A method, apparatus, medium, device and product for data packet transmission

Abstract

The application relates to the technical field of data transmission, and particularly provides a data packet transmission method, device, medium, equipment and product. The method can comprise the following steps: receiving a data packet conforming to an access control policy; wherein the access control policy represents a data packet type allowed to be sent by a network security engine; determining an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy comprises a private IP number, a private port number, a network protocol type and the application protocol type; the application protocol type comprises a general protocol, a multicast protocol or an audio / video protocol; calling a protocol interface function corresponding to the application protocol type to detect the data packet, and obtaining a detection result; wherein the detection result represents whether to block the data packet from continuing transmission. The application embodiment can improve the reverse proxy performance and realize effective transmission of various protocol data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission, in particular to a data packet transmission method, device, medium, equipment and product. BACKGROUND

[0002] Reverse proxy refers to accepting connection requests on the Internet by a proxy server, then forwarding the request to a server on the internal network, and returning the result obtained from the server to the client requesting connection on the Internet, at this time the proxy server appears as a reverse proxy server to the outside. The usual workflow of reverse proxy is to listen to IP and port according to the strategy, the client applies for connection to the reverse proxy service and sends data, the reverse proxy accepts downstream connection, establishes upstream connection with the service system, reads data, parses protocol, processes data and forwards data to the service system. However, the reverse proxy architecture in the prior art is single in protocol adaptation, and the reverse proxy performance is low.

[0003] Therefore, how to provide a technical solution of a data packet transmission method with high performance becomes a technical problem to be solved urgently. SUMMARY

[0004] Some embodiments of the present application aim to provide a data packet transmission method, device, medium, equipment and product, and the technical solution of the embodiments of the present application can improve the reverse proxy performance of the reverse proxy architecture, adapt to different transmission protocols, and realize effective transmission of multiple protocol data.

[0005] In a first aspect, some embodiments of the present application provide a data packet transmission method, comprising: receiving a data packet conforming to an access control policy; wherein the access control policy represents a data packet type allowed to be sent by a network security engine; determining an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy includes a special IP number, a special port number, a network protocol type and the application protocol type; the application protocol type includes a general protocol, a multicast protocol or an audio / video protocol; calling a protocol interface function corresponding to the application protocol type to detect the data packet, and obtaining a detection result; wherein the detection result represents whether to block the data packet from continuing transmission.

[0006] Some embodiments of the present application determine the application protocol type in the reverse proxy policy associated with the access control policy related to the received data packet, and detect the data packet by calling the corresponding protocol interface function through the application protocol type to obtain the detection result. The embodiments of the present application can use different interface functions for detection according to different application protocol types, so as to adapt to transmission data of multiple protocols, improve the reverse proxy performance of the reverse proxy structure, and realize effective transmission of the data packet.

[0007] In some embodiments, when the application protocol type is the multicast protocol, before the receiving the data packet conforming to the access control policy, the method further comprises: constructing a protocol data packet based on the IP address and the port number in the multicast protocol and the access control policy; sending the protocol data packet to a specific network port of a switch through an interface of the network security engine, so as to inform the switch to send the multicast data packet corresponding to the IP address and the port number to the specific network port.

[0008] Some embodiments of the present application face the multicast protocol, construct a protocol data packet, and send it to a switch through a specific network port to achieve the purpose of informing the switch, realize the joining of the multicast function, and ensure effective data transmission.

[0009] In some embodiments, the receiving the data packet conforming to the access control policy comprises: receiving a to-be-transmitted multicast data packet sent by a client to the IP address and the port number.

[0010] Some embodiments of the present application can realize effective detection of multicast data packets by receiving to-be-transmitted multicast data packets.

[0011] In some embodiments, when the application protocol type is the audio / video protocol, the calling a protocol interface function corresponding to the application protocol type to detect the data packet to obtain a detection result comprises: calling a second reverse proxy system to analyze second protocol connection data in the data packet, obtaining protocol information, and generating an audio / video reverse proxy strategy based on the protocol information; sending the audio / video reverse proxy strategy to a first reverse proxy system through the second reverse proxy system; calling the first reverse proxy system and the audio / video reverse proxy strategy to detect first protocol connection data in the data packet to obtain the detection result.

[0012] Some embodiments of the present application face the audio / video protocol, process different protocol connection data in it through different reverse proxy systems to obtain a detection result, and can realize effective detection of audio / video protocol related data.

