Access control method, access control end, and cluster

Abstract

An access control method, an access control end, and a cluster. The method comprises: receiving a target data packet, wherein the target data packet comprises a value to be matched; acquiring a target code of at least one rule from an access control list (ACL), the target code comprising a matching logic instruction and a matching item that correspond to each rule, wherein the matching item is used for determining whether said value matches the rule corresponding to the matching item; on the basis of the matching item and said value, executing the matching logic instruction to obtain a matching result of said value and the rule corresponding to the matching item; and on the basis of the matching result, allowing or blocking the passage of the target data packet. The method can improve access control efficiency.

Description

Access control method, access control terminal and cluster

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on October 25, 2023, with application number 202311393692.6 and application name “A method, device and other equipment for data processing”, and the Chinese patent application filed with the State Intellectual Property Office of China on January 31, 2024, with application number 202410137605.9 and application name “A method for access control, access control terminal and cluster”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to an access control method, an access control terminal, and a cluster. Background Art

[0003] An access control list (ACL) is an access control technology based on packet filtering. An ACL includes at least one routing information element, each of which may include at least one rule. This rule is used to control access to data packets. Specifically, if a data packet matches all of the at least one rule, the data packet is allowed to pass or blocked. Each of the at least one ACL rule typically includes one or more matching items. A match is determined by checking whether the packet's to-be-matched value matches a matching item.

[0004] Currently, the matching items of the rules are stored in the memory. When determining whether a data packet matches the rule, the matching items need to be read from the memory, which results in a large number of memory access operations and affects the efficiency of access control.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide an access control method, an access control terminal, and a cluster, which can improve the efficiency of access control.

[0007] In a first aspect, an access control method is provided, the method comprising: receiving a target data packet, the target data packet including a value to be matched; obtaining a target code of at least one rule in an access control list (ACL), the target code including a matching logic instruction and a matching item corresponding to each rule, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; executing the matching logic instruction based on the matching item and the value to be matched to obtain a matching result between the value to be matched and the rule corresponding to the matching item; and allowing or blocking the target data packet based on the matching result.

[0008] In this method, matching items are included in the code used to perform access control. When the processor loads the code from memory, the matching items are also loaded. This eliminates the need to retrieve the matching items from memory when determining whether a target packet matches a rule. This reduces the number of memory accesses, saves memory access operations, and improves access control efficiency.

[0009] In a possible implementation, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol (IP) address, a destination port, and a destination IP address.

[0010] In this implementation, the ACL can control data packets based on at least one of the protocol number, source port, source Internet Protocol (IP) address, destination port, and destination IP address, thereby improving the flexibility of access control.

[0011] In a possible implementation, before receiving the target data packet, the method includes: obtaining a matching item; and generating a target code based on a matching logic instruction corresponding to at least one rule and the matching item.

[0012] In this implementation, before performing access control based on an ACL, matching items in the ACL can be retrieved and incorporated into the code used to perform access control, resulting in a target code. This eliminates the need to retrieve matching items from memory when using the target code to perform access control on target data packets, saving memory access operations and improving access control efficiency.

[0013] In one possible implementation, the matching item is a default value, and the target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: generating a default code based on the matching logic instructions and matching items of at least one rule, and the default code indicates skipping the execution of the matching logic instructions.

[0014] The default value of the match item indicates that no matter what the value to be matched is, it matches the rule, so there is no need to execute the corresponding matching logic instructions. In this case, a default code is generated, which indicates that the matching logic instructions should be skipped. Therefore, when performing access control, the default code can be used to skip the matching logic instructions, reducing the execution of logic instructions and improving access control efficiency.

[0015] In one possible implementation, the matching item is a preset value, and a target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: generating a first judgment code based on the matching logic instructions and matching items of at least one rule, and the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0016] The matching item is a preset value. By judging whether the value to be matched is consistent with the matching item, the matching result between the value to be matched and the rule can be obtained. This has a high matching efficiency and can improve the efficiency of access control.

[0017] In one possible implementation, the matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and a target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: determining the left endpoint as the minimum value of the value to be matched, generating a second judgment code based on the matching logic instructions and matching items of at least one rule, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or determining the right endpoint as the maximum value of the value to be matched, generating a third judgment code based on the matching logic instructions and matching items of at least one rule, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0018] When a matching item consists of multiple consecutive values, these values ​​can be represented by an interval. By determining whether the value to be matched falls within this interval, the matching result between the value to be matched and the rule can be obtained. This improves access control efficiency.

[0019] When the left endpoint of an interval is the minimum possible value of the value to be matched, the matching result between the value to be matched and the rule can be obtained by simply checking whether the value to be matched is less than or equal to the right endpoint of the interval. This further improves the efficiency of access control.

[0020] When the right endpoint of an interval is the maximum value that the value to be matched can take, the matching result between the value to be matched and the rule can be obtained by simply checking whether the value to be matched is greater than or equal to the left endpoint of the interval. This further improves the efficiency of access control.

[0021] In a possible implementation, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

[0022] In this implementation, the target code can be generated based on the ACL's dictionary tree structure and the JIT's code compilation capability, which has high code generation efficiency.

[0023] In a second aspect, an access control terminal is provided, which includes: a receiving module for receiving a target data packet, the target data packet including a value to be matched; an acquisition module for obtaining a target code of at least one rule in an access control list (ACL), the target code including a matching logic instruction and a matching item corresponding to each rule, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; an execution module for executing the matching logic instruction based on the matching item and the value to be matched to obtain a matching result between the value to be matched and the rule corresponding to the matching item; and a control module for allowing or blocking the target data packet from passing based on the matching result.

