Hot-pluggable HTTP (Hyper Text Transport Protocol) service framework system and method free from port monitoring

Abstract

The invention discloses a port-monitoring-free hot-pluggable HTTP (Hyper Text Transport Protocol) service framework system and a port-monitoring-free hot-pluggable HTTP service framework method, which are applied to a service node, and the system comprises a node starting module which is used for initiating an encrypted outbound tunnel to a control plane after the service node is started, so that any new port does not need to be opened; a light HTTP parser is arranged in the parsing module, and the parsing module is used for unpacking the received task frame, mapping the unpacked task frame to a service code to execute service logic and returning a response through the outbound tunnel; the task frame monitors an external entrance in a unified manner through the control plane, and after a request is received, the request is packaged into the task frame, and the task frame is safely issued through an outbound tunnel; the hot plug management module is used for instantly reporting online / offline of a service node through the outbound tunnel, so that the control plane completes rolling upgrading under the condition that a network strategy is not changed; the method has the beneficial effects that any inbound port does not need to be opened, and the vulnerability utilization risk caused by passive port scanning is eliminated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, in particular to a hot-pluggable HTTP service framework system and method without port monitoring. BACKGROUND

[0002] Existing HTTP services usually provide capabilities externally by monitoring ports such as 80 / 443, but must pass through the inbound connection in the border firewall, cloud security group or host-level policy. At the same time, such resident monitoring ports will expose fixed fingerprints, so that automated scanners can discover and test known or unknown vulnerabilities. Once the patch is lagging, the configuration is neglected, or there is a zero-day vulnerability, attackers can use open ports to launch intrusions. Although WAF, reverse proxy, jump machine and other means can be used to mitigate risks, the service itself still needs to monitor the port at the operating system level, and it is difficult to completely eliminate the passive scanning surface. SUMMARY

[0003] In view of the technical defects mentioned in the background, the purpose of the embodiments of the present application is to provide a hot-pluggable HTTP service framework system and method without port monitoring, aiming to at least solve one of the technical problems in the related art to some extent.

[0004] To achieve the above-mentioned purpose, in a first aspect, the embodiments of the present application provide a hot-pluggable HTTP service framework system without port monitoring, applied to a service node, the system comprising:

[0005] A node startup module is configured to initiate an encrypted outbound tunnel to a control plane after starting the service node, so as to not need to open any new port, and register the service capability, health status and running version corresponding to the service node in the tunnel;

[0006] A parsing module is configured to unpack and map the received task frame to the business code to execute the business logic, and return the response through the outbound tunnel; wherein the task frame is uniformly monitored by the control plane for external HTTP / HTTPS entry, and after receiving the request, the target node is selected according to the preset matching rule, the request is packaged into a task frame, and the task frame is safely issued through the outbound tunnel;

[0007] A hot-plug management module is configured to report the service node online / offline through the outbound tunnel in real time, so that the control plane completes the rolling upgrade without changing the network policy.

[0008] As a specific implementation of the present application, the outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection, realizes 0-RTT session multiplexing and multiplexing capability, and reduces the handshake overhead.

[0009] As a specific implementation manner of the application, the target node is selected according to the preset matching rule, and specifically includes:

[0010] The corresponding service node is selected as the target node according to the routing strategy, the tenant information and the service node health degree.

[0011] As a specific implementation manner of the application, the control plane performs identity verification, rate limiting and log auditing on the request source when scheduling, so that full-link controllability is ensured after removing the inbound monitoring.

[0012] As a preferred implementation manner of the application, the hot plug management module is also used for request migration and recovery during node hot plug, and specifically includes:

[0013] The publishing starts;

[0014] The new node is online;

[0015] Traffic is smoothly migrated;

[0016] The old node is recycled;

[0017] The publishing is completed.

[0018] In the second aspect, the application also provides a port monitoring free method applied to the port monitoring free hot plug HTTP service framework system in the first aspect, and the method includes the following steps:

[0019] After the service node is started, the encrypted outbound tunnel is initiated to the control plane, so that any new port does not need to be opened, and the service capability, health condition and running version corresponding to the service node are registered and recorded in the tunnel;

[0020] The received task frame is unpacked and mapped to the business code through the built-in lightweight HTTP parser to execute the business logic, and the response is returned through the outbound tunnel; wherein the task frame is uniformly monitored by the control plane to the external HTTP / HTTPS entrance, and after receiving the request, the target node is selected according to the preset matching rule, the request is packaged into the task frame, and the task frame is safely issued through the outbound tunnel;

[0021] The service node online / offline is reported in real time through the outbound tunnel, so that the control plane completes the rolling upgrade without changing the network strategy.