[0013] In some embodiments, when the detection result indicates that there is abnormal data, the method further comprises: calling a query interface function through the second reverse proxy system and a management system to detect the abnormal data to obtain the detection result.

[0014] Some embodiments of the present application detect the data with abnormalities again through the second reverse proxy system to obtain a detection result, and realize effective processing of complex data packets.

[0015] In some embodiments, when the detection result indicates that the data packet is allowed to continue transmission, the method further comprises: sending a shutdown strategy to the first reverse proxy system by the second reverse proxy system; and executing the shutdown strategy by the first reverse proxy system to stop the data packet transmission.

[0016] Some embodiments of the present application can effectively end the data packet transmission process by executing the shutdown strategy sent by the second reverse proxy system through the first reverse proxy system.

[0017] In some embodiments, when the application protocol type in the reverse proxy strategy associated with the access control strategy is determined, the method further comprises: confirming that the data packet conforms to the locally stored access control strategy.

[0018] Some embodiments of the present application can achieve accurate transmission of data packets by detecting whether the data packet conforms to the access control strategy while determining the application protocol type.

[0019] In some embodiments, when the detection result indicates that the data packet is allowed to continue transmission, the method further comprises: finding a local target port through a protocol extension module interface, the local target port being used to establish an upstream connection with a server; and sending an updated data packet obtained by updating a packet header of the data packet to the server through the local target port.

[0020] In a second aspect, some embodiments of the present application provide a device for data packet transmission, comprising: a receiving module configured to receive a data packet conforming to an access control strategy; wherein the access control strategy indicates a type of data packet allowed to be sent by a network security engine; a determining module configured to determine an application protocol type in a reverse proxy strategy associated with the access control strategy; wherein the reverse proxy strategy comprises a special IP number, a special port number, a network protocol type, and the application protocol type; the application protocol type comprises a general protocol, a multicast protocol, or an audio / video protocol; and a detecting module configured to detect the data packet by calling a protocol interface function corresponding to the application protocol type to obtain a detection result; wherein the detection result indicates whether to block the data packet from continuing transmission.

[0021] In a third aspect, some embodiments of the present application provide a computer readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, can implement the method of any of the embodiments of the first aspect.

[0022] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method of any of the embodiments of the first aspect.

[0023] In a fifth aspect, some embodiments of the present application provide a computer program product, which comprises a computer program, wherein the computer program, when executed by a processor, can implement the method according to any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required to be used in some embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0025] Figure 1 One of the architecture diagrams of the reverse proxy device provided by some embodiments of the present application;

[0026] Figure 2 The second architecture diagram of the reverse proxy device provided by some embodiments of the present application;

[0027] Figure 3 The method flow diagram of the data packet transmission provided by some embodiments of the present application;

[0028] Figure 4 The scene deployment structure diagram of the reverse proxy system provided by some embodiments of the present application;

[0029] Figure 5 The device composition block diagram of the data packet transmission provided by some embodiments of the present application;

[0030] Figure 6 The schematic diagram of an electronic device provided by some embodiments of the present application. DETAILED DESCRIPTION

[0031] The technical solutions of some embodiments of the present application will be described in detail below with reference to the drawings in some embodiments of the present application.

[0032] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used for distinguishing description, and cannot be understood as indicating or implying relative importance.

[0033] In order to facilitate the understanding of the technical solutions of the present application, the functions of some special modules involved in the embodiments will be described first as follows.

[0034] DPDK, which stands for Data Plane Development Kit, is a data plane development kit running on Linux system, a function library and driver set for fast packet processing, which can greatly improve data processing performance and throughput, and improve the working efficiency of data plane service programs. DPDK uses polling instead of interrupt to process packets. When a packet is received, the DPDK- loaded network card driver does not notify the CPU through an interrupt, but directly stores the packet in memory and delivers it to the application layer software for direct processing through the interface provided by DPDK, thus saving a lot of CPU interrupt time and memory copy time.

[0035] UDP protocol is a simple packet-oriented transport layer protocol that provides non-fully connected, non-secure data stream transmission.

[0036] Nginx is an open source and high performance, reliable http web server and reverse proxy server architecture, which has the characteristics of small memory occupation, high concurrency, high scalability, high reliability and supports hot deployment, and Nginx uses the Epoll network model.

