, the apparatus comprising:

a time validity determining unit, configured to determine, on a condition that a first enabling attribute of the NAT rule to be detected is configured to be enabled, whether the current time is within a predetermined target time period;

a second enabling attribute determining unit, configured to determine a second enabling attribute of the NAT rule to be detected;

a first configuration unit, configured to configure the second enabling attribute to be enabled when it is determined that the current time is within the target time period;

the second enabling attribute determining unit is specifically configured to find a second enabling attribute corresponding to the NAT rule to be detected from a corresponding relationship between a prestored NAT rule and the second enabling attribute;

a first enabling attribute determining unit, configured to determine, when receiving an instruction that the NAT rule to be detected is configured, the first enabling attribute from the NAT rule to be detected; determining that the first enable attribute is configured to be enabled;

and the time period determining unit is used for determining whether the NAT rule to be detected has the time attribute after determining that the first enabling attribute of the NAT rule to be detected is configured to be enabled, and if so, extracting the target time period from the NAT rule to be detected.

6. The apparatus of claim 5, wherein the apparatus further comprises:

and a second configuration unit, configured to configure the second enabling attribute to be disabled when it is determined that the current time is not within the target time period.

7. An electronic device comprising a memory and a processor, the memory having stored therein computer program instructions that, when read and executed by the processor, perform the method of any of claims 1-4.

8. A storage medium having stored thereon computer program instructions which, when read and executed by a computer, perform the method of any of claims 1-4.