[0024] In a possible implementation, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol (IP) address, a destination port, and a destination IP address.

[0025] In a possible implementation, before receiving the target data packet, the acquisition module is configured to: acquire a matching item; and generate a target code based on the matching logic instruction and the matching item corresponding to at least one rule.

[0026] In a possible implementation, the matching item is a default value, and the acquisition module is used to generate a default code based on the matching logic instruction and the matching item of the at least one rule, where the default code indicates to skip executing the matching logic instruction.

[0027] In a possible implementation, the matching item is a preset value, and the acquisition module is used to generate a first judgment code based on the matching logic instruction and the matching item of at least one rule, where the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0028] In one possible implementation, the matching item is a preset interval, and the preset interval includes a left endpoint and a right endpoint. The acquisition module is used to: determine the left endpoint as the minimum value of the value to be matched, and generate a second judgment code based on the matching logic instructions and matching items of at least one rule, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or determine the right endpoint as the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instructions and matching items of at least one rule, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0029] In a possible implementation, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

[0030] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster performs the method provided in the first aspect.

[0031] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0032] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0033] The beneficial effects of the second to fifth aspects can be referred to the above introduction to the beneficial effects of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] FIG1 is a schematic diagram of a system architecture provided in an embodiment of the present application;

[0035] FIG2 is a schematic diagram of the structure of an access control terminal provided in an embodiment of the present application;

[0036] FIG3 is a schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0037] FIG4 is a flow chart of a code generation method provided in an embodiment of the present application;

[0038] FIG5 is a schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0039] FIG6 is a schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0040] FIG7 is a schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0041] FIG8 is a flowchart of an access control method provided in an embodiment of the present application;

[0042] FIG9 is a schematic diagram of the structure of an access control terminal provided in an embodiment of the present application;

[0043] FIG10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0044] FIG11 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0045] FIG12 is a schematic diagram of a structure of a computing device cluster connected via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following describes the solutions provided by the embodiments of the present application in conjunction with the accompanying drawings. In the embodiments of the present application, "plurality" refers to two or more than two. "First," "second," and the like are merely used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0047] Next, the technical terms that may be involved in the embodiments of this application are introduced.

[0048] An access control list (ACL) is a user-configured list of rules for resource access control. ACLs come in various types, including network ACLs and file system ACLs. Generally speaking, a network ACL is a list of rules for access control of intranet resources. A file system ACL is a list of rules for access control of file systems. An ACL includes at least one routing information item, and each routing information item includes at least one rule. If a packet matches at least one rule in a routing information item, it is considered a match with the routing information item, meaning that the packet has hit the routing information item. When at least one rule consists of multiple rules, the multiple rules have a matching order. When performing access control on a packet, the packet is sequentially determined to see if it matches the multiple rules according to this matching order. Specifically, for two adjacent rules in the matching order, the packet is first determined to see if it matches the rule in the first position. If so, the packet is then determined to see if it matches the rule in the second position. And so on. For a piece of routing information, whenever a rule does not match, the matching process is terminated, resulting in a match result indicating that the packet does not match the routing information item. The packet is then determined to see if it matches the next piece of routing information item. This process continues until a match is found between the packet and a specific route, or the packet does not match any route. ACL-based access control follows a "stop matching once a match is found" mechanism: once a match is found between a packet and a specific route, matching is terminated without further checking for matches with other routes. If the ACL is a whitelist, if a packet does not match any route, the packet is blocked, preventing it from accessing the corresponding resource. Conversely, if the packet matches any route, the packet is allowed to access the corresponding resource. If the ACL is a blacklist, if a packet matches any route, the packet is blocked. Conversely, if the packet does not match any route, the packet is allowed to access the corresponding resource. Furthermore, an implicit statement ends the ACL rule. If the ACL is a whitelist, this implicit statement indicates a block. That is, if the packet does not match any route, the implicit statement is executed, preventing the packet from passing. If the ACL is a blacklist, the implicit statement indicates a permit. That is, when a data packet does not match any routing information, the implicit statement is executed and the data packet is allowed to pass.

[0049] Matching items: Matching items belong to rules and are used to determine whether a data packet matches the rule. Among them, matching items are used to determine whether a data packet matches a rule by determining whether the to-be-matched value in the data packet matches the rule. For example, the destination address consists of four bytes, and each byte serves as a rule. The destination address can be set to "192.167.1.1". Then the matching item for the first byte (i.e., the first rule of the destination address) is "192", and the matching item for the second byte (i.e., the second rule of the destination address) is "167". Then the matching item for the third byte (i.e., the third rule of the destination address) is "1", and the matching item for the fourth byte (i.e., the fourth rule of the destination address) is "1".

[0050] Value to be matched: is the value carried by the data packet. The value to be matched corresponds to the ACL rule. The value to be matched is used to determine whether the data packet matches the rule. When the value to be matched is consistent with the matching item of the corresponding rule, it can be confirmed that the value to be matched matches the rule. If the value to be matched matches the rule, it means that the data packet matches the rule. For example, if the rule is the source Internet Protocol (IP) address, the value to be matched is the value of the source IP address of the data packet. For another example, if the rule is the first byte in the destination address, the value to be matched is the value of the first byte in the destination address carried by the data packet.

[0051] A trie, also known as a trie or prefix tree, is a tree-like data structure used to count, sort, and store large numbers of strings. The string recorded by a node in the trie is a prefix of the string recorded by its next hop node. Nodes that record the same string can be merged into a single node. In other words, a node can have multiple next hop nodes, and the string recorded by a node is the common prefix of the strings recorded by these multiple next hop nodes. This allows queries to use the common prefix of multiple strings, reducing unnecessary string comparisons and improving query efficiency.