[0037] User Space Protocol Stack refers to a network protocol stack implemented in the user space (userspace) of an operating system rather than in the kernel space (kernel space), including F-Stack, LWIP, MTCP, etc.

[0038] The server or gateway device integrated with the reverse proxy function is called a reverse proxy device.

[0039] In order to improve the reverse proxy performance of the reverse proxy architecture in the prior art, some embodiments of the present application provide a method for packet transmission based on a reverse proxy architecture, which can determine the application protocol type involved in the packet after receiving the packet, and implement detection of the packet by calling the interface function related thereto. The embodiments of the present application can adapt to data under multiple different protocols, and implement effective transmission of data.

[0040] The following will be described in conjunction with the accompanying drawings Figure 1 Exemplary overall composition structure of the reverse proxy device provided by some embodiments of the present application is described.

[0041] As Figure 1As shown, some embodiments of the present application provide an architecture diagram of a reverse proxy device. The reverse proxy device includes a reverse proxy system, a management system, a network security engine and a DPDK. The reverse proxy system includes a UDP protocol reverse proxy system (or simply referred to as a UDP reverse proxy system), an Nginx reverse proxy system, and a user protocol stack. The UDP protocol reverse proxy system is parallel to the Nginx reverse proxy system and the user protocol stack. The UDP protocol reverse proxy system can independently process UDP protocols and application protocols, or can cooperate with the Nginx reverse proxy system to process complex application protocols, such as SIP-based audio and video protocols.

[0042] Specifically, as shown, Figure 2 The UDP protocol reverse proxy system communicates with the network security engine and other interface libraries through interfaces (functions), and the UDP protocol reverse proxy system calls the interfaces (functions) of other interface libraries to realize key sub-checking functions, and the network security engine and the UDP protocol reverse proxy system call each other's interfaces (functions) to realize data packet transmission, connection and state query functions; The UDP protocol reverse proxy system communicates with the management system and the Nginx reverse proxy system through a bidirectional queue, and the bidirectional queue mainly transmits strategy information.

[0043] The functions of each component unit in Figure 1 and Figure 2 are exemplarily described below.

[0044] In some specific embodiments, the management system provides reverse proxy strategy, NAT, routing and other policy management, while reading state data from other systems and recording it as log or statistical data information. The state data includes connection and transmission data volume, and other types of data generated by the system.

[0045] In some specific embodiments, the network security engine is used to provide protocol identification, access control, routing, connection and session management, and other basic network security functions. The network security engine receives the access control policies issued by the management system, the UDP reverse proxy system and the Nginx reverse proxy system, and reports the state data to these systems, and forwards the data packets between the user protocol stack, the UDP reverse proxy system and the DPDK according to the policy, routing and other information.

[0046] In some specific embodiments, when the Nginx reverse proxy system transmits UDP data of the client and the server, it first establishes a downstream connection with the client, then establishes an upstream connection with the server, and provides protocol analysis and security check functions. The user protocol stack provides the Nginx with connection establishment, connection closing, data reading, data sending and other function interfaces (functions), and transmits data between the network security engine and the Nginx.

[0047] In some embodiments, other interface libraries are used to provide basic functions such as keyword matching, data format identification, etc. for other system calls.

[0048] In some embodiments, the UDP protocol reverse proxy system includes state management, policy management, application protocol processing, and L234 protocol extension; wherein the application protocol processing includes general protocol, multicast, and audio and video, etc.

[0049] Specifically, the state management is used to put the connection information (including IP, port, application protocol type, processing data volume, transmission state) processed by the reverse proxy system into the shared memory for the management system to query; and send the log generated by the reverse proxy system to the management system through the bidirectional queue for the management system to parse and store the log.

[0050] The policy management receives policy information from the management system and the Nginx reverse proxy system through the bidirectional queue, parses the policy and stores it in the shared memory; then calls the network security engine interface (function) to create an access control policy, the network security engine internally transmits the data packet of the IP and port meeting the reverse proxy policy to the reverse proxy system through the interface (function) of the reverse proxy system, and finally associates the reverse proxy policy with the access control policy.

