CN105391684A - Centralized management method and centralized management device for strategies - Google Patents

Abstract

The present invention provides a method for centralized management of policies and a centralized management device, wherein the method may include: the centralized management device pre-creates a policy library including multiple policies; groups multiple clients in the computer network; Multiple policies are included, and corresponding policies are assigned to clients belonging to the same group; the assigned policies are delivered to corresponding clients respectively. According to this solution, by grouping multiple clients in the computer network, it is only necessary to assign a policy to one group to complete the policy assignment to all clients included in the group, thereby improving the efficiency of policy configuration delivery .

Description

A method for centralized management of policies and centralized management equipment

technical field

The present invention relates to the technical field of policy management, in particular to a centralized policy management method and centralized management equipment.

Background technique

With the rapid development of computer network technology, more and more security products are deployed in the network. In order to ensure the security performance of the network, it is necessary to configure and issue security policies for each device included in the network.

In the existing policy management method, the audit management device, the super management device and the security management device at the management end configure corresponding policies for each device included in the network one by one, and issue the configured security policies to the corresponding devices. And different management terminals store the strategies issued by them.

Since more and more devices are included in the computer network, when configuring and delivering a security policy for each device, a large amount of resources is consumed, and the efficiency of configuration delivery is low.

Contents of the invention

In view of this, the present invention provides a centralized policy management method and centralized management equipment, so as to improve the efficiency of issuing policy configurations.

In the first aspect, the present invention provides a method for centralized management of policies, which is applied to a centralized management device, and the centralized management device pre-creates a policy library including multiple policies; it also includes:

Group multiple clients in a computer network;

According to multiple policies included in the policy library, assign corresponding policies to clients belonging to the same group;

Send each policy that has been allocated to the corresponding client.

Preferably,

The grouping of multiple clients in the computer network includes: grouping clients with the same attribute in the computer network into the same group according to the attributes of the clients;

or,

The grouping of multiple clients in the computer network includes: grouping the clients belonging to the same host in the computer network into the same group according to the identifiers of the hosts to which the clients belong.

Preferably,

Each policy in the policy library includes at least one rule group;

The rule group includes corresponding security rules respectively configured for the objects to be protected;

Wherein, each rule group includes at least one type of the following rules: security mark rules, file protection rules, process protection rules, registry protection rules and trust list protection rules.

Preferably,

It further includes: pre-creating a policy decision message queue and a client message queue corresponding to each client; and pre-creating a policy decision thread for monitoring the policy decision message queue;

The described strategies of completing the assignment are delivered to the corresponding clients respectively, including:

Send each strategy that has been allocated to the policy decision message queue, and the policy decision thread executes policy decision processing on each strategy sent to the policy decision message queue, and determines the client identifier to which each strategy belongs according to the decision result;

According to the determined client ID, send each policy to the client message queue corresponding to the corresponding client, so that when the corresponding client monitors that the corresponding client message queue includes the policy, it will send the corresponding client The policies in the terminal message queue are taken out for storage.

Preferably,

Before sending each strategy that has been allocated to the corresponding client respectively, it further includes: converting the data structure of each strategy into a HashMap data structure, wherein the converted HashMap data structure includes: an identifier for representing the client The keyword key and the field value used to represent the policy content;

The step of performing policy decision processing on each policy delivered to the policy decision message queue, and determining the client ID to which each policy belongs according to the decision result includes: according to each policy sent to the policy decision message queue The corresponding keyword key determines the client ID to which the corresponding policy belongs.

Preferably,

It further includes: creating a client response queue in advance;

It further includes: when monitoring that the client response queue includes a response message, parsing out the client identifier and the corresponding target policy included in the response message, and judging whether the target policy needs to be synchronized, if synchronization is required, then according to The target group to which the client corresponding to the client identifier included in the response message belongs, sends the target policy to the client message queues respectively corresponding to other clients in the target group, so that the target policy Synchronize to other clients in the target group.

In the second aspect, the present invention also provides a centralized management device, including:

Create a unit for creating a strategy library including multiple strategies;

A division unit, used to group multiple clients in the computer network;

An allocation unit, configured to assign corresponding target policies to clients belonging to the same group according to multiple policies included in the policy library;

The sending unit is configured to send each policy that has been allocated to the corresponding client respectively.