[0052] Just-in-time compilation (JIT): Also known as real-time compilation or real-time compilation, it is a method of compiling computer code during program execution. Compilation refers to the conversion of source code or bytecode into machine code that can be directly executed by a computer. Runtime compilation is performed by the JIT compiler.

[0053] An embodiment of the present application provides an access control method based on ACL. This method can include the matching items of the ACL rules into the target code of the rules, so that when the processor loads the target code of the rules, it can load the matching items. When performing access control on the target data packet, it is directly judged based on the matching items in the target code whether the to-be-matched value of the target data packet matches the corresponding rule, thereby obtaining the matching result of the matching value of the data packet and the rule. Then, based on the matching result, the target data packet can be allowed or blocked from passing. In this way, there is no need to read the matching items from the memory, which saves memory read operations and improves the efficiency of access control.

[0054] Next, the access control method provided in the embodiment of the present application is introduced.

[0055] Figure 1 shows a system architecture diagram of the access control method provided by an embodiment of the present application. As shown in Figure 1, the system architecture may include a management terminal 110, an access terminal 120, an access control terminal 200, and a resource terminal 300. The management terminal 110 and the access terminal 120 may be any device, platform, or cluster with data processing and communication capabilities, such as a terminal device, server, etc. The access control terminal 200 may be a cloud platform, a computing device, a computing device cluster, etc. In some embodiments, the access control terminal 200 may be a computing instance such as a virtual machine (VM) or a container deployed in a cloud platform, computing device, or computing device cluster. In some embodiments, the access control terminal 200 may be a hardware device such as a switch, router, or hardware firewall. In some embodiments, the access control terminal 200 may be a software system such as a virtual network or software firewall. The resource terminal 300 is the destination terminal requested for access by the access terminal 120. In some embodiments, the resource terminal 300 may be an intranet of an organization such as an enterprise. In some embodiments, the resource terminal 300 may be a file system. In some embodiments, the resource terminal 300 may be a cloud network, such as a virtual private cloud (VPC).

[0056] The administrator can configure an ACL for the resource terminal 300 on the management terminal 110 through configuration operations. The management terminal 110 can send the ACL to the access control terminal 200, so that the access control terminal 200 performs access control on the data stream sent to the resource terminal 300 based on the ACL. The user can trigger the access terminal 120 to send a data stream for accessing the resource terminal 300 through access operations. The data stream consists of multiple data packets sent in chronological order. The access control terminal 200 can perform access control on the data packets in the data stream and send the data packets that have passed access control (i.e., the data packets that have been filtered by the access control) to the resource terminal 300, thereby enabling the user to access the resource terminal 300.

[0057] Next, the functions of the access control terminal 200 will be introduced with reference to FIG. 2 .

[0058] 2 , the access control terminal 200 may include a code generation module 220 and an access control module 230 .

[0059] In some embodiments, the code generation module 220 may generate target code for at least one rule in the ACL. The ACL may include at least one routing information, each routing information including at least one rule. The code generation module 220 may generate target code for at least one rule for each routing information.

[0060] In some embodiments, an ACL can be configured to include the three routing information items shown in Table 1, with each routing information item including at least one rule. Access control can be configured for target data packets, using byte-level granularity to determine whether the target data packet complies with the ACL rules. Based on the byte granularity, each routing information item is divided into 11 rules, meaning each routing information item includes 11 rules. The protocol number is one byte, representing one rule; the source IP address is four bytes, representing four rules; the source port is two bytes, representing two rules; the destination IP address is four bytes, representing four rules; and the destination port is two bytes, representing two rules. Thus, the routing information included in the ACL can be divided into at least one rule. The at least one rule has a matching order of: protocol number, first byte of source IP address, second byte of source IP address, third byte of source IP address, fourth byte of source IP address, first byte of source port, second byte of source port, first byte of destination IP address, second byte of destination IP address, third byte of destination IP address, fourth byte of destination IP address, first byte of destination port, and second byte of destination port.

[0061] Table 1

[0062] In some embodiments, an ACL can be configured to include the two routing information items shown in Table 2, each of which includes at least one rule. The protocol number is a preset value, and both the IP address and port number can be expressed as a range. In this embodiment, the protocol number, source IP address, source port, destination IP address, and destination port number in each routing information item can be used as a rule in the ACL.

[0063] Table 2

[0064] The code generation module 220 can generate a target code for each piece of routing information based on at least one rule. The target code for each rule can be generated one by one according to the matching order between the at least one rule, thereby obtaining the target code for the at least one rule. The target code for the at least one rule can be referred to as the target code for the routing information to which the at least one rule belongs. The target codes for the multiple pieces of routing information included in the ACL constitute the target code for the ACL.

[0065] In some embodiments, code generation module 220 generates target code for at least one rule in the ACL based on a trie corresponding to the ACL. As shown in FIG2 , access control terminal 200 further includes a trie construction module 210. Trie construction module 210 can obtain the ACL and generate a trie based on the ACL. For example, based on the ACL shown in Table 1 and using a trie generation algorithm, trie construction module 210 can generate the trie shown in FIG3 .

[0066] As shown in Figure 3, an ACL includes multiple rules, and a dictionary tree includes multiple nodes. The multiple rules correspond to nodes in the multiple nodes. In the matching order between the multiple rules, the rule corresponding to a node precedes the rule corresponding to the node's next hop node. A node records the matching items of the rule corresponding to the node.

[0067] In a traditional table lookup approach, when performing access control on a target data packet, the system jumps between multiple nodes. Each time it jumps to a node, it retrieves the matching items recorded by that node and, based on the matching items, determines whether the target data packet matches the rule. The order of jumping between the multiple nodes is consistent with the order in which the multiple rules are matched. The root node represents the protocol number, and when performing access control on the target data packet, matching begins at the root node.