[0051] Among them, the strategy of the general protocol includes: reverse proxy IP (referred to as IP-1) and port, system IP (IP-2) which communicates with IP-3, destination IP (referred to as IP-3) and port, network protocol type (UDP in this system), application protocol type and keyword. The strategy of multicast includes: source multicast IP (IP-I) and port and network port, system IP (IP-II) and port (communicates with IP-I), destination multicast IP (IP-III) and port and network port, local system IP (IP-IV) which communicates with IP-III, network protocol type, application protocol type (multicast) and keyword. The strategy of the audio and video module includes the general protocol module strategy content and the audio and video frame type. Other application protocol modules will include protocol field content.

[0052] The policy information sent by the management system is the reverse proxy policy generated by the administrator operation, and the policy information sent by the Nginx reverse proxy system is the temporary reverse proxy policy created by parsing the application protocol.

[0053] In some embodiments, the application protocol processing unit reads the data packet from the network security engine, parses the network protocol type and determines the consistency with the protocol type in the policy, parses the application protocol field and determines the compliance, calls the interface library to check the consistency of the data carried by the application protocol with the keyword information in the policy; according to the consistency and compliance results, the data packet transmission is blocked, or according to the IP, network port, port information in the policy, the L234 protocol extension module interface (function) is called to construct a new L2, L3, L4 layer header based on the received data packet, and finally the network security engine is called to send the data packet. The application protocol processing includes general protocol, multicast, audio and video modules, and the system also supports other protocols. In order to facilitate understanding, only three representative modules are described in this paper.

[0054] The general protocol module mainly processes UDP data packets, does not check the application protocol, and checks the keyword content of the UDP carried data. The multicast module mainly processes multicast protocol related content and checks the keyword content of the UDP carried data. The audio and video module mainly processes the frame format and frame size of the audio and video protocol.

[0055] In some embodiments, the L234 protocol extension unit constructs L2, L3, L4 protocol header, IGMPv2 Report data packet of multicast according to the requirements of application protocol processing, supports querying the source IP and port, destination IP and port, and UDP protocol through the interface (function) in the network security engine, and finds a local IP corresponding to the port, which is a key element of a connection.

[0056] The following will be described in conjunction with the accompanying Figure 3 The implementation process of the data packet transmission performed by the reverse proxy system provided by some embodiments of the application is exemplarily described.

[0057] Please refer to the accompanying Figure 3 , Figure 3 A method flowchart of data packet transmission is provided for some embodiments of the application. The data packet transmission method can include: S310, receiving a data packet conforming to an access control policy; wherein the access control policy represents a data packet type allowed to be sent by a network security engine. S320, determining an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy includes a special IP number, a special port number, a network protocol type and the application protocol type; the application protocol type includes a general protocol, a multicast protocol or an audio and video protocol. S330, calling a protocol interface function corresponding to the application protocol type to detect the data packet and obtain a detection result; wherein the detection result represents whether to block the data packet from continuing transmission.

[0058] For example, in a specific embodiment of this application, the client can send data packets to the reverse proxy device; these data packets are transmitted to the network security engine via DPDK, and the network security engine, upon confirming permission to send, forwards them to the reverse proxy system. The reverse proxy system can determine the application protocol type of the data packets and call the corresponding protocol interface function to detect them, obtaining the detection result.

[0059] For example, combining Figure 4 The scenario shown depicts a general setup consisting of a client, reverse proxy device, and server. Taking the transmission of UDP packets as an example, before receiving UDP packets, the management system sends a reverse proxy policy to the UDP reverse proxy system via a bidirectional queue. The reverse proxy policy includes a dedicated IP address and a dedicated port number: IP-1: 192.168.0.10, port: 5000; IP-2: 192.168.1.10; IP-3: 192.168.1.100, port: 6000; network protocol type: UDP; application protocol type: general (meaning it can carry any application protocol). The UDP reverse proxy system reads the reverse proxy policy from the bidirectional queue, parses it, and saves it as a reverse proxy policy. Then, it calls the network security engine interface (function) to generate an access control policy internally and sends it to the network security engine. The access control policy allows UDP packets destined for IP-1: 192.168.0.10, port 5000 to be sent to the UDP reverse proxy system. Pointers are set on the reverse proxy policy and the access control policy to point to each other, forming an association.