Preferably,

The creating unit is further configured to create a policy decision message queue and a client message queue corresponding to each client; and pre-create a policy decision thread for monitoring the policy decision message queue;

The delivery unit is specifically configured to send each strategy that has been allocated to the policy decision message queue, and use the policy decision thread to perform policy decision processing on each strategy sent to the policy decision message queue, and according to the decision result Determine the client ID to which each policy belongs; according to the determined client ID, send each policy to the client message queue corresponding to the corresponding client, so that the corresponding client is monitored in the corresponding client message queue When the policy is included, the policy in the corresponding client message queue is taken out and stored.

Preferably,

It further includes: a conversion unit, which is used to convert the data structure of each strategy into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field value used to represent the content of the strategy;

The delivery unit is specifically configured to determine the client identifier to which the corresponding policy belongs according to the keyword key corresponding to each policy delivered to the policy decision message queue.

Preferably,

The creation unit is used to create a client response queue;

It further includes: a synchronization unit, configured to parse out the client ID and the corresponding target policy included in the response message when monitoring that the client response queue includes a response message, and determine whether the target policy needs to be synchronized, if If synchronization is required, then according to the target group to which the client corresponding to the client identifier included in the response message belongs, the target policy is sent to the client message queues respectively corresponding to other clients in the target group, so as to Synchronizing the target policy to other clients in the target group.

The embodiment of the present invention provides a centralized management method of policies and a centralized management device. By grouping multiple clients in a computer network, all the policies included in the group can be completed only by assigning a policy to one group. Client-side policy allocation, which can improve the efficiency of policy configuration delivery.

Description of drawings

Fig. 1 is the flow chart of the method provided by the embodiment of the present invention;

Fig. 2 is a flow chart of a method provided by another embodiment of the present invention;

Fig. 3 is a structural diagram of a centralized management system provided by an embodiment of the present invention;

FIG. 4 is a hardware architecture diagram of a centralized management device provided by an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of a centralized management device provided by an embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a centralized management device provided by another embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Apparently, the described embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As shown in Figure 1, the embodiment of the present invention provides a method for centralized management of policies, which is applied to a centralized management device, and the centralized management device creates a policy library in advance; the method may include the following steps:

Step 101: Group multiple clients in the computer network.

Step 102: According to the multiple policies included in the policy library, assign corresponding policies to the clients belonging to the same group.

Step 103: Send each policy that has been allocated to the corresponding client respectively.

According to the centralized policy management method provided in this embodiment, by grouping multiple clients in the computer network, only one group is required to assign a policy to complete the policy assignment to all clients included in the group, thereby It can improve the efficiency of policy configuration delivery.

In a preferred embodiment of the present invention, in order to further improve the efficiency of policy delivery, a policy decision message queue and a client message queue corresponding to each client can be pre-created; and a policy decision thread for monitoring the policy decision message queue can be pre-created .

When each strategy that has been allocated is delivered to the corresponding client, it can be delivered in the following way: each strategy that is allocated is sent to the policy decision message queue, and the policy decision thread sends it to the policy decision Each policy in the message queue executes policy judgment processing respectively, and determines the client identifier to which each strategy belongs according to the judgment result; according to the determined client identifier, sends each strategy to the client message queue corresponding to the corresponding client, so as to When the corresponding client monitors that the policy is contained in the message queue of the corresponding client, it takes out and stores the policy in the message queue of the corresponding client.

In a preferred embodiment of the present invention, in order to improve the decision efficiency of the policy decision thread on the client to which the strategy belongs in the policy decision message queue, before sending each strategy that has been allocated to the corresponding client respectively, each strategy The data structure of the HashMap is converted into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field value used to represent the content of the policy; when determining the client identity to which each policy belongs, it can be The determination is performed in the following manner: according to the keyword key corresponding to each policy delivered to the policy decision message queue, the client identifier to which the corresponding policy belongs is determined.

By converting the policy data structure into a HashMap data structure, the content of the policy and the client ID to which the policy belongs can be quickly obtained according to the characteristics of the HashMap data structure, thereby further improving the efficiency of policy delivery.