[0022] The application has the following beneficial effects:

[0023] 1. Without opening any inbound port and without modifying the firewall rule, the dynamic deployment, hot plug expansion and contraction, and safe operation and maintenance of the HTTP service are realized, and the vulnerability utilization risk caused by passive port scanning is eliminated;

[0024] 2. Because the data is distributed securely through the outbound tunnel, the business process no longer creates any local listening sockets. Even if the system is scanned, it will not expose port or banner information, thus reducing the passive detection surface.

[0025] 3. The outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection by default, realizing 0-RTT session reuse and multiplexing capabilities, reducing handshake overhead and port state synchronization cost, and improving throughput and resource utilization in high-concurrency scenarios. Attached Figure Description

[0026] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below.

[0027] Figure 1 This is a schematic diagram of a hot-swappable HTTP service framework system that does not require port listening, provided in an embodiment of the present invention.

[0028] Figure 2 This is an architectural diagram of a hot-swappable HTTP service framework system that does not require port listening, provided in an embodiment of the present invention.

[0029] Figure 3 This is a flowchart of node registration and tunnel establishment provided in an embodiment of the present invention;

[0030] Figure 4 This is a flowchart of a request migration and recycling process during node hot-plugging provided in an embodiment of the present invention;

[0031] Figure 5 This is a flowchart of a port-free monitoring method provided in an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0034] Control Plane: In HTTP service (and more broadly network / application architecture), Control Plane is used for rules, configuration, scheduling and state management.

[0035] Service Node: is the entity that provides specific HTTP services to the outside world;

[0036] HTTP Service: HTTP Service (HyperText Transfer Protocol Service) is a server program that provides network resource access and data interaction based on HTTP / HTTPS protocol.

[0037] It should be noted that the technical terms in this embodiment have the usual meanings understood by those skilled in the art, unless otherwise stated.

[0038] Please refer to Figures 1 to 3 The HTTP service framework system provided by the embodiment of the present application is applied to a service node, and the system comprises:

[0039] A node startup module is configured to initiate an encrypted outbound tunnel to the control plane after the service node is started, so that no new port needs to be opened, and the service capability, health status and running version corresponding to the service node are registered in the tunnel;

[0040] A parsing module is configured to unpack and map the received task frame to the business code to execute the business logic and return the response through the outbound tunnel, wherein the task frame is uniformly monitored by the control plane through an external HTTP / HTTPS entrance, and after receiving a request, the target node is selected according to a preset matching rule, the request is packaged into a task frame, and the task frame is safely issued through the outbound tunnel;

[0041] A hot plug management module is configured to report the online / offline of the service node through the outbound tunnel in real time, so that the control plane completes the rolling upgrade without changing the network strategy.

[0042] In this embodiment, the number of service nodes is not limited; after the service node is started, only an encrypted outbound tunnel (such as mTLS / QUIC / WebSocket over TLS) needs to be initiated to the control plane, since this process meets the existing firewall default "intranet out" policy, so that no new port needs to be opened.

[0043] The control plane is deployed in a trusted area or an existing gateway, and it uniformly monitors the external HTTP / HTTPS entrance (see Figure 2), after receiving the request, according to the routing strategy, tenant information and node health degree, the target node is selected, the request is packaged as a task frame, and the task frame is safely issued through the outbound tunnel; that is, the preset matching rule includes matching according to the routing strategy, tenant information and service node health degree, so as to select the corresponding service node as the target node.

[0044] Specifically, according to the configuration of the administrator, which service node is selected to provide services externally; wherein the routing strategy includes round-robin scheduling, weight allocation, least connection and response time; the tenant information includes corresponding priority information; and the node health degree includes CPU, memory usage, network delay and traffic load.