[0060] The client sends UDP packets to the reverse proxy device at 192.168.0.10:5000. The reverse proxy device receives the packets from the client and transmits them to the network security engine via DPDK. The network security engine parses the network protocol type of the packets. Based on the packet's IP address, port, and UDP protocol, it first searches for a connection. If no connection is found, it indicates that this is the first time the packet has been received. Next, it searches for an access control policy based on the packet's destination IP address and port. If an access control policy is found, a downstream connection is created between the packet and the client. A pointer is set on the downstream connection to point to the access control policy, and a pointer is also added to the end of the packet to point to the downstream connection. This allows subsequent reception of the same packet to be directly forwarded to the UDP reverse proxy system after a connection is found, saving data transmission time. If neither a connection nor an access control policy is found, the packet is blocked. Once a connection is found or a new connection is created, the packet is transmitted to the UDP reverse proxy system through its interface (function).

[0061] In some embodiments of the present application, performing S320 can further include confirming that the data packet conforms to the locally stored access control policy.

[0062] For example, after the UDP reverse proxy system obtains the UDP data packet through the interface (function), it checks whether it corresponds to the access control policy, and simultaneously looks up the reverse proxy policy associated with the access control policy. When the application protocol type of the detected reverse proxy policy is a general type, the general protocol module interface (function) is called. The consistency of the data carried by the UDP data packet and the keywords in the reverse proxy policy is checked by calling other interface library interfaces (functions) inside the general protocol module. If they are the same, the data packet is blocked, otherwise the subsequent process continues. It can be understood that other application protocol types correspond to the calling of other application protocol modules, and if there is no corresponding module, the data packet is blocked.

[0063] In addition, when the management system closes the reverse proxy policy, the UDP reverse proxy system obtains the information of the closed policy, calls the relevant interface to find all downstream connections and upstream connections associated with IP-1 and the port, and deletes them, and calls the relevant interface to delete the access control policy and the reverse proxy policy.

[0064] The following exemplary describes the implementation process of data packet transmission when the application protocol type is a multicast protocol (referred to as multicast).

[0065] The management system issues the reverse proxy policy of the multicast protocol to the UDP reverse proxy system through the bidirectional queue, and the content of the reverse proxy policy includes: IP-Ⅰ: 239.0.0.100, port: 5000, network interface: 1, IP-Ⅱ: 192.168.0.10, port 6000, IP-Ⅲ: 239.0.1.100, port: 7000, network interface 2, IP-Ⅳ: 192.168.1.10, port 8000, network protocol type: UDP, application protocol type: multicast. The UDP reverse proxy system reads the reverse proxy policy of the multicast protocol from the bidirectional queue, parses and saves the reverse proxy policy by the policy module, and calls the network security engine interface (function) to generate two access control policies inside it. The content of access control policy 1 is to allow the UDP protocol data packet with destination IP-Ⅰ: 239.0.0.100 and port 5000 to be sent to the UDP reverse proxy system, and the content of policy 2 is to allow the UDP protocol data packet with destination IP-5: 239.0.1.100 and port 7000 to be sent to the UDP reverse proxy system. The pointers are used to point to each other between the reverse proxy policy and the access control policies 1 and 2, to achieve association.

[0066] To implement the multicast function, in some embodiments of the present application, when the application protocol type is the multicast protocol, before performing S310, the method for packet transmission further comprises: constructing a protocol packet based on the multicast protocol and the IP address and port number in the access control policy; and sending the protocol packet to the switch through a specific network port by calling the interface of the network security engine, so as to inform the switch to send the multicast packet corresponding to the IP address and the port number to the specific network port.

[0067] For example, in the specific embodiments of the present application, the multicast module of the UDP reverse proxy system calls the L234 extension protocol module interface (function) to implement the multicast function. Specifically, an IP-II: 192.168.0.10, port 6000 and IP-I: 239.0.0.100, port: 5000 (i.e. the IP address and port number in the access control policy) are used, and a protocol packet is constructed according to the format of the IGMPv2 Report protocol (i.e. the multicast protocol), and the interface (function) of the network security engine is called to send to the switch from the network port 1 (as a specific example of the specific network port), to inform the switch to send the multicast packet of IP-I and port 5000 to the network port 1, thereby implementing the multicast function.

[0068] Similarly, the L234 extension protocol module interface (function) is called to implement the multicast function, and the process is: IP-IV: 192.168.0.10, port 8000 and IP-III: 239.0.1.100, port: 8000 are used, and a packet is constructed according to the format of the IGMPv2 Report protocol, and the interface function of the network security engine is called to send to the switch from the network port 2 (as a specific example of the specific network port), to inform the switch to send the multicast packet of IP-III and port 8000 to the network port 2, thereby implementing the multicast function.

