Conflict detection rule lockless updating method for network security access control strategy

Abstract

The invention relates to a conflict detection rule lock-free updating method for a network security access control strategy, and belongs to the technical field of network security. According to the method, the memory can be recycled in time under the condition that the lowest delay of the read thread is guaranteed to the greatest extent, and a special write thread recycling stage or a special garbage recycling thread is not needed. According to the method, the cache block is applied in the memory in advance and is defined as the structure of the space table, so that the overhead of the system caused by frequent application and release of the memory can be avoided, and the memory can be allocated in a universal available space table free list. The memory blocks which are not used can be directly used, if the cache blocks are all occupied by the threads, distribution is applied from a system, and the memory blocks are not directly released after being used and are stored by a free list. According to the method, a quick, safe and stable access control rule updating algorithm is realized through a lock-free mechanism, and the problems of low efficiency and large influence on concurrency under the condition of using a lock are avoided.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a lock-free updating method of conflict detection rules for network security access control strategies. Background Art

[0002] At present, most functions of network security protection systems are to execute rule-based security policies on access control components, such as firewalls, virus monitoring, trusted behavior monitoring, host intrusion prevention, etc. No matter where the access control component is implemented, what platform architecture it is based on, or what programming language it uses, it is undoubtedly necessary to set and update the access control rules. Access control rules are undoubtedly a shared resource in a parallel computing environment. The access control execution component needs to obtain the rules and match them, and the rule setting component needs to issue and enable new rules while invalidating old rules.

[0003] The access control execution component generally exists in the context of the subject's access to the object and is executed highly concurrently. Therefore, if the access control rule update algorithm is not implemented well, it may have a serious impact on the overall system performance.

[0004] Usually, there are certain concurrency issues in rule updates. For example, in a concurrent environment, the term "thread" is used to describe code objects that are scheduled in parallel. Based on this, it is assumed that the access control component has the following characteristics: the rule can be abstracted as a pointer, denoted as Rn; the update of the access control rule, that is, the enabling of the new rule Ry and the revocation of the old rule Rx, is implemented by an independent thread T0; the use of the access control rule is in a concurrent environment of multiple threads, and its threads are denoted as T1, T2...Tn; T0's update action on the rule does not occur frequently, which is a low-frequency event relative to the use of the rule.

[0005] Based on the above, the most primitive algorithm for rule update (Algorithm 1) is to use the read-write lock mechanism. For example, the following logic is used to update in T0:

[0006] AcquireForWite(Lock);

[0007] Free(R);

[0008] R = Ry;

[0009] ReleaseForWite(Lock);

[0010] The following logic is used in T1..n to obtain the rules:

[0011] AcquireForRead(Lock);

[0012] Use(R);

[0013] ReleaseForRead(Lock);

[0014] There are two problems in implementing Algorithm 1: if locks cannot be queued, T1..n frequently acquires read locks, and T0 may not be able to obtain write locks and be starved to death; the lock implementation mechanism may affect concurrency performance. For example, spin locks under Windows will increase the interrupt request level, thereby affecting the scheduling of user threads.

[0015] Algorithm 2 is designed to improve Algorithm 1, using a counter to control the release of the rule pointer. Since the increase / decrement of the counter and the setting / getting of the rule pointer are not atomic operations, a local lock is still necessary. T0 can use the following logic to implement the conversion from the old rule to the new rule, where ReferCount is a global variable of type int* and is initialized to point to an integer unit containing 1:

[0016] Acquire(Lock);

[0017] (*ReferCount)--;

[0018] if((*ReferCount) == 0){

[0019] Free(R);

[0020] delete ReferCount;

[0021] }

[0022] R = Ry;

[0023] ReferCount = new int(1);

[0024] Release(Lock);

[0025] The following logic is used in T1..n to obtain, use and release rules:

[0026] Acquire(Lock);

[0027] r = R;

[0028] c = ReferCount;

[0029] (*c)++;

[0030] Release(Lock);

[0031] Use(r);

[0032] Acquire(Lock);

[0033] if((--(*c))==0){

[0034] Free(r);

[0035] delete c;

[0036] }

[0037] Release(Lock);

[0038] The advantage of Algorithm 2 is that there is no lock when Use(r), the lock is local, and the impact on performance is much smaller. However, this algorithm still has the following problems: there is still a lock, and the acquisition of the lock still consumes time and may affect concurrent performance; only considering the replacement of the old and new sets of rules, if you want to adapt to the accumulation effect of rule updates, you need to use a more complex data structure, such as a queue, but the queue position, counter, and access to the rule pointer cannot be atomically operated, so local locks cannot be avoided; T0 thread still has the possibility of starving to death due to failure to obtain the lock.

[0039] Usually, access control rule updates can be implemented based on the RCU (Read-Copy-Update) synchronization mechanism. RCU is an improved read-write lock, but it allows the reading thread to be concurrent with the writing thread, thereby avoiding the blocking of the reading thread. The RCU mechanism still needs to protect the rule pointer as a whole during use, and a recycling mechanism is required to complete the recycling of memory.