In a preferred embodiment of the present invention, it is also possible to configure policies for the client in a self-defined form. After customizing the policy for a certain client, it is necessary to further determine whether to synchronize the policy to the group to which the client belongs. of other clients. Therefore, it may further include: pre-creating a client response queue; when monitoring that the client response queue includes a response message, parsing out the client ID and the corresponding target policy included in the response message, and judging the target policy Whether synchronization is required, if synchronization is required, according to the target group to which the client corresponding to the client ID included in the response message belongs, the target policy is sent to the clients corresponding to other clients in the target group message queue to synchronize the target policy to other clients in the target group.

By creating a client response queue, after the client is configured with a custom policy, it can be automatically uploaded to the client response queue, so that the centralized management device can determine whether to synchronize it, thereby improving the flexibility of policy allocation sex.

In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

As shown in Figure 2, the embodiment of the present invention provides a method for centralized management of policies, which may include the following steps:

Step 201: Establish a centralized management device connected to the management terminal and the client, and the management terminal creates a policy library by controlling the centralized management device.

In the prior art, different management terminals need to separately store the policies issued to each client. Due to the large number of devices in the computer network, it is easy to cause confusion in policy management.

In this embodiment, a centralized management device can be established, which connects the management terminal and the client. Please refer to Figure 3, which is a structural diagram of the centralized management system. Different management terminals can be managed through the centralized Policies are configured on the device for the client, and the configured policies can be stored in the policy library of the centralized management device, so that the policies can be managed centrally and the policies can be managed in an orderly manner.

Wherein, the policy configured by the management terminal for the client may include: a system security policy, a network security policy, an alarm policy, and the like.

In this embodiment, the centralized management device can create a policy library for storing the policies configured by the management terminal for the client.

In this embodiment, the following policy models can be configured:

Each policy included in the policy library can include at least one rule group, where a rule group includes a set of similar or related rules, including corresponding security rules for the allocation and configuration of the objects to be protected; the policy is based on business needs A collection of specified rule groups.

Wherein, a policy may contain multiple rule groups, and a rule group is composed of multiple rules of different categories. Wherein, the rule group may include at least one type of the following rules: security mark rule, file protection rule, process protection rule, registry protection rule and trust list protection rule; wherein, each type of rule may define at least one rule.

In this embodiment, the following policy creation modes can be set: a system predefined mode and a user-defined mode. Among them, you can set the policy created in the system predefined way to not allow operations such as deletion and editing. If you need to modify the policy created in the system predefined way, you can copy the policy, and edit and edit the copied policy. Issued.

In this embodiment, the grouping method in the computer network can be set: 1. According to the attributes of the clients, the clients with the same attributes are divided into the same group; 2. According to the host IDs to which the clients belong, the Clients of the same host are grouped into the same group. 3. Other grouping methods.

In this embodiment, the priority of the delivery method can be set, for example, the priority of grouping and delivery according to the host to which the client belongs is higher than the priority of grouping and delivery according to the client attribute.

In this embodiment, the policy management page may include the following four parts:

Rule group management: used to manage rule groups and define security rules based on protected objects.

Policy library management: used to customize policies according to business needs, and rule groups can be combined arbitrarily.

Group distribution rules: used to distribute the policies configured in the policy library to clients belonging to the same group in batches. When the same client is divided into multiple groups according to different grouping methods, and has received policies assigned to it by multiple groups, you can select the policy issued by the group delivery method with higher group priority as the its allocation strategy.

Client policy: It is used to view the assigned policy through the dimension of the client, and can also personalize the rules for the client.

Step 202: Group multiple clients in the computer network.

In this embodiment, multiple clients in the computer network may be grouped according to any one or more of the foregoing grouping manners.

In a preferred embodiment of the present invention, multiple clients in the computer network are grouped according to the above-mentioned grouping manner.

Step 203: According to the multiple policies included in the policy library, assign corresponding policies to the clients belonging to the same group.

Step 204: Convert the data structure of each policy into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field value used to represent the content of the policy.

In this embodiment, in order to improve the efficiency of obtaining the client ID corresponding to each policy, the data structure of each policy may be converted into a HashMap data structure. Wherein, each strategy stored in the strategy library may also be stored in the form of a HashMap data structure, so as to improve the search speed.