[0069] In some embodiments of the present application, S310 can include: receiving a to-be-transmitted multicast packet sent by a client to the IP address and the port number.

[0070] For example, in the specific embodiments of the present application, the client sends the multicast data packet to be transmitted to IP-I and port 5000, the reverse proxy system receives the multicast data packet to be transmitted, establishes a downstream connection, queries the access control policy, associates the downstream connection with the access control policy 1, associates the data packet with the downstream connection, and performs subsequent keyword checking, etc. The processes are consistent with the general protocol module processing process of the UDP data packet, and thus will not be described here. In another embodiment, the reverse proxy system uses IP-IV: 192.168.1.10, port 8000, and IP-III: 239.0.1.100, port: 7000 to establish a connection, associates the connection with the access control policy 2, associates the data packet with the upstream connection, associates the upstream connection with the downstream connection, constructs the data packet according to IP-IV and the port and IP-III and the port, and sends the data packet, etc. The processes are consistent with the general protocol processing module, and thus will not be described here. The process of closing the policy is also similar to the general protocol processing.

[0071] The implementation process of the data packet transmission when the application protocol type is the audio / video protocol is described below.

[0072] The management system issues the reverse proxy policy to the Nginx reverse proxy system through the bidirectional queue, and the policy content includes: IP-1: 192.168.0.10, port: 5000, IP-2: 192.168.1.10, IP-3: 192.168.1.100, port: 6000, network protocol type: UDP, application protocol type: SIP, and other content also includes the frame format of the audio / video protocol, SIP protocol, and other related content. The reverse proxy system uses the Nginx reverse proxy system to process the SIP protocol connection data, and uses the UDP reverse proxy to process the audio / video connection data, which comprehensively realizes the high-speed audio / video reverse proxy function. The Nginx reverse proxy system reads the reverse proxy policy from the bidirectional queue and saves the policy, and calls the network security engine interface (function) to generate an access control policy inside, and the access control policy content is to allow the UDP protocol data packet of the destination IP-1: 192.168.0.10, port 5000 to be sent to the Nginx reverse proxy system. Similarly, the access control policy is also stored to the network security engine.

[0073] The client sends the audio / video protocol data packet to the Nginx reverse proxy system through the network security engine and the user-mode protocol stack.

[0074] In some embodiments of the present application, when the application protocol type is an audio / video protocol, S330 can include: obtaining protocol information by calling the second reverse proxy system to parse the second protocol connection data in the data packet, and generating an audio / video reverse proxy strategy based on the protocol information; sending the audio / video reverse proxy strategy to the first reverse proxy system through the second reverse proxy system; and obtaining the detection result by calling the first reverse proxy system and the audio / video reverse proxy strategy to detect the first protocol connection data in the data packet.

[0075] For example, in specific embodiments of the present application, the Nginx reverse proxy system (as a specific example of a second reverse proxy system) parses the SIP protocol (as a specific example of second protocol connection data). After negotiating the IP, port, frame format, etc. (as a specific example of protocol information) according to the SIP protocol, a UDP connection must be established to transmit audio / video data. At this time, the Nginx reverse proxy system generates an audio / video reverse proxy strategy and sends it to the UDP reverse proxy system through a bidirectional channel. The UDP reverse proxy system and the audio / video module establish upstream and downstream connections according to the content of the audio / video reverse proxy strategy, check the frame format of the audio / video connection data (as a specific example of first protocol connection data), and obtain the detection result.

[0076] In some embodiments of the present application, when the detection result indicates that there is abnormal data, the data packet transmission method further includes: detecting the abnormal data by calling a query interface function of the second reverse proxy system and the management system to obtain the detection result.

[0077] For example, in specific embodiments of the present application, when unqualified frames (as a specific example of abnormal data) are found in the audio / video connection data, the number of unqualified frames is recorded in the state management, which is used to query the final detection result by calling the interface function of the Nginx reverse proxy system and the management system.