[0068] More specifically, each node has 256 positions, each of which is used to record the matching items of the corresponding rule. If all 256 positions have values, this means that the matching items of the rule cover all possible values ​​of the target data packet to be matched, that is, the rule is unrestricted (for example, the rule is "any"). For example, the first byte of the source IP address in each routing information shown in Table 1 records 0, 1, 2, ..., 255, which covers all possible values ​​of the first byte of the source IP address, indicating that the rule represented by the first byte is unrestricted.

[0069] As described above, the string recorded in a node in the dictionary tree is the prefix of the string recorded in the node's next hop node. That is, the matching item recorded in the node is the prefix of the matching item recorded in the node's next hop node. If the prefixes of the matching items of the corresponding rules in different routing information are the same, the prefix can be recorded in one node. Furthermore, if the matching items of the corresponding rules in different routing information are different, when the prefixes of these different matching items are the same, these different matching items are also recorded in the same node, specifically in different locations in different nodes. For example, as shown in Table 1, the matching items of the rule represented by the second byte of the destination IP address in different routing information are different, namely the preset value "167", the preset value "168", and the preset value "169". The matching item of the rule represented by the first byte of the destination IP address in each routing information is the preset value "192", that is, the matching items of the rule represented by the first byte of the destination IP address in different routing information are the same. Therefore, the matching items of the rule represented by the second byte of the destination IP address in different routing information have a common prefix, which is the matching item of the rule represented by the first byte of the destination IP address.

[0070] In addition, if the matching items of the corresponding rules in different routing information are different, it means that these matching items are different prefixes, and the next hop nodes of the node recording the matching items of the rule are different, that is, a branch is generated from the node recording the matching items of the rule. For example, the matching items of the rule represented by the second byte of the destination IP address shown in Table 1 are the preset value "167", the preset value "168", and the preset value "169", respectively, pointing to different next hop nodes. In other words, the dictionary tree generates branches from the nodes recording the preset value "167", the preset value "168", and the preset value "169", and the nodes recording the preset value "167", the preset value "168", and the preset value "169" have multiple next hop nodes.

[0071] The specific method of generating a dictionary tree based on ACL can also refer to the introduction of the existing technology, which will not be described here in detail.

[0072] The code generation module 220 can obtain the dictionary tree constructed by the dictionary tree construction module 210 and generate the target code of the ACL based on the dictionary tree. The specific generation process will be introduced below and will not be repeated here.

[0073] In some embodiments, the code generation module 220 may be implemented as a JIT compiler. Thus, the JIT compiler's ability to compile source code or bytecode into machine code may be utilized to convert the rules in the ACL or the trie corresponding to the ACL into target code for at least one rule in the ACL (i.e., generate target code based on the trie).

[0074] The access control module 230 can obtain the target code generated by the code generation module 220 and execute the target code to perform access control on the data packets sent to the resource end 300. The specific process of access control will be introduced below and will not be repeated here.

[0075] The above examples introduce a system architecture that can be used to implement the access control method provided by the embodiment of the present application. Next, in conjunction with this system architecture, the specific process of the access control method provided by the embodiment of the present application is introduced.

[0076] First, the process of generating the target code of ACL rules is introduced.

[0077] 4 , after obtaining the ACL, the code generation module 220 may be started and run in step 401. In some embodiments, the code generation module 220 generates the target code of the ACL based on the ACL dictionary tree. Therefore, the code generation module 220 is started and run after the dictionary tree construction module 210 generates the dictionary tree.

[0078] In some embodiments, after the code generation module 220 is started, step 402 may be executed to generate an initialization code for access control.

[0079] In one example of this embodiment, the initialization code includes code for performing a non-volatile register stack backup. This code can back up the caller information of the target code when the access control module 230 executes the target code to prevent the target code execution process from damaging the caller information.

[0080] In another example of this embodiment, the initialization code includes code for allocating registers. The code is used to allocate a register pointing to the current rule and a register pointing to the current query string. The register pointing to the current rule is a register in a processor (e.g., a central processing unit (CPU)) used to store the target of the current rule. As described above, the access control performed on the data packet determines whether the to-be-matched value in the data packet matches each rule in at least one rule in turn according to the matching order between at least one rule. When it is necessary to determine whether the to-be-matched value matches the current rule according to the matching order, the target code of the current rule is obtained from the register pointing to the current rule, and the code is executed.

[0081] In one example, the register pointing to the current rule is specifically a register pointing to the current trie node. The current trie node refers to the trie node that records the matching item of the current rule.

[0082] The register pointing to the current query string is a register used by the processor to store the current query string. The current query string is the string in the data packet, i.e., the value to be matched in the data packet. The match between the string and the matching item in the current rule is determined by determining whether the data packet matches the current rule. This will be described in detail below with reference to the accompanying figures and will not be detailed here.

[0083] Continuing to refer to FIG. 4 , the code generation module 220 may execute step 403 to generate target code for each rule in the ACL.

[0084] In step 403, the matching items of the rule may be obtained, and matching logic instructions corresponding to the rule may be generated based on the matching items. Then, based on the matching logic instructions corresponding to the rule and the matching items of the rule, the target code for the rule may be generated. For example, the matching logic instructions corresponding to the rule and the matching items of the rule may be combined to obtain the target code for the rule.