[0040] Since locks affect performance and may cause thread starvation, is there a lock-free method? WRRM (Write-Rarely-Read-Many) is a lock-free algorithm based on Hazard pointers and Retired Lists in the form of a mapping. This algorithm can avoid deadlocks and livelocks between read and write threads, and has good performance. However, this lock-free algorithm still requires a memory recycling operation phase, which is completed by the write thread or garbage collection thread. And after each update, this algorithm often cannot recycle the most recently outdated pointer in time, and there will always be a delay of an uncertain period of time.

[0041] Another method that is easy to think of is that T0 sets the rules and does not manage them. That is, when setting the rules, copy the rules synchronously to a linked list, and then ignore its release, and use a dedicated thread to perform garbage collection after a certain period of time. However, this method requires the creation of a new thread, and the additional cost of thread scheduling is often higher than the lock itself (after all, thread scheduling also requires the improvement of the interrupt request level and the use of locks). Therefore, garbage collection threads are not an option.

[0042] Consider another lock-free algorithm that requires the use of atomic operation instructions supported by the CPU to safely control and operate shared data. From an algorithmic perspective, these atomic operation instructions are usually not considered to have locks, although they are usually implemented through the CPU's Lock# signal. The primitive representation of CPU instructions that can atomically complete a certain operation includes but is not limited to the following: (1) Fetch-And-Add (FAA): Atomically implement x = x + a, denoted as function FAA (&x, a), and its return value is the changed value of x; (2) Compare-And-Swap (CAS): Atomically implement if (x == a) {x = y; y = old x;}, denoted as function CAS (&x, a, y), and its return value is a Boolean variable indicating whether the operation is successful.

[0043] The lock-free algorithm uses a large number of atomic operations to replace locks during implementation. Based on the atomic operation capabilities that are generally supported by most CPU architectures, the present invention can implement an efficient, lock-free rule update algorithm. Summary of the invention

[0044] 1. Technical issues to be resolved

[0045] The technical problem to be solved by the present invention is how to provide a lock-free update method for conflict detection rules of network security access control strategies to solve the problems of low efficiency and great impact on concurrency when using locks.

[0046] (II) Technical solution

[0047] In order to solve the above technical problems, the present invention proposes a lock-free update method for conflict detection rules of network security access control policies, which includes the following steps:

[0048] S1. Use the pre-allocation strategy to pre-open a space table in the memory; the space table structure is defined as follows: struct CACHE_ALIGN CRulesManageUnitArray, where CACHE_ALIGN indicates that the structure memory allocation should be based on the integer boundary of the cache line; the structure CRulesManageUnitArray consists of multiple basic units CRulesManageUnit, each of which can store the relevant variables of a rule; count the rule memory and establish the recycle bit Retire_Bit;

[0049] S2. Define a management unit structure CRulesAnchor and apply for a management unit RulesAnchor. The management unit is pinned in the memory by a global variable. The management unit CRulesAnchor is used to manage CRulesManageUnit and CRulesManageUnitArray by setting them to its own pointer variables Tail and Array; Tail is the CRulesManageUnit structure pointer of the management unit, and Array is the space table defined in the queue;

[0050] S3. Allocate a space table and basic units for the new rule, including:

[0051] S31, first determine whether the rule pointer is a null pointer, that is, a null rule; if it is not a null pointer, it means that it is a valid rule;

[0052] S32, under the premise that the rule is a valid rule, determine whether the Array pointer of the current CRulesAnchor structure has been initialized, that is, whether the space table has been initialized. If it is a null pointer, it means that it does not point to the space table. At this time, a memory unit is allocated for the space table, and the memory structure is built on the integer boundary of the cache memory; if it is not a null pointer, the aligned memory is recycled;

[0053] S33. After the space table is built, first point the CRulesManageUnit pointer p to the first basic unit of the space table, and then determine whether the rule pointer contained in the first basic unit is a null pointer, that is, whether it points to a certain rule. If it is null, point it to the new rule to be written, and set the reference count to 1. If it is not null, point the p pointer to the next basic unit and make the judgment again. This cycle continues until the last basic unit. When the last basic unit is still not null, use the NextArray pointer of the current space table to judge each basic unit of the next space table.

[0054] (III) Beneficial effects

[0055] The present invention proposes a lock-free update method for conflict detection rules of network security access control policies. The lock-free update method based on detection rules proposed in the present invention mainly optimizes performance from the following aspects:

[0056] Dynamically allocate aligned memory so that the processor only needs one operation to access it instead of two, thereby improving efficiency;

[0057] Pre-allocate a space table to store data, reduce pop, push and other stack popping and stacking instruction operations, and after the thread is suspended, determine the current cache line usage by setting the highest bit flag, do not recycle memory, and reduce memory allocation time;

[0058] In the CloseRules method of the closing rules, the atomic operations DEC and CAS are used together to prevent the comparison amount from changing due to interruption by other threads, which may cause repeated failures of the CAS operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a flow chart of update rules of the lock-free update method of the detection rules of the present invention;

[0060] Figure 2 Access rule flow chart for the lock-free update method of the detection rule. DETAILED DESCRIPTION

[0061] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0062] In view of this, in order to address the above-mentioned problems, the present invention strives to implement a fast, safe and stable lock-free update method of conflict detection rules for network security access control strategies through a lock-free mechanism, avoiding the problems of low efficiency and great impact on concurrency when using locks.