Among them, the HashMap data structure can be as follows:

typedefstructGroupPolicy

{

intpriority;

intpolicyid;

}GroupListObject;

typedefstructPolicyObject

{

List<GroupListObject>HIPSlist;

List<GroupListObject>ADlist;

List<GroupListObject>SLlist;

List<GroupListObject>FClist;

List<GroupListObject>RAlist;

inthostpolicy;

intpolicytype;

}ValueObject;

HashMap<unsignedint, ValueObject>

Step 205: Send each policy converted into the HashMap data structure to the policy decision message queue.

In this embodiment, in order to determine which group of clients each assigned policy belongs to, a policy decision message queue (Jqueue) and a policy decision thread can be created in advance, wherein the policy decision message queue is used to receive each issued policy , the policy decision thread is used to monitor the policy decision message queue.

Step 206: When the policy decision thread monitors that the policy decision message queue contains policies, it determines the client identifier to which the corresponding policy belongs according to the keyword key corresponding to each included policy.

Step 207: According to the determined client ID, deliver each policy to the client message queue corresponding to the corresponding client.

In this embodiment, in order to quickly deliver each policy to a corresponding client, a client message queue (Cqueue) corresponding to each client may be established in advance. For example, when each client registers, a Cqueue is created for each client, where the name of the Cqueue can be an identifier for the client. When there is a strategy that needs to be delivered to the client, the data of the strategy is assembled into Json format and added to the corresponding client message queue, and the client waits for the client to retrieve the message from the client message queue.

In this embodiment, after the client ID corresponding to the policy is determined, other client IDs that belong to the same group as the client ID are determined according to the group, and the policy is delivered to each client in the group. in the client message queue.

Step 208: When the client monitors that the corresponding client message queue contains policies, it takes out the policy from the corresponding client message queue and stores it.

In this embodiment, a message bus between the centralized management device and the client can be established, so that when the centralized management device transmits data with the client, the message bus can be used for transmission and processing.

Step 209: Create a client response queue (Rqueue) and a policy synchronization thread for monitoring the client response queue. When the policy synchronization thread monitors that the client response queue includes message content, parse out the information included in the response message Client ID and corresponding target policy.

Step 210: Determine whether the target policy needs to be synchronized, and if it needs to be synchronized, send the target policy to other clients in the target group according to the target group to which the client corresponding to the client ID included in the response message belongs The target policy is synchronized to other clients in the target group.

In this embodiment, the following threads can also be created:

Main thread: used to initialize data and create threads.

Monitoring thread: used to monitor the status of the policy decision thread and policy synchronization thread, and restart the thread if the thread status is found to be abnormal.

According to the policy centralized management method provided in this embodiment, by grouping multiple clients in the computer network, only one group needs to assign a policy to complete the policy assignment to all clients included in the group, so that Improve the efficiency of policy configuration delivery.

As shown in FIG. 4 and FIG. 5 , an embodiment of the present invention provides a centralized management device. The device embodiments can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, as shown in Figure 4, it is a hardware structural diagram of the device where the centralized management device is located in the embodiment of the present invention, except for the processor, memory, network interface, and non-volatile memory shown in Figure 4 In addition, the device where the device in the embodiment is located may generally include other hardware, such as a forwarding chip responsible for processing packets, and the like. Taking software implementation as an example, as shown in Figure 5, as a device in a logical sense, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for operation by the CPU of the device where it is located. The centralized management equipment provided in this embodiment includes:

A creating unit 501, configured to create a policy library including multiple policies;

A division unit 502, configured to group multiple clients in the computer network;

The assigning unit 503 is configured to assign corresponding target policies to clients belonging to the same group according to multiple policies included in the policy library.

The delivery unit 504 is configured to deliver the allocated policies to corresponding clients respectively.

further,

The creating unit 501 is further configured to create a policy decision message queue and a client message queue corresponding to each client; and pre-create a policy decision thread for monitoring the policy decision message queue;

The delivery unit 504 is specifically configured to send each strategy that has been allocated to the policy decision message queue, and use the policy decision thread to perform policy decision processing on each strategy delivered to the policy decision message queue, according to the decision As a result, the client ID to which each policy belongs is determined; according to the determined client ID, each policy is sent to the corresponding client message queue of the corresponding client, so that the corresponding client can monitor the corresponding client message queue When the policy is included in the policy, the policy in the corresponding client message queue is taken out and stored.