[0085] In some embodiments, the matching item of the rule can be a default value. The default value covers all possible values ​​of the value to be matched of the target data packet. Therefore, no matter what the value to be matched is, when judging whether the value to be matched matches the rule based on the matching item, the result of the value to be matched matching the rule is obtained. In this case, when performing access control on the target data packet, there is no need to judge whether the value to be matched of the target data packet matches the rule, and the matching result of the value to be matched matching the rule can be directly obtained. Therefore, a default code can be generated in step 403, and the default code is used to indicate to skip executing the matching logic instruction corresponding to the rule. When performing access control on the target data packet, the default code is executed to skip the matching logic instruction corresponding to the rule, that is, the matching logic instruction corresponding to the rule is not executed.

[0086] In some embodiments, the matching item of the rule is a preset value. In step 403, a judgment code F1 may be generated, indicating whether the to-be-matched value of the target data packet is consistent with the matching item. This judgment code F1 may serve as a matching logic instruction corresponding to the rule. When performing access control on the target data packet, this judgment code F1 is executed to determine whether the to-be-matched value of the target data packet is consistent with the matching item. If they are consistent, it indicates that the to-be-matched value of the target data packet matches the rule.

[0087] In some embodiments, the matching items of the rule are multiple continuous values, which form an interval. In step 403, a judgment code F2 can be generated. The judgment code F2 is used to indicate whether the value to be matched of the target data packet is within the interval. The judgment code F2 can be used as a matching logic instruction corresponding to the rule. When performing access control on the target data packet, the judgment code F2 is executed to determine whether the value to be matched of the target data packet is within the interval. If it is within the interval, it means that the value to be matched of the target data packet matches the rule.

[0088] In an example of this embodiment, the left endpoint of the interval is the minimum value of the value to be matched of the target data packet, that is, the left endpoint is the minimum value among all possible values ​​of the value to be matched. In other words, no matter what the value to be matched is, it is greater than or equal to the left endpoint of the interval. Therefore, when the target data packet is subjected to access control, it is not necessary to determine whether the value to be matched is greater than or equal to the left endpoint of the interval. It is only necessary to determine whether the value to be matched is less than or equal to the right endpoint of the interval to determine whether the value to be matched is within the interval. In this example, the judgment code F2 can only indicate whether the value to be matched is less than or equal to the right endpoint of the interval. In this way, when performing access control, it is only necessary to determine whether the value to be matched is less than or equal to the right endpoint of the interval, thereby further improving the efficiency of access control.

[0089] In another example of this embodiment, the right endpoint of the interval is the maximum value of the value to be matched of the target data packet, that is, the right endpoint is the maximum value among all possible values ​​of the value to be matched. In other words, no matter what the value to be matched is, it is less than or equal to the right endpoint of the interval. Therefore, when the target data packet is subjected to access control, it is not necessary to determine whether the value to be matched is less than or equal to the right endpoint of the interval. It is only necessary to determine whether the value to be matched is greater than or equal to the left endpoint of the interval to determine whether the value to be matched is within the interval. In this example, the judgment code F2 can only indicate whether the value to be matched is greater than or equal to the left endpoint of the interval. In this way, when performing access control, it is only necessary to determine whether the value to be matched is greater than or equal to the left endpoint of the interval, thereby further improving the efficiency of access control.

[0090] In some embodiments, the ACL includes at least one rule, and the at least one rule can be traversed to generate a target code for each rule. The ACL can include multiple routing information, each routing information including at least one rule, and the at least one rule in each routing information can be traversed to generate a target code for the at least one rule in each routing information. At least one rule in the same routing information has a matching order, and the at least one rule can be traversed according to the matching order to generate the target code.

[0091] Next, we introduce the target code generation scheme based on specific rules.

[0092] Typically, routing information may include at least one of the following: protocol number, source IP address, source port, destination IP address, and destination port. Each of these three items in the same routing information represents a rule. Generally, the matching order is: protocol number, source IP address, source port, destination IP address, and destination port.

[0093] You can first generate target code for the protocol number rule, specifically in the following situations: the protocol number value in the ACL is the match item, and the protocol number value of the data packet is the value to be matched.

[0094] In case D1, the matching item for the protocol number of a certain routing information is the default value, that is, the value of the protocol number of the routing information covers all possible values ​​of the protocol number of the target data packet. In other words, no matter what the protocol number of the target data packet is, the protocol number of the target data packet is consistent with the protocol number of the routing information. In this case, the protocol number of the target data packet matches the protocol number in the routing information by default. Then, in step 403, a default code can be generated for the protocol number. This default code is used to instruct to skip executing the matching logic instruction corresponding to the protocol number. When performing access control, this default code is executed without determining whether the protocol number of the target data packet matches the protocol number in the routing information.

[0095] In case D2, when the number of matching items for a protocol number in a particular routing information is one, that is, when the matching item for the protocol number in the routing information is a preset value, a judgment code F1 can be generated for the protocol number. This judgment code F1 indicates whether the value of the protocol number of the target data packet is consistent with the matching item for the protocol number. This judgment code F1 can be used as a matching logic instruction corresponding to the protocol number. When performing access control on the target data packet, this judgment code F1 is executed to determine whether the value of the protocol number of the target data packet is consistent with the matching item for the protocol number. If they are consistent, it indicates that the protocol number of the target data packet matches the protocol number of the routing information.