[0078] After the above detection of data packets under a general protocol, data packets under a multicast protocol, or data packets under an audio / video protocol is completed, the data packets need to be transmitted to the server in the case of non-blocking data transmission. Therefore, in some embodiments of the present application, after S330 is executed, the data packet transmission method further includes: finding a local target port through a protocol extension module interface, the local target port being used to establish an upstream connection with the server; and sending updated data packets obtained by updating the data packet to the server through the local target port.

[0079] For example, in the specific embodiments of the present application, an available local port is found by calling the L234 protocol extension module (as a specific example of a local target port). The L234 protocol extension module interface (function) creates a connection information (upstream connection) for the available local port and IP. The upstream connection and the downstream connection are associated by pointing to each other through their internal pointers, and the pointer in the upstream connection is used to point to the access control policy, forming an association. In addition, in order to prevent irrelevant or malicious data from being carried in the data packet, the IP header and other contents of the data packet need to be updated before being sent to the server through the available local port.

[0080] For example, in the specific embodiments of the present application, an available local port is found by calling the L234 protocol extension module (as a specific example of a local target port). The L234 protocol extension module interface (function) creates a connection information (upstream connection) for the available local port and IP. The upstream connection and the downstream connection are associated by pointing to each other through their internal pointers, and the pointer in the upstream connection is used to point to the access control policy, forming an association. In addition, in order to prevent irrelevant or malicious data from being carried in the data packet, the IP header and other contents of the data packet need to be updated before being sent to the server through the available local port.

[0081] For example, in the specific embodiments of the present application, an available local port is found by calling the L234 protocol extension module (as a specific example of a local target port). The L234 protocol extension module interface (function) creates a connection information (upstream connection) for the available local port and IP. The upstream connection and the downstream connection are associated by pointing to each other through their internal pointers, and the pointer in the upstream connection is used to point to the access control policy, forming an association. In addition, in order to prevent irrelevant or malicious data from being carried in the data packet, the IP header and other contents of the data packet need to be updated before being sent to the server through the available local port.

[0082] In other embodiments, when the server sends data packets back to the client through the upstream connection of the reverse proxy device, the reverse proxy system processes the data packet flow similar to the downstream connection processing above. The main difference is that the network security engine looks up the upstream connection according to the destination IP and port, and if no connection is found and no access control policy for the target IP and port is found, the data packet is blocked. If a connection is found, a pointer is set at the end of the data packet pointing to the upstream connection, which is passed to the reverse proxy system. The reverse proxy system obtains the data packet and the upstream connection, and then obtains the access control policy and the reverse proxy policy and the downstream connection through the pointer, and sets the IP, UDP, and Ethernet header of the data packet according to the IP, port, and MAC of the downstream connection.

[0083] As can be seen from the above some embodiments of the application, the application does not use a protocol stack and a Socket network interface to implement the functions of reverse proxy and data inspection based on the UDP protocol application protocol, and has the characteristics of high security and high performance; while realizing the general UDP protocol reverse proxy function and improving the performance, further extending the multicast reverse proxy function, and having high performance; for complex application protocols, the Nginx reverse proxy system is used to process such protocols, and when UDP connection is needed for data transmission, it is given to the UDP reverse proxy system for transmission, realizing flexible combination and deployment, and further improving the overall performance of the reverse proxy device.

[0084] Please refer to Figure 5 , Figure 5 A block diagram of the composition of the data packet transmission device provided by some embodiments of the application is shown. It should be understood that the data packet transmission device corresponds to the method embodiments described above, and can perform each step involved in the method embodiments described above. The specific functions of the data packet transmission device can be referred to the description above, and detailed description is appropriately omitted here to avoid repetition.

[0085] Figure 5 The data packet transmission device includes at least one software function module that can be stored in the form of software or firmware in the memory or solidified in the data packet transmission device. The data packet transmission device includes: a receiving module 510 configured to receive a data packet conforming to an access control policy; wherein the access control policy represents a type of data packet allowed to be sent by the network security engine; a determining module 520 configured to determine an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy includes a dedicated IP number, a dedicated port number, a network protocol type, and the application protocol type; the application protocol type includes a general protocol, a multicast protocol, or an audio / video protocol; a detecting module 530 configured to call a protocol interface function corresponding to the application protocol type to detect the data packet and obtain a detection result; wherein the detection result represents whether to block the data packet from continuing to transmit.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing method, which will not be described in detail here.

[0087] Some embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the operations of the method corresponding to any of the embodiments of the above method provided by the embodiments.