[0045] The node is built-in lightweight HTTP parser, which is used for unpacking and mapping the task frame to the business code, because the business process no longer creates any local listening socket, even if the system is scanned, the port or Banner information will not be exposed, the passive detection surface is reduced, and the "invisible HTTP operation" is realized;

[0046] Meanwhile, the outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection, realizes 0-RTT session multiplexing and multiplexing capability, reduces handshake overhead; so that the node can carry complete business traffic by only maintaining the outbound channel, and external scanning cannot find any open port.

[0047] Further, the control plane performs identity verification, rate limiting and log auditing on the request source when scheduling, ensuring full-link controllability after removing the inbound listener; the tunnel uses short-term certificate, one-time token and session sequence management.

[0048] It should be noted that because the service node has established a bidirectional communication QUIC connection with the control plane, the control plane controls the scheduling, and the service node only needs to provide a standard http service; because the control plane controls the scheduling, which services to provide and who to provide can be specified by the control plane, so it is full-link controllable.

[0049] As shown in Figure 3 , the process of node registration and tunnel establishment includes: node startup, initiating outbound connection, registering capability information, activating session, request issuing and response returning.

[0050] Further, referring to Figure 4 , the hot plug management module is also used for request migration and recovery when the node is hot plugged, specifically including:

[0051] Publishing starts; the control plane detects new version notification scheduling;

[0052] New node online; pull up the container-outbound registration to establish a QUIC connection;

[0053] Traffic smooth migration; route weight switching, new node takes over new requests;

[0054] Old node recycling; after processing the inventory session, actively close the outbound connection;

[0055] Release complete; only new nodes are online, and the inbound policy remains unchanged.

[0056] Thus, when a new version is released, the rolling upgrade, blue-green release and cross-regional expansion are completed without changing the network policy.

[0057] The network policy is mainly the release of the network firewall. If the http service is locally ported, it is generally necessary to release the port on the network firewall.

[0058] Specifically, the non-monitoring deployment of an edge scenario is illustrated:

[0059] In the industrial control, retail cabinet and other restricted scenarios, the HTTP service without local monitoring is deployed. After the service is started, a QUIC tunnel is established to the regional control plane and bidirectional certificate authentication is completed; the control plane encapsulates external requests as HTTP task frames and pushes them to the HTTP service, which parses and executes business logic and returns the response through the tunnel. Since all traffic is transmitted through the existing outbound channel, the on-site gateway and firewall do not need to add inbound policies, and the node will not be discovered by port scanning.

[0060] The service node does not need to monitor the port and will not expose the network surface that can be scanned, but it can still handle standard HTTP traffic without modification and provide better concurrent performance.

[0061] The beneficial effects of the above scheme are as follows:

[0062] 1. Without opening any inbound port or modifying the firewall rule, the dynamic deployment, hot plug expansion and contraction, and safe operation and maintenance of the HTTP service are realized, and the vulnerability exploitation risk brought by passive port scanning is eliminated;

[0063] 2. Since it is delivered through an outbound tunnel, the business process no longer creates any local monitoring socket, so even if the system is scanned, it will not expose the port or Banner information, reducing the passive detection surface;

[0064] 3. The outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection by default, which realizes 0-RTT session multiplexing and multiplexing capability, reduces handshake overhead and port state synchronization cost, and improves throughput and resource utilization in high-concurrency scenarios.

[0065] Based on the same inventive concept, the embodiment of the present application also provides a port-mirroring-free method applied to the port-mirroring-free hot-pluggable HTTP service framework system of the first aspect, with reference to Figure 5 , the method comprises the following steps:

[0066] S101, after the service node is started, an encrypted outbound tunnel is initiated to the control plane, so that any new port does not need to be opened, and the service capability, health status and running version corresponding to the service node are registered in the tunnel;

[0067] S102, the received task frame is unpacked and mapped to the business code by the built-in lightweight HTTP parser to execute the business logic, and the response is returned through the outbound tunnel; wherein the task frame is uniformly monitored by the control plane through the external HTTP / HTTPS entrance, and after receiving the request, the target node is selected according to the preset matching rule, the request is packaged into a task frame, and is safely issued through the outbound tunnel;

[0068] S103, the service node online / offline is reported in real time through the outbound tunnel, so that the control plane completes the rolling upgrade without changing the network strategy.

[0069] Specifically, the outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection, realizes 0-RTT session multiplexing and multiplexing capability, and reduces the handshake overhead.