[0063] To achieve the above object, a method for updating conflict detection rules of network security access control policies without locks according to the present invention comprises the following steps:

[0064] S1. Use the pre-allocation strategy to pre-open a space table in the memory; the space table structure is defined as follows: struct CACHE_ALIGN CRulesManageUnitArray, where CACHE_ALIGN indicates that the structure memory allocation should be based on the integer boundary of the cache line; the structure CRulesManageUnitArray consists of multiple basic units CRulesManageUnit, each of which can store the relevant variables of a rule; count the rule memory and define its highest bit as the recycling bit Retire_Bit. When Retire_Bit is 1, it means that the rule needs to be recycled. When Retir e_Bit is 0, it means that the rule is valid;

[0065] The spatial table structure is defined as follows:

[0066] struct CACHE_ALIGN CRulesManageUnitArray{

[0067] A1 intptr_t ReferCount[CACHE_COUNT-1];

[0068] A2 intptr_t Padding;

[0069] A3 void*RulesPtr[CACHE_COUNT-1];

[0070] A4 CRulesManageUnitArray*NextArray;

[0071] };

[0072] The structure of a basic unit in a spatial table is defined as follows:

[0073] struct CRulesManageUnit{

[0074] A5 intptr_t ReferCount;

[0075] A6 intptr_t Padding[CACHE_COUNT-1];

[0076] A7 void*RulesPtr;

[0077] };

[0078] The structure CRulesManageUnitArray consists of multiple basic units, each of which can store the variables related to a rule. However, if there are many rules, the structure may not be able to store all the rules. Therefore, a pointer is set in the structure CRulesManageUnitArray to point to the next structure. In this way, if the basic unit of the current structure has been used up, the basic unit of the next structure can be used through this pointer. The variables in CRulesManageUnit are the elements of the array.

[0079] A rule consists of two variables, called a basic unit. ReferCount is a reference count variable, which represents how many threads are using this rule; RulesPtr represents a rule pointer, through which this rule can be referenced.

[0080] The recycling bit Retire_Bit is the highest bit of the variable "ReferCount" related to a rule (ReferCount is stored by a cache line, which generally contains 64 bits, and this number varies in different architectures), so the value of Retire_Bit is contained in the ReferCount variable. When implementing this lock-free update algorithm in C language, the value of the highest bit Retire_Bit can be obtained using the following two lines of code:

[0081] int mask=1<<(sizeof(ReferCount)*8-1);

[0082] Return(ReferCount&mask)>>(sizeof(ReferCount)*8-1);

[0083] In order to clearly present the role of the recycle bit in rule updating and rule referencing, the Retire_Bit used directly in this article represents the highest bit of ReferCount.

[0084] Due to the special mechanism of cache, the smallest unit of operation is cache line, rather than a single independent element.

[0085] The reference count variable ReferCount and the rule pointer Rulesptr are separated by a distance of CACHE_COUNT-1, so that when the cache loads the structure CRulesManageUnit, ReferCount and RulesPtr are in different cache lines, allowing different threads that need their values ​​to access them quickly, reducing the probability that a thread is slowed down by a cache miss in multi-threading.

[0086] Among them, CACHE_ALIGN means that the structure memory allocation should be based on the integer boundary of the cache line, and the value set by CACHE_COUNT should cause RulesPtr to be allocated to the next page.

[0087] Considering that most cache lines today are 64 bits, CACHE_ALIG is predefined as alignas(64) and CHCHE_COUNT is predefined as 64 / sizeof(intptr_t).

[0088] Among them, ReferCount is a reference count variable of type intptr_t, which is defined as intptr_t type to increase portability across platforms. sizeof(intptr_t) represents the number of bits of a pointer, so CHCHE_COUNT represents how many pointers can be placed in a cache line.

[0089] Apply for a cache block in advance and define it as the structure of the space table CRulesManageUnitArray to avoid the overhead caused by frequent application and release of memory to the system and implement memory allocation in a general free list.

[0090] Among them, unused memory blocks can be used directly. If all cache blocks are occupied by threads (memory block refers to an area in memory, and cache block refers to memory block that has been allocated to the space table), then apply for allocation from the system. After use, the memory block is not released directly, but is kept in the free list.

[0091] Among them, in the spatial table structure, the pointer NextArray is a node pointer.