[0088] Some embodiments of the present application also provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the operations of the method corresponding to any of the embodiments of the above method provided by the embodiments.

[0089] As shown in Figure 6 Some embodiments of the present application provide an electronic device 600, which comprises a memory 610, a processor 620 and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 reads the program from the memory 610 through a bus 630 and executes the program to implement the method of any of the embodiments described above.

[0090] The processor 620 can process digital signals and can include various computing structures, such as a complex instruction set computer structure, a reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, the processor 620 can be a microprocessor.

[0091] The memory 610 can be used to store instructions executed by the processor 620 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 620 of the embodiments of the present disclosure can be used to execute the instructions in the memory 610 to implement the method shown above. The memory 610 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0092] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0093] The above descriptions are merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0094] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus.

Claims

1. A method of data packet transmission, characterized by, The method comprises: receiving a data packet conforming to an access control policy; wherein the access control policy represents a type of data packet allowed to be sent by a network security engine; determining an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy comprises a private IP number, a private port number, a network protocol type, and the application protocol type; the application protocol type comprises a general protocol, a multicast protocol, or a video and audio protocol; calling a protocol interface function corresponding to the application protocol type to detect the data packet, to obtain a detection result; wherein the detection result represents whether to block the data packet from continuing transmission; when the application protocol type is the video and audio protocol, the calling of the protocol interface function corresponding to the application protocol type to detect the data packet, to obtain a detection result, comprises: parsing second protocol connection data in the data packet through a second reverse proxy system, to obtain protocol information, and generating a video and audio reverse proxy policy based on the protocol information; sending the video and audio reverse proxy policy to a first reverse proxy system through the second reverse proxy system; detecting first protocol connection data in the data packet through the first reverse proxy system and the video and audio reverse proxy policy, to obtain the detection result.

2. The method of claim 1, wherein, when the application protocol type is the multicast protocol, before the receiving of the data packet conforming to the access control policy, the method further comprises: constructing a protocol data packet based on the multicast protocol and IP addresses and port numbers in the access control policy; sending the protocol data packet to a switch through a specific network port through an interface of the network security engine, so as to notify the switch to send multicast data packets corresponding to the IP addresses and the port numbers to the specific network port.

3. The method of claim 2, wherein, The receiving of the data packet conforming to the access control policy comprises: receiving a to-be-transmitted multicast data packet sent by a client to the IP addresses and the port numbers.

4. The method of claim 1, wherein, when the detection result represents that there is abnormal data, the method further comprises: detecting the abnormal data through a query interface function called by the second reverse proxy system and a management system, to obtain the detection result.

5. The method of claim 1 or 4, wherein, when the detection result represents that the data packet is blocked from continuing transmission, the method further comprises: sending a closing policy to the first reverse proxy system through the second reverse proxy system; executing the closing policy through the first reverse proxy system, to prevent the data packet from being transmitted.

6. The method of any one of claims 1-4, wherein, When the determination of the application protocol type in the reverse proxy policy associated with the access control policy is performed, the method further comprises: confirming that the data packet conforms to the access control policy stored locally.

7. The method of any one of claims 1-4, wherein, when the detection result represents that the data packet is allowed to continue transmission, the method further comprises: finding a local target port through a protocol extension module interface, the local target port being used to establish an upstream connection with a server; sending updated data packets obtained after a packet header of the data packet is updated, to the server through the local target port.

8. An apparatus for data packet transmission, the apparatus comprising: The device is used to execute the method of claim 1, comprising: The receiving module is configured to receive a data packet conforming to an access control policy; wherein the access control policy represents a type of data packet allowed to be sent by a network security engine; The determining module is configured to determine an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy comprises a private IP number, a private port number, a network protocol type and the application protocol type; and the application protocol type comprises a general protocol, a multicast protocol or an audio / video protocol; The detecting module is configured to call a protocol interface function corresponding to the application protocol type to detect the data packet, and obtain a detection result; wherein the detection result represents whether to block the data packet from continuing transmission.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is run by the processor to execute the method in any one of claims 1-7.

10. An electronic device, comprising: The computer readable storage medium stores a computer program, wherein the computer program is run by the processor to execute the method in any one of claims 1-7.

11. A computer program product, characterised in that, The computer readable storage medium stores a computer program, wherein the computer program is run by the processor to execute the method in any one of claims 1-7.

Images