In a preferred embodiment of the present invention, as shown in Figure 6, the centralized management device may also include:

The conversion unit 601 is configured to convert the data structure of each strategy into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field value used to represent the content of the strategy;

The delivery unit 504 is specifically configured to determine the client identifier to which the corresponding policy belongs according to the keyword key corresponding to each policy delivered to the policy decision message queue.

further,

The creating unit 501 is configured to create a client response queue;

It further includes: a synchronizing unit 602, configured to parse out the client ID and the corresponding target policy included in the response message when it is monitored that the client response queue includes a response message, and determine whether the target policy needs to be synchronized, If synchronization is required, according to the target group to which the client corresponding to the client identifier included in the response message belongs, the target policy is sent to the client message queues respectively corresponding to other clients in the target group, to synchronize the target policy to other clients in the target group.

Further, the dividing unit 502 is specifically configured to divide clients with the same attribute in the computer network into the same group according to the attributes of the clients;

or,

The dividing unit 502 is specifically configured to divide the clients belonging to the same host in the computer network into the same group according to the identifier of the host to which the clients belong.

Further, each policy in the policy library includes at least one rule group;

The rule group includes corresponding security rules respectively configured for the objects to be protected;

Wherein, each rule group includes at least one type of the following rules: security mark rules, file protection rules, process protection rules, registry protection rules and trust list protection rules.

In summary, the embodiments of the present invention can at least achieve the following beneficial effects:

1. In the embodiment of the present invention, by grouping multiple clients in the computer network, it is only necessary to assign a strategy to one group to complete the strategy assignment to all clients included in the group, thereby improving the policy The efficiency of configuration delivery.

2. In the embodiment of the present invention, create a policy decision message queue and a client message queue corresponding to each client; and create a policy decision thread for monitoring the policy decision message queue, and send each policy that has been allocated to the policy In the decision message queue, the policy decision thread executes policy decision processing on each strategy sent to the policy decision message queue, and determines the client ID to which each strategy belongs according to the decision result, thereby improving the efficiency of policy delivery.

3. In the embodiment of the present invention, by converting the data structure of each policy into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field used to represent the content of the policy value; when determining the client identifier to which each strategy belongs, it can be determined in the following manner: according to the keyword key corresponding to each strategy in the policy judgment message queue issued to the policy, the client identifier to which the corresponding strategy belongs is determined, so that It can improve the decision efficiency of the policy decision thread on the client to which the policy belongs in the policy decision message queue, thereby improving the efficiency of policy delivery.

4. In the embodiment of the present invention, the centralized management mode is adopted, which can be used for users with multiple client devices, which can save the user's cost and facilitate the management of the client devices by technicians. Through centralized management of devices, system security policies, network security policies, and alarm policies can be customized and distributed for client devices. This policy centralized management method can support the management of more than 3,000 client devices, and the configuration is simple, flexible and efficient. In addition, the communication between the centralized management device and the client can carry out asynchronous transmission and processing of messages through the message bus, and the loose coupling between the system function modules can withstand higher business volume, which greatly improves the system throughput and performance.

The information exchange and execution process among the units in the above-mentioned equipment are based on the same concept as the method embodiment of the present invention, and the specific content can refer to the description in the method embodiment of the present invention, and will not be repeated here.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or sequence. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a """""" does not exclude the presence of additional same elements in the process, method, article or apparatus comprising said element.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by program instructions related hardware, and the aforementioned programs can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that the above descriptions are only preferred embodiments of the present invention, and are only used to illustrate the technical solution of the present invention, and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (10)