[0092] S2. Define a management unit structure CRulesAnchor and apply for a management unit RulesAnchor. The management unit is pinned in the memory by a global variable. The management unit CRulesAnchor is used to manage CRulesManageUnit and CRulesManageUnitArray (including search, access, deletion, and modification) by setting them to its own pointer variables Tail and Array.

[0093] The management unit structure is as follows:

[0094] struct CRulesAnchor{

[0095] A8 CRulesManageUnit*Tail;

[0096] A9 CRulesManageUnitArray*Array;

[0097] };

[0098] Among them, Tail is the CRulesManageUnit structure pointer of the management unit

[0099] Among them, Array is the space table defined in the queue.

[0100] S3. Allocate a space table and basic units for the new rule, including:

[0101] S31, first determine whether the rule pointer is a null pointer (i.e., a null rule); if it is not a null pointer, it indicates that the rule is valid;

[0102] S32, under the premise that the rule is a valid rule, determine whether the Array pointer of the current CRulesAnchor structure has been initialized, that is, whether the space table has been initialized. If it is a null pointer, it means that it does not point to the space table. At this time, a memory unit is allocated for the space table, and the memory structure is built on the integer boundary of the cache memory; if it is not a null pointer, the aligned memory is recycled;

[0103] S33. After the space table is built, first point the CRulesManageUnit pointer p to the first basic unit of the space table, and then determine whether the rule pointer contained in the first basic unit is a null pointer, that is, whether it points to a certain rule. If it is null, point it to the new rule to be written, and set the reference count to 1. If it is not null, point the p pointer to the next basic unit and make the judgment again. This cycle continues until the last basic unit. When the last basic unit is still not null, use the NextArray pointer of the current space table to judge each basic unit of the next space table.

[0104] The new rule management unit structure is as follows:

[0105]

[0106]

[0107] The purpose of setting the B1 statement is to avoid incorrectly referencing a null pointer.

[0108] Among them, statements B4 to B6 define the management unit structure pointer, space table and acquisition queue address respectively.

[0109] Among them, the purpose of statements B10 to B16 is to determine whether the current pointer array is a null pointer. If it is a null pointer, the following operations are performed: Statement B12 is to dynamically allocate aligned memory so that the processor only needs one operation to access it instead of two operations to improve efficiency. Statement B13 is to fill a given value in the new_array memory block. The value filled here is 0 to avoid the uncertainty caused by random numbers. Statements B14 and B15 are to recycle the aligned memory new_array if array is not a null pointer.

[0110] Among them, in statement B17, the first address of the referenced variable is taken out and stored in the p pointer.

[0111] Among them, statements B19 to B31 use the atomic operation CAS to determine whether the rule pointed to by pointer p is a new rule. If it is, it continues to determine whether the reference variable pointed to by pointer p is used by a thread. If the reference count is not zero, it means that there is already a thread using it. The highest bit Retire_Bit is set to 1 through the atomic operation FAA, indicating that its memory is released. If the reference count is zero, it means that it is not used by any thread and can be directly added by 1. The establishment of Retire_Bit avoids the pointer from being recycled too early, that is, it avoids the so-called ABA problem in concurrency problems. Among them, because what is being discussed here is the process of rule update, once the rule is updated, the old rule must be invalid, that is, if the new thread wants to read this rule, it must read the new one, so the reference count of the old rule needs to be released; and if the reference count is zero, it means that no thread is using this rule, so the reference count can be used for the new rule. In order to represent that this new rule is valid, it is necessary to ensure that the reference count is not 0, so it needs to be added by 1.

[0112] Among them, the B30 statement adds the displacement of each offset to the pointer p, and the B32 statement points to the next array again after use.

[0113] S4. Update rules: exchange the new CRulesManageUnit structure pointer p and the &RulesAnchor.Tail address through the atomic operation XCHG, so that &RulesAnchor.Tail points to the new rule;

[0114] The method to update the rules is defined as follows:

[0115] void UpdateRules(void* R)

[0116] {

[0117] C1 CRulesManageUnit*p;

[0118] C2 CRulesManageUnit*Unit=nullptr;

[0119] C3

[0120] C4 p=NewUnit(R);

[0121] C5 Unit=(CRulesManageUnit*)XCHG(&RulesAnchor.Tail,p);

[0122] C6 CloseRules(Unit);

[0123] }

[0124] Among them, in the method of updating rules, the key statement is C5, which exchanges the new CRulesManageUnit structure pointer p and the &RulesAnchor.Tail address through the atomic operation XCHG, so that &RulesAnchor.Tail points to the new rule, and the C6 statement indicates that the memory will not be released after use and is set to a null pointer.

[0125] S5. Closing rules and recycling rules: Determine whether the pointer of this basic unit is a null pointer. If it is a null pointer, it means that it does not need to be closed and returns directly to improve efficiency. If it is not a null pointer, then when it is determined that the count variable is zero after being decremented by one, the reference count variable is compared with 0 through atomic operations. If they are equal, the DeleteUnit method is called to set the rule pointer of this basic unit to null, and the RETIRE_BIT bit of the reference count of this basic unit is enabled.