[0070] Further, the control plane performs identity verification, rate limiting and log auditing on the request source when scheduling, to ensure that the full-link controllability is still possessed after removing the inbound monitoring;

[0071] After receiving the request, the target node is selected according to the routing strategy, tenant information and node health degree, the request is packaged into a task frame, and is safely issued through the outbound tunnel.

[0072] Further, the method further comprises request migration and recycling when the node is hot-plugged, specifically comprising:

[0073] Publishing starts;

[0074] New node online;

[0075] Traffic smooth migration;

[0076] Old node recycling;

[0077] Publishing completion.

[0078] It should be noted that the more specific workflow of the method embodiment is described in the foregoing system embodiment part, which will not be repeated here.

[0079] The whole scheme has the following advantages:

[0080] 1. Without opening any inbound port and without modifying the firewall rule, the dynamic deployment of HTTP service, hot plug expansion and security operation and maintenance are realized, and the vulnerability utilization risk brought by passive port scanning is eliminated;

[0081] 2. Since it is safely issued through an outbound tunnel, the service process no longer creates any local listening socket, so even if the system is scanned, the port or Banner information will not be exposed, and the passive detection surface is reduced;

[0082] 3. The outbound tunnel uses QUIC connection instead of traditional HTTP / 1.1 short connection by default, realizes 0-RTT session multiplexing and multiplexing capability, reduces handshake overhead and port state synchronization cost, and improves throughput and resource utilization in high concurrency scenarios.

[0083] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A hot-pluggable HTTP service framework system without port scanning, characterized in that, The system applied to a service node comprises: a node starting module, configured to initiate an encrypted outbound tunnel to a control plane after starting of the service node, so as to not open any new port, and register the service capability, health status and running version corresponding to the service node in the tunnel; a parsing module, configured to unpack a received task frame and map the task frame to a business code to execute a business logic, and return a response through the outbound tunnel; wherein the task frame is uniformly listened to by the control plane to an external HTTP / HTTPS entrance, and after receiving a request, a target node is selected according to a preset matching rule, the request is packed into a task frame, and the task frame is safely issued through the outbound tunnel; a hot plug management module, configured to instantly report the service node online / offline through the outbound tunnel, so that the control plane completes rolling upgrade without changing a network strategy.

2. The system of claim 1, wherein, The outbound tunnel uses a QUIC connection to replace a traditional HTTP / 1.1 short connection, realizes 0-RTT session multiplexing and multiplexing capability, and reduces handshake overhead.

3. The system of claim 1, wherein, The target node is selected according to the preset matching rule, and specifically includes: matching according to a routing strategy, tenant information and service node health degree to select a corresponding service node as the target node.

4. The system of claim 2, wherein, The control plane performs identity verification, rate limitation and log auditing on a request source when scheduling, so as to guarantee full-link controllability after removal of inbound listening.

5. The system of any one of claims 1 to 4, wherein, The hot plug management module is further configured to request migration and recovery when the node is hot plugged, and specifically includes: publishing start; new node online; smooth traffic migration; old node recovery; publishing completion.

6. A method of port snoop-free, characterized by, The method applied to the port-free listening hot-pluggable HTTP service framework system of claim 2 comprises the following steps: after starting of the service node, initiating an encrypted outbound tunnel to a control plane, so as to not open any new port, and registering the service capability, health status and running version corresponding to the service node in the tunnel; unpacking a received task frame and mapping the task frame to a business code to execute a business logic, and returning a response through the outbound tunnel; wherein the task frame is uniformly listened to by the control plane to an external HTTP / HTTPS entrance, and after receiving a request, a target node is selected according to a preset matching rule, the request is packed into a task frame, and the task frame is safely issued through the outbound tunnel; the service node online / offline is instantly reported through the outbound tunnel, so that the control plane completes rolling upgrade without changing a network strategy.

7. The method of claim 6, wherein, The outbound tunnel uses a QUIC connection to replace a traditional HTTP / 1.1 short connection, realizes 0-RTT session multiplexing and multiplexing capability, and reduces handshake overhead.

8. The method of claim 7, wherein, The control plane performs identity verification, rate limitation and log auditing on a request source when scheduling, so as to guarantee full-link controllability after removal of inbound listening.

Images