1. a centralized management method of strategy, it is characterized in that, is applied to centralized management equipment, and described centralized management equipment pre-creates the strategy storehouse that comprises multiple strategies; Also includes: Group multiple clients in a computer network; According to multiple policies included in the policy library, assign corresponding policies to clients belonging to the same group; Send each policy that has been allocated to the corresponding client respectively. 2. The method of claim 1, wherein, The grouping of multiple clients in the computer network includes: grouping clients with the same attribute in the computer network into the same group according to the attributes of the clients; or, The grouping of multiple clients in the computer network includes: grouping the clients belonging to the same host in the computer network into the same group according to the identifiers of the hosts to which the clients belong. 3. The method of claim 1, wherein, Each policy in the policy library includes at least one rule group; The rule group includes corresponding security rules respectively configured for the objects to be protected; Wherein, each rule group includes at least one type of the following rules: security mark rules, file protection rules, process protection rules, registry protection rules and trust list protection rules. 4. The method of claim 1, wherein, It further includes: pre-creating a policy decision message queue and a client message queue corresponding to each client; and pre-creating a policy decision thread for monitoring the policy decision message queue; The described strategies of completing the assignment are delivered to the corresponding clients respectively, including: Send each strategy that has been allocated to the policy decision message queue, and the policy decision thread executes policy decision processing on each strategy sent to the policy decision message queue, and determines the client identifier to which each strategy belongs according to the decision result; According to the determined client ID, each policy is sent to the client message queue corresponding to the corresponding client, so that when the corresponding client monitors that the corresponding client message queue includes the policy, it will send the corresponding client The policies in the end message queue are taken out for storage. 5. The method of claim 3, wherein, Before sending each strategy that has been allocated to the corresponding client respectively, it further includes: converting the data structure of each strategy into a HashMap data structure, wherein the converted HashMap data structure includes: an identifier for representing the client The keyword key and the field value used to represent the policy content; The step of performing policy decision processing on each policy delivered to the policy decision message queue, and determining the client ID to which each policy belongs according to the decision result includes: according to each policy sent to the policy decision message queue The corresponding keyword key determines the client ID to which the corresponding policy belongs. 6. The method according to any one of claims 1-5, characterized in that, It further includes: creating a client response queue in advance; It further includes: when monitoring that the client response queue includes a response message, parsing out the client identifier and the corresponding target policy included in the response message, and judging whether the target policy needs to be synchronized, if synchronization is required, then according to The target group to which the client corresponding to the client identifier included in the response message belongs, sends the target policy to the client message queues respectively corresponding to other clients in the target group, so that the target policy Synchronize to other clients in the target group. 7. A centralized management device, characterized in that it comprises: Create a unit for creating a strategy library including multiple strategies; A division unit, used to group multiple clients in the computer network; An allocation unit, configured to assign corresponding target policies to clients belonging to the same group according to multiple policies included in the policy library; The sending unit is configured to send each policy that has been allocated to the corresponding client respectively. 8. The centralized management device according to claim 7, characterized in that: The creating unit is further configured to create a policy decision message queue and a client message queue corresponding to each client; and pre-create a policy decision thread for monitoring the policy decision message queue; The delivery unit is specifically configured to send each strategy that has been allocated to the policy decision message queue, and use the policy decision thread to perform policy decision processing on each strategy sent to the policy decision message queue, and according to the decision result Determine the client ID to which each policy belongs; according to the determined client ID, send each policy to the client message queue corresponding to the corresponding client, so that the corresponding client is monitored in the corresponding client message queue When the policy is included, the policy in the corresponding client message queue is taken out and stored. 9. The centralized management device according to claim 8, characterized in that: It further includes: a conversion unit, which is used to convert the data structure of each strategy into a HashMap data structure, wherein the converted HashMap data structure includes: a keyword key used to represent the identity of the client and a field value used to represent the content of the strategy; The delivery unit is specifically configured to determine the client identifier to which the corresponding policy belongs according to the keyword key corresponding to each policy delivered to the policy decision message queue. 10. The centralized management device according to any one of claims 7-9, characterized in that, The creation unit is used to create a client response queue; It further includes: a synchronization unit, configured to parse out the client ID and the corresponding target policy included in the response message when monitoring that the client response queue includes a response message, and determine whether the target policy needs to be synchronized, if If synchronization is required, then according to the target group to which the client corresponding to the client identifier included in the response message belongs, the target policy is sent to the client message queues respectively corresponding to other clients in the target group, so as to Synchronizing the target policy to other clients in the target group.