[0126] The methods for closing rules and recycling rules are defined as follows:

[0127]

[0128] Among them, statements D1 and D2 determine that if the Unit pointer is empty, they can return directly to improve execution efficiency.

[0129] Among them, statements D6 and D10 are used to compare the reference count variable with 0 through atomic operations when the count variable is judged to be zero. If they are equal, the DeleteUnit method is called to set the pointer to zero.

[0130] S6. Get rules: Use a while loop to determine whether the current pointer is a null pointer. If it is a null pointer, directly return a null pointer; otherwise, return the latest rule unit.

[0131] The definition of the get rule method is as follows:

[0132]

[0133] Among them, the method of obtaining rules mainly includes E4 and E8 statements. A while loop is used to determine whether the current pointer is a null pointer. If it is a null pointer, a null pointer is directly returned. The judgment statement is to reduce the reference count by 1, which means that if the highest bit is 1, it fails.

[0134] Embodiment 1:

[0135] In the following description, since each rule update uses a basic unit different from that before the rule update, the present invention refers to the rule before the rule update as the next-new rule or the rule before the update; at the same time, since the reference counts of new rules, next-new rules, and next-new rules may not be 0 at the same time, for the sake of simplicity, the following description only considers the process of replacing the next-new rule with the new rule.

[0136] In the following description, cache line and cache page are the same concept and can be used interchangeably. Cache line or cache page represents the minimum unit that the cache loads from the memory at one time. Each cache line or cache page contains multiple basic units, such as Figure 1 shown.

[0137] In the following description, the newest rule needs to be closed and recycled, where recycling means setting the rule pointer of the basic unit corresponding to the newest rule to null, so that when there is a new rule, this basic unit can be used again. Closing means releasing the memory space occupied by the rule object of the newest rule to prevent the memory space from increasing due to frequent rule updates. Closing and recycling operations are usually used together.

[0138] Figure 1 The flowchart of a lock-free update method of a detection rule in some embodiments of the present invention. The rule update and rule access of the lock-free update method include the following steps:

[0139] Taking a complete rule reading and writing as an example, the features of the present invention are explained in detail.

[0140] In the initial case, there is no regular memory, no read / write threads, and a CRulesAnchor structure is defined (such as Figure 1 ① in the figure contains two pointers: the Array pointer points to the CRulesManageUnitAr ray structure (such as Figure 1 ②), the tail pointer points to the CRulesManageUnit structure (such as Figure 1 ③).

[0141] At this time, there is no rule, and a thread needs to exist first to perform rule update operations. Therefore, a basic unit of the space table needs to be prepared for this rule (such as Figure 1 ② in this example, this basic unit contains two pointers, one pointer pointing to the rule object (such as Figure 1 ⑤ in ), and another pointer points to the reference count of the rule (that is, how many threads are using this rule, such as Figure 1 ④) in the above.

[0142] As shown in code B1-B16, when allocating a space table and basic units for a new rule, first determine whether the rule pointer is a null pointer (i.e., a null rule). If it is not a null pointer, it means that it is a valid rule. Under the premise that the rule is a valid rule, as shown in lines B6 and B10 of code, it is necessary to determine whether the Array pointer of the current CRulesAnchor structure has been initialized (i.e., whether the space table has been initialized). If it is a null pointer, it means that it does not point to the space table. Therefore, it is necessary to allocate memory units for the space table as shown in lines B12 and B13 of code (this step determines whether the current pointer array is a null pointer. If it is a null pointer, dynamically allocate aligned memory so that the processor access only requires one operation instead of two to improve efficiency). The memory structure is built on the integer boundary of the cache memory (i.e., the integer boundary of the cache line, and its allocated memory structure is as shown in lines B12 and B13 of code). Figure 1 As shown in Figure 1-4, the space table structure is defined as struct CACHE_ALIGN CRulesManageUnitArray (as shown in Code A1-A4, CACHE_ALIGN means that the structure memory allocation should be based on the integer boundary of the cache line. The distance between the reference count variable and the rule pointer makes the cache loading structure in different cache lines, so that different threads that need its value can access it quickly. Here, the reference count variable and the rule pointer are in different cache lines). Subsequent operations must load the entire cache line into the cache, perform pointer replacement and other operations on the basic unit of the cache line, rather than just loading one basic unit. Therefore, the smallest unit of operation is the cache line, rather than a single independent element.

[0143] Because a rule update only uses one basic unit of the spatial table (i.e., CRulesManageUnit, the basic unit is Figure 1 As shown), the present invention adopts a pre-allocation strategy to pre-open a space table in the memory. According to the cache size, the space table includes multiple basic units.

