Firewall system of user mode pipeline architecture

Abstract

The invention discloses a firewall system of a user mode pipeline architecture. A control plane is responsible for management and control functions of the system and redirects a message sent from a management port to a kernel protocol stack; a data plane is responsible for main service functions, works in a user mode and can bypass a complex Linux kernel protocol stack to directly obtain messagesfrom a network card. The data plane decomposes firewall function software into a plurality of function modules, each function module is bound to an independent CPU core, one CPU core serves as a maincore and is responsible for receiving messages, data packet receiving and sending are achieved in a polling mode, and an assembly line framework is formed. The firewall system belongs to a software architecture which bypasses a system kernel and is suitable for a firewall function, a network card driver is usually realized in the kernel, the firewall system is realized again in a user mode, the system directly acquires a message from the network card, and the problem of low processing efficiency caused by a traditional firewall Linux kernel is effectively solved.

Description

technical field [0001] The invention belongs to the technical field of digital information transmission, and in particular relates to a firewall system with a user mode pipeline architecture. Background technique [0002] With the development of Internet communication technology and the increasing popularity of Internet applications, the Internet has become the main platform for data transmission and information exchange. As a basic network security product, firewall technology is an important means to achieve network information security, so the application scenarios of firewalls are very wide. [0003] At present, almost all network security vendors with a relatively large scale have launched their own firewall products. In addition to the necessary functions, the performance of firewalls is also the focus of publicity by various security vendors. For example, many firewall products use hardware acceleration such as FPGA, ASIC, and NP. processing technology. However, due...

AI Technical Summary

Problems solved by technology

[0007] Aiming at the problem that the Linux kernel calling in the existing pure software firewall solutions above leads to low packet processing efficiency of the firewall, objectively, it is necessary to design a set of firewall software architecture system that meets the actual needs in order to make full use of multiple Core CPU resources to improve device processing capabilities

Images