[0096] Case D3, when the matching item of the protocol number of a certain routing information is a continuous multiple values. An interval can be generated based on the multiple values, and the interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the protocol number. The judgment code F2 is used to indicate whether the value of the protocol number of the target data packet is within the interval. When access control is performed on the target data packet, the judgment code F2 is executed to determine whether the value of the protocol number of the target data packet is within the interval. If it is within the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0097] In an example of this embodiment, the left endpoint of the interval is the minimum value of the protocol number of the target data packet, that is, the left endpoint is the minimum value among all possible values ​​of the protocol number of the target data packet. In this example, the judgment code F2 can only indicate whether the value of the protocol number of the target data packet is less than or equal to the right endpoint of the interval. When the access control is performed on the target data packet, only whether the value of the protocol number of the target data packet is less than or equal to the right endpoint of the interval is judged. If the value of the protocol number of the target data packet is less than or equal to the right endpoint of the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0098] In another example of this embodiment, the right endpoint of this interval is the maximum value of the protocol number of the target data packet, that is, the right endpoint is the maximum value among all possible values ​​of the protocol number of the target data packet. In this example, the judgment code F2 can only indicate whether the value of the protocol number of the target data packet is greater than or equal to the left endpoint of the interval. When the target data packet is subjected to access control, only the value of the protocol number of the target data packet is judged to be greater than or equal to the left endpoint of the interval. If the value of the protocol number of the target data packet is greater than or equal to the left endpoint of the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0099] Next, you can generate target code for the source IP address rule, which can be as follows: the source IP address value in the ACL is the matching item, and the source IP address value in the data packet is the value to be matched.

[0100] In case E1, the matching item of the source IP address of a certain routing information is the default value, that is, the value of the source IP address of the routing information covers all possible values ​​of the source IP address of the target data packet. In other words, no matter what the source IP address of the target data packet is, the source IP address of the target data packet is consistent with the source IP address of the routing information. For example, the source IP address "0.0.0.0 / 0" shown in Table 2 is equivalent to "0-0xFFFFFFFF", which covers all possible values ​​of the source IP address of the target data packet. In this case, the source IP address of the target data packet matches the source IP address in the routing information by default. Then, in step 403, a default code can be generated for the source IP address, and the default code is used to indicate to skip executing the matching logic instruction corresponding to the source IP address. When performing access control, the default code is executed, and it is not determined whether the source IP address of the target data packet matches the source IP address in the routing information.

[0101] In case E2, when the number of matching items for the source IP address of a certain routing information is one, that is, when the matching item for the source IP address of the routing information is a preset value, a judgment code F1 can be generated for the source IP address. The judgment code F1 indicates whether the value of the source IP address of the target data packet is consistent with the matching item for the source IP address. The judgment code F1 can be used as a matching logic instruction corresponding to the source IP address. When performing access control on the target data packet, the judgment code F1 is executed to determine whether the value of the source IP address of the target data packet is consistent with the matching item for the source IP address. If they are consistent, it means that the source IP address of the target data packet matches the source IP address of the routing information.

[0102] In case E3, when the matching items of the source IP address of a certain routing information are multiple consecutive values, an interval can be generated based on the multiple values. The interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the source IP address. When performing access control on the target data packet, the judgment code F2 is executed to determine whether the value of the source IP address of the target data packet is within the interval. If it is within the interval, it means that the source IP address of the target data packet matches the source IP address of the routing information.

[0103] In an example of this embodiment, the left endpoint of the interval is the minimum value (0) of the source IP address of the target data packet, that is, the left endpoint is the minimum value among all possible values ​​of the source IP address. In this example, the judgment code F2 can only indicate whether the value of the source IP address of the target data packet is less than or equal to the right endpoint of the interval. When access control is performed on the target data packet, only whether the value of the source IP address of the target data packet is less than or equal to the right endpoint of the interval is judged. If the value of the source IP address of the target data packet is less than or equal to the right endpoint of the interval, it means that the source IP address of the target data packet matches the source IP address of the routing information.

[0104] In another example of this embodiment, the right endpoint in this interval is the maximum value (0xFFFFFFFF) of the source IP address of target data packet, and promptly the right endpoint is the maximum value in all possible values ​​of source IP address.In this example, judgment code F2 can only indicate whether the value of the source IP address of the target data packet is greater than or equal to the left endpoint in interval.When target data packet is carried out access control, the value of the source IP address of only judging target data packet is the left endpoint in interval that is greater than or equal to.The value of the source IP address of target data packet is greater than or equal to the left endpoint in interval, indicating that the source IP address of target data packet mates with the source IP address of this routing information.

[0105] Next, target codes can be generated for rules such as source port, destination IP address, and destination port. The matching items for source port, destination IP address, and destination port also have the aforementioned cases E1, E2, and E3. Based on the matching items for source port, destination IP address, and destination port, target codes can be generated for the source port, destination IP address, and destination port, respectively, referring to the method described above. This will not be repeated here. In the relevant communication protocols, the maximum value of a port is "65535" (i.e., 2 to the 16th power - 1), and the minimum value is "0."

[0106] The above method can generate target codes for the protocol number, source IP address, source port, destination IP address, and destination port in the routing information. These codes constitute the target code of the routing information. Within the target code of the same routing information, the execution order of the target codes for the protocol number, source IP address, source port, destination IP address, and destination port is consistent with the order in which they are matched.

[0107] The target codes of all routing information of ACL constitute the target code of the ACL. Among them, the target codes of different routing information are executed serially, that is, when the target code of one routing information is executed, the target code of another routing information is executed.

[0108] In one example, the following target code may be generated for the routing information with sequence number 1 shown in Table 2.

[0109] if(protocol number = 6 && 0xc0a80000 <= destination IP && destination IP <= 0xc0a800ff && destination port <= 80)

[0110] return 1; / / If the conditions required by this rule are met, the routing information with sequence number 1 will be returned.

[0111] Among them, the rules in the routing information of sequence number 2 are all default matching rules. Therefore, the target code of the routing information of sequence number 2 is "return 2; / / The second rule matches all situations by default, and the execution returns directly here.