[0144] After the space table is built, lines B4 and B17 first point the CRulesManageUnit pointer p to the first basic unit of the space table, and then determine whether the rule pointer contained in the first basic unit is a null pointer (i.e., whether it points to a certain rule). If it is null, it points to the new rule to be written by the present invention, and sets the reference count to 1. If it is not null, the code in line B30 points the p pointer to the next basic unit, and makes a judgment again, and this loops until the last basic unit. When the last basic unit is still not null, the NextArray pointer of the current space table (i.e., the next space table) is used to judge each basic unit of the next space table. In this way, the present invention returns a pointer to the CRulesManageUnit structure (i.e., the pointer p of the basic unit allocated by the present invention for the new rule).

[0145] With the pointer of this basic unit, the present invention can perform rule update operations. As shown in C4, the p pointer points to the basic unit allocated for the new rule R. The C5 line uses the XCHG atomic operation to point the Tail pointer of the global structure CRulesAnchor defined in the present invention to p. Therefore, when other threads access the rule through RulesAnchor.Tail, they access the newly created rule object. After the exchange, the Unit pointer points to the basic unit corresponding to the new rule. This basic unit needs to be closed and recycled (execute the CloseRules function, but it may not be closed and recycled because other threads may be using it, that is, the reference count is greater than 1).

[0146] Assuming that this new rule has no other thread references and the XCHG atomic operation has been exchanged, it is necessary to close and recycle the basic unit corresponding to this new rule, as shown in the CloseRules function. First, it is necessary to determine whether the basic unit pointer is a null pointer. If it is a null pointer, it means that it does not need to be closed and returns directly to improve efficiency. If it is not a null pointer, then statement D6 compares the reference count variable with 0 through atomic operations (the two adjacent reference count variables are compared with 0 to prevent the operating system from scheduling other threads to access this rule and increase the count variable when D5 determines that it is 0). If they are equal, the DeleteUnit method is called to set the rule pointer of this basic unit to null, and the RETIRE_BIT bit of the reference count of this basic unit is enabled (the counting of the rule memory and the establishment of the recycling bit Retire_Bit represent that this unit is no longer used). This step uses atomic operations to operate memory pointers. Through atomic operations, the reference count variable is compared with 0. If the reference count is 0, it is directly increased by one, indicating that a new rule is created; if it is not zero, it means that its RETIRE_BIT bit is enabled, and the recycling bit (Retire_Bit) is reset through the atomic operation FAA and the reference count is changed to 1. Among them, B27 is an atomic operation FAA that resets the recycle bit (Retire_Bit) and changes the reference count to 1; D6-D10 uses atomic operations to perform memory pointer operations. Through atomic operations, the reference count variable is compared with 0. If the reference count is 0, it is directly increased by 1, which means that a new rule is created.

[0147] With the above method of closing and recycling rules, each time a thread accesses this rule, it is necessary to determine whether the rule needs to be closed and recycled after its access is completed, because the rule may have been updated at this time, and this thread is the last thread to access the rule before the update, so after its access is completed, the basic unit before the rule update needs to be closed and recycled.

[0148] Therefore, the method for a thread to obtain rules is shown in the OpenRules function. First, line E1 defines a pointer Unit of the CRulesManageUnit object to be returned. Then line E5 executes the CloseRules function. Because Unit is a null pointer at this time, line E5 directly returns to line E6 when executing the CloseRules function. Line E6 assigns the RulesAnchor.Tail pointer (that is, the last updated rule pointer) to the Unit pointer. Line E8 determines whether the reference count of this basic unit is less than 0 after it is reduced by one. If it is less than 0, it means that the operating system has scheduled other threads to update this rule between lines E6 and E8, and the highest bit (recycling bit) of this basic unit has been set to 1 (the highest bit is 1, which represents a negative number, so it is less than 0). Therefore, it is necessary to execute the function body after do again. First, execute the CloseRules function in line E5 to reduce the reference count of the old rule by one (after reduction, if the reference count is 0, the memory is recycled in time. This operation ensures that the thread will not be Under the premise of termination, the goal is to pursue the minimum performance loss of the rule reading thread and realize timely memory recovery), then line E6 assigns the latest RulesAnchor.Tail to the pointer Unit of the CRulesManageUnit object to be returned, and then executes the reference count reduction operation of line E8 again to determine whether it is less than 0. If it is less than 0, it means that this rule has been updated again, and repeats the loop body content (through the while loop to determine whether the current pointer is a null pointer, if it is a null pointer, it directly returns a null pointer, and the judgment statement is to reduce the reference count by 1, indicating that if the highest bit is 1, it fails) until the latest rule is obtained (at this time, the reference count is not less than 0 after adding one, so it will no longer loop, and line E10 directly returns this basic unit), so far the latest rule unit has been obtained.

[0149] Embodiment 2:

[0150] A lock-free update method for detection rules comprises the following steps:

[0151] The memory structure is built on the integer boundary of the high-level cache memory. A pre-allocation strategy is adopted to pre-open a space table in the memory. The space table structure is defined as follows: struct CACHE_ALIGN CRulesManageUnitArray, where CACHE_ALIGN indicates that the structure memory allocation should be built on the integer boundary of the cache line; the rule memory is counted and the recycling bit Retire_Bit is established; on the premise of ensuring that the thread will not be terminated, the goal is to pursue the minimum performance loss of the rule reading thread and realize timely memory recycling; atomic operations are used for memory pointer operations. Through atomic operations, the reference count variable is compared with 0. If the reference count is not zero, it means that there is a thread in use. The recycling bit Retire_Bit is set to 1 through the atomic operation FAA, indicating that its memory is released. If they are equal, the corresponding method is called to set the pointer to zero.

[0152] Furthermore, the distance between the reference count variable and the rule pointer allows the cache loading structure to be in different cache lines, allowing different threads that need its value to access it quickly, thereby reducing the probability that a thread will be slowed down by a cache miss in multi-threading.

[0153] Furthermore, due to the special mechanism of cache, the minimum unit of operation of the lock-free update method based on detection rules is cache line instead of a single independent element.

[0154] Furthermore, it is determined whether the current pointer array is a null pointer. If it is a null pointer, the memory is dynamically allocated and aligned, so that the processor access only requires one operation instead of two operations to improve efficiency.

[0155] Furthermore, an atomic operation is used to determine whether the rule pointed to by the pointer is a new rule. If so, the reference variable pointed to by the pointer is used by a thread. If the reference count is not zero, it means that a thread is already using it. The highest bit Retire_Bit is set to 1 through an atomic operation, indicating that its memory is released.

[0156] Furthermore, in the method definition of the closing rule and the recycling rule, a while loop is used to determine whether the current pointer is a null pointer. If it is a null pointer, a null pointer is directly returned, and the judgment statement is to decrement the reference count by 1, indicating that if the highest bit is 1, it fails.

[0157] The present invention proposes a lock-free update method for access control rules, which can recycle memory in time while ensuring the lowest delay of the reading thread to the greatest extent, without the need for a special writing thread recovery phase or a special garbage collection thread. The present invention can avoid the overhead of frequent application and release of memory to the system by applying for a cache block in the memory in advance and defining it as a space table structure, and realize memory allocation in a general available space table (free list). Unused memory blocks can be used directly. If the cache blocks are all occupied by threads, they are applied for allocation from the system. After use, the memory blocks are not released directly, but are handed over to the free list for safekeeping. The present invention attempts to implement a fast, safe and stable access control rule update algorithm through a lock-free mechanism, avoiding the problems of low efficiency and great impact on concurrency when using locks.

[0158] The lock-free update method based on detection rules proposed in the present invention mainly optimizes performance from the following aspects:

[0159] Dynamically allocate aligned memory so that the processor only needs one operation to access it instead of two, thereby improving efficiency;

[0160] Pre-allocate a space table to store data, reduce pop, push and other stack popping and stacking instruction operations, and after the thread is suspended, determine the current cache line usage by setting the highest bit flag, do not recycle memory, and reduce memory allocation time;

[0161] In the CloseRules method of the closing rules, the atomic operations DEC and CAS are used together to prevent the comparison amount from changing due to interruption by other threads, which may cause repeated failures of the CAS operation.

[0162] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A lock-free update method for conflict detection rules of network security access control strategy, characterized in that: The method comprises the following steps: S1. Use the pre-allocation strategy to pre-open a space table in the memory; the space table structure is defined as follows: structCACHE_ALIGN CRulesManageUnitArray, where CACHE_ALIGN indicates that the structure memory allocation should be based on the integer boundary of the cache line; the structure CRulesManageUnitArray consists of multiple basic units CRulesManageUnit, each of which can store the relevant variables of a rule; count the rule memory and define its highest bit as the recycling bit Retire_Bit. When Retire_Bit is 1, it means that the rule needs to be recycled, and when Retire_Bit is 0, it means that the rule is valid; S2. Define a management unit structure CRulesAnchor and apply for a management unit RulesAnchor. The management unit is pinned in the memory by a global variable. The management unit CRulesAnchor is used to manage CRulesManageUnit and CRulesManageUnitArray by setting them to its own pointer variables Tail and Array; Tail is the CRulesManageUnit structure pointer of the management unit, and Array is the space table defined in the queue; S3. Allocate a space table and basic units for the new rule, including: S31, first determine whether the rule pointer is a null pointer, that is, a null rule; if it is not a null pointer, it means that it is a valid rule; S32, under the premise that the rule is a valid rule, determine whether the Array pointer of the current CRulesAnchor structure has been initialized, that is, whether the space table has been initialized. If it is a null pointer, it means that it does not point to the space table. At this time, a memory unit is allocated for the space table, and the memory structure is built on the integer boundary of the cache memory; if it is not a null pointer, the aligned memory is recycled; S33. After the space table is built, first point the CRulesManageUnit pointer p to the first basic unit of the space table, and then determine whether the rule pointer contained in the first basic unit is a null pointer, that is, whether it points to a certain rule. If it is null, point it to the new rule to be written, and set the reference count to 1. If it is not null, point the p pointer to the next basic unit and make the judgment again. This cycle continues until the last basic unit. When the last basic unit is still not null, use the NextArray pointer of the current space table to judge each basic unit of the next space table.