[0112] After JIT compilation, the target code corresponding to the two routing information shown in Table 2 includes the following code:

[0113] if(protocol number = 6 && 0xc0a80000 <= destination IP && destination IP <= 0xc0a800ff && destination port <= 80)

[0114] return 1;

[0115] return 2;"

[0116] In some embodiments, the target code of the ACL may be generated based on the dictionary tree corresponding to the ACL. In step 403, the dictionary tree may be traversed starting from the root node of the dictionary tree to generate the target code for each node.

[0117] As described above, a node corresponds to a rule and records matching items for the rule. Based on the number of next-hop nodes and the matching items recorded by the node, the target code for the rule corresponding to the node can be generated. This can be categorized into the following situations.

[0118] In case A1, each position in the node has a value, and the number of next-hop nodes of the node in the dictionary tree is one. Each position in the node has a value, which means that the node has recorded all possible matching items of the rule, that is, the matching items recorded by the node cover all possible values ​​of the target data packet's to-be-matched value, that is, the rule corresponding to the node is not restricted, and the matching item of the rule is the default value, and the value to be matched of the default data packet matches the rule corresponding to the node. For case A1, a default code is generated for the rule corresponding to the node in step 404, and the default code is used to indicate to skip executing the matching logic instruction corresponding to the rule. When performing access control on the target data packet, the default code is executed without judging whether the value to be matched of the target data packet matches the rule, and the matching result of the matching value of the target data packet matching the rule is directly obtained.

[0119] For example, as shown in Figure 5, every position in the node corresponding to the rule "Second Byte of Source Port" has a value, and the number of next-hop nodes for the node in the dictionary tree is one. A default code is generated for the rule "Second Byte of Source Port". When performing access control on a target packet, this default code is executed without determining whether the target packet's to-be-matched value matches the rule "Second Byte of Source Port". The result is directly that the target packet's matching value matches the rule.

[0120] In case A2, the node records one or more matching items, and the matching items recorded by the node do not cover all possible values ​​of the data packet's to-be-matched value, and the number of next-hop nodes of the node in the dictionary tree is one. In this case, a judgment instruction can be generated to determine whether the to-be-matched value of the data packet is consistent with the matching items recorded by the node. Then, based on the judgment instruction and the matching items recorded by the node, the target code of the rule corresponding to the node is obtained. When performing access control on the target data packet, the judgment instruction is executed to determine whether the to-be-matched value of the target data packet matches the rule corresponding to the node.

[0121] Among them, situation A2 may include the following two situations.

[0122] In case A21, the number of next-hop nodes of the node in the dictionary tree is one, and the number of matching items recorded by the node is one. In the network ACL, when the protocol number is fixed, or several bytes in the IP address are fixed, the dictionary tree has case A21. In case A21, the node has a value recorded in only one position, and the other positions are empty. The value recorded by the node points to a next-hop node. In step 403, a judgment code F1 can be generated for the rule corresponding to the node. The judgment code F1 is used to indicate whether the value to be matched of the target data packet is consistent with the matching item recorded by the node. When access control is performed on the target data packet, the judgment code F1 is executed to determine whether the value to be matched of the target data packet is consistent with the matching item recorded by the node. If consistent, it indicates whether the value to be matched of the target data packet matches the rule corresponding to the node.

[0123] For example, as shown in FIG6 , the value of the first byte of the destination IP address is "192," meaning that the node corresponding to the first byte of the destination IP address only records the value "192." In step 403 , a determination code F1 may be generated, where the determination code F1 is used to determine whether the value of the first byte of the destination IP address of the target data packet is consistent with "192."

[0124] In case A22, the number of next-hop nodes of the node in the dictionary tree is one, and the node records multiple matching items, wherein the multiple matching items are multiple continuous preset values. In case A22, the multiple preset values ​​can be obtained, and an interval can be generated based on the multiple preset values. The interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the node. The judgment code F2 is used to indicate whether the value to be matched of the target data packet is within the interval. When access control is performed on the target data packet, the judgment code F2 is executed to determine whether the value to be matched of the target data packet is within the interval. If it is within the interval, it means that the value to be matched of the target data packet matches the rule corresponding to the node.

[0125] For example, as shown in Figure 7, the value of the fourth byte of the destination IP address can be any of 0, 1, 2, and 3. That is, the node corresponding to the fourth byte of the destination IP address records 0, 1, 2, and 3. Based on 0, 1, 2, and 3, the interval [0, 3] can be obtained. A judgment code F2 can be generated for this node. Judgment code F2 is used to determine whether the to-be-matched value of the target data packet is within the interval [0, 3].

[0126] In addition, when the left endpoint of the interval is the minimum value of the value to be matched of the target data packet, that is, when the left endpoint is the minimum value among all possible values ​​of the value to be matched. The judgment code F2 can only indicate whether the value to be matched of the target data packet is less than or equal to the right endpoint of the interval. When performing access control on the target data packet, only whether the value to be matched of the target data packet is less than or equal to the right endpoint of the interval is judged. If the value to be matched of the target data packet is less than or equal to the right endpoint of the interval, it means that the value to be matched of the target data packet matches the rule corresponding to the node.

[0127] When the right endpoint of the interval is the maximum value of the value to be matched of the target data packet, that is, when the right endpoint is the maximum value among all possible values ​​of the value to be matched. In this example, the judgment code F2 can only indicate whether the value to be matched of the target data packet is greater than or equal to the left endpoint of the interval. When performing access control on the target data packet, it is only determined whether the value to be matched of the target data packet is greater than or equal to the left endpoint of the interval. If the value to be matched of the target data packet is greater than or equal to the left endpoint of the interval, it means that the value to be matched of the target data packet matches the rule corresponding to the node.