2. The method for updating conflict detection rules for network security access control policies without locks according to claim 1, characterized in that: The rule is composed of two variables, which is called a basic unit, wherein ReferCount is a reference count variable, which represents how many threads are using this rule; RulesPtr represents a rule pointer, and this rule is referenced through this variable; the reference count variable ReferCount and the rule pointer Rulesptr are separated by a distance of CACHE_COUNT-1, so that when the cache loads the structure CRulesManageUnit, ReferCount and RulesPtr are in different cache lines.

3. The method for updating conflict detection rules for network security access control policies without locks as claimed in claim 2, characterized in that: The smallest unit of operation is the cache line, not a single independent element.

4. The method for updating conflict detection rules for network security access control policies without locks according to claim 1, characterized in that: CACHE_ALIGN indicates that structure memory allocation should be based on the integer boundary of the cache line, and the value set by CACHE_COUNT should make RulesPtr allocated to the next page; when the number of bits of the cache line is 64, CACHE_ALIG is predefined as alignas(64), and CHCHE_COUNT is predefined as 64 / sizeof(intptr_t); among them, ReferCount is a reference count variable of type intptr_t, sizeof(intptr_t) represents the number of bits of the pointer, so CHCHE_COUNT represents how many pointers can be placed in the cache line.

5. The method for updating conflict detection rules for network security access control policies without locks as claimed in claim 1, characterized in that: In S33, the atomic operation CAS is used to determine whether the rule pointed to by the pointer p is a new rule. If so, it is further determined whether the reference variable pointed to by the pointer p is used by a thread. If the reference count is not zero, it means that a thread is already using it. The atomic operation FAA is used to set the highest bit Retire_Bit to 1, indicating that its memory is released. If the reference count is zero, it means that it is not used by any thread, so just add 1.

6. The method for updating conflict detection rules for network security access control policies without locks as claimed in claim 5, characterized in that: The method also includes: updating rule process: exchanging the new CRulesManageUnit structure pointer p and the &RulesAnchor.Tail address through the atomic operation XCHG, so that &RulesAnchor.Tail points to the new rule.

7. The method for updating conflict detection rules for network security access control policies without locks according to claim 6, characterized in that: The method also includes closing rules and recycling rule processes: judging whether the basic unit pointer is a null pointer, if it is a null pointer, it indicates that it does not need to be closed and directly returns to improve efficiency; if it is not a null pointer, then when it is judged that the count variable is zero after being decremented by one, the reference count variable is compared with 0 through atomic operations, and if they are equal, the DeleteUnit method is called to set the rule pointer of this basic unit to null, and the RETIRE_BIT bit of the reference count of this basic unit is enabled.

8. The method for updating conflict detection rules for network security access control policies without locks as claimed in claim 7, characterized in that: Assuming that this new rule has no other thread references and the XCHG atomic operation has been exchanged, it is necessary to close and recycle the basic unit corresponding to this new rule. First, it is necessary to determine whether the pointer to this basic unit is a null pointer. If it is a null pointer, it means that it does not need to be closed and can be returned directly to improve efficiency. If it is not a null pointer, then when the count variable is decremented by one and is zero, the reference count variable is compared with 0 through atomic operations. If they are equal, the DeleteUnit method is called to set the rule pointer of this basic unit to null, and the RETIRE_BIT bit of the reference count of this basic unit is enabled. The rule memory is counted and the recycling bit Retire_Bit is established, indicating that this unit is no longer in use.

9. The method for updating conflict detection rules for network security access control policies without locks as claimed in claim 5, characterized in that: The method also includes a rule acquisition process: judging whether the current pointer is a null pointer through a while loop, and directly returning a null pointer if it is a null pointer, otherwise returning the latest rule unit.

10. The method for updating conflict detection rules for network security access control policies without locks according to claim 1, characterized in that: The memory structure is built on the integer boundary of the high-level cache memory. A pre-allocation strategy is adopted to pre-open a space table in the memory. The space table structure is defined as follows: struct CACHE_ALIGN CRulesManageUnitArray, where CACHE_ALIGN indicates that the structure memory allocation should be built on the integer boundary of the cache line; the rule memory is counted and the recycling bit Retire_Bit is established; on the premise that the thread will not be terminated, the goal is to pursue the minimum performance loss of the rule reading thread and realize timely memory recycling; atomic operations are used for memory pointer operations. Through atomic operations, the reference count variable is compared with 0. If the reference count is not zero, This means that a thread is already using it, and the atomic operation FAA is used to set the recycle bit Retire_Bit to 1. Indicates that its memory is released. If they are equal, the corresponding method is called to set the pointer to zero.

Images