[0128] In some embodiments, if a node does not fall into either of the aforementioned scenarios A1 or A2, code is generated for the node to implement a traditional table lookup method. Specifically, the code is configured to determine whether the target packet's to-be-matched value matches the rule corresponding to the node using the traditional table lookup method. In other words, when determining whether the target packet's to-be-matched value matches the rule corresponding to the node, the code is configured to read a matching entry from the memory address corresponding to the node and, based on the matching entry, determine whether the packet matches the rule corresponding to the node.

[0129] In some embodiments, an instruction for returning indication information is generated for each node in the trie. That is, the object code for each node also includes an instruction for returning indication information, where the indication information is used to indicate that the to-be-matched value of the data packet does not match the rule corresponding to the node. In other words, when it is determined that the to-be-matched value of the data packet does not match the rule corresponding to the node, the instruction for returning indication information corresponding to the node is executed.

[0130] In some embodiments, epilogue code may also be generated. The epilogue code is the last code executed. The epilogue code is used to restore the non-volatile register from the stack, write the matching result back to the return value register, and execute the matching result return instruction.

[0131] The target code for each node, the code for returning instruction information, and the closing code generated above constitute the ACL target code. In the ACL target code, the execution order of the target code for each node's rules is consistent with the jump order of each node in the dictionary tree. The jump order of each node in the dictionary tree is consistent with the matching order of the rules corresponding to each node. Therefore, the execution order of the target code for each node's rules is consistent with the matching order of the rules corresponding to each node.

[0132] The above describes the process of generating the target code for the ACL. Next, we will introduce how to use this target code to control access to target data packets.

[0133] The access control terminal 200 can use the target code of the ACL to perform access control on the target data packet. As shown in FIG8 , the method includes the following steps.

[0134] Step 801 : Receive a target data packet, the target data packet including a value to be matched, wherein the target data packet may be a data packet sent to the resource end 300 .

[0135] The value to be matched may be at least one of a protocol number, a source port, a source IP address, a destination port, and a destination IP address. In other words, the value to be matched may be at least one of a value of a protocol number, a value of a source port, a value of a source IP address, a value of a destination port, and a value of a destination IP address of a target data packet.

[0136] After receiving the target data packet, the access control terminal 200 may parse the target data packet to obtain a value to be matched.

[0137] Step 802 obtains the target code for at least one rule in the ACL. The target code includes the matching logic instructions and matching items corresponding to each rule. The matching items are used to determine whether the value to be matched matches the rule corresponding to the matching item. This determination is specifically performed by the matching logic instructions. In other words, the access control terminal 200 determines whether the matching value matches the rule corresponding to the matching item by executing the matching logic instructions.

[0138] The ACL may include one or more pieces of routing information, and the at least one rule may be a rule of one of the routing information.

[0139] The matching logic instructions and matching items corresponding to each rule are included in the target code. This allows the processor of the access control terminal 200 to load the matching items when loading the target code from memory. This eliminates the need to retrieve matching items from memory during the matching process, reducing memory access operations.

[0140] In some embodiments, before step 801, target code for the at least one rule may be generated. Matches for the at least one rule may be obtained. Then, based on the matching logic instructions and matching items corresponding to the at least one rule, target code for the at least one rule is generated. For details, please refer to the above description of the embodiment shown in FIG. 4 , which will not be repeated here.

[0141] Step 802 is performed by the access control module 230 in the access control terminal 200. The target code of the at least one rule is generated by the code generation module 220. When the access control module 230 and the code generation module 220 are running on the same computing device (for example, the access control terminal 200 may be a computing device cluster, and the access control module 230 and the code generation module 220 are running on the same computing device in the computing device cluster), the access control module 230 can obtain the target code generated by the code generation module 220 through shared memory or other means.

[0142] When the access control module 230 and the code generation module 220 run on different computing devices (for example, the access control terminal 200 can be a computing device cluster, and the access control module 230 and the code generation module 220 run in different computing devices in the computing device cluster), the computing device running the code generation module 220 can send the target code to the computing device running the access control module 230 through a network, etc., so that the access control module 230 obtains the target code.

[0143] When the access control module 230 obtains the target code, the access control module 230 may apply for an executable memory from the operating system of the access control terminal 200. For example, when the operating system has a portable operating system interface (POSIX), the access control module 230 may apply for an executable memory from the operating system through the memory mapping function mmap. For another example, when the operating system is When access control module 230 uses the virtualalloc function to request executable memory from the operating system.

[0144] Upon requesting executable memory, access control module 230 can copy the target code to the executable memory and remove the write permission on the executable memory to prevent the target code from being tampered with. Access control module 230 can return the first address of the executable memory to the processor. The first address of the executable memory serves as the address of the target code, allowing the processor to call the target code.

[0145] Step 803: Based on the matching item and the value to be matched, a matching logic instruction is executed to obtain a matching result of the rule corresponding to the value to be matched and the matching item.

[0146] Match logic instructions determine whether the matching item and the value to be matched are consistent. If they are, the value to be matched matches the rule corresponding to the matching item, resulting in a match result indicating a match. If they are inconsistent, the value to be matched does not match the rule corresponding to the matching item, resulting in a match result indicating a mismatch.

[0147] In some embodiments, as described above, the matching item of a rule may be a default value, and the target code of the rule includes a default code that instructs to skip executing the matching logic instructions corresponding to the rule. In step 803, when the matching item is the default value, the default code is executed to skip executing the matching logic instructions corresponding to the rule, thereby reducing the execution of the logic instructions and improving the efficiency of access control. In this embodiment, a match result indicating a match is obtained by default.

[0148] In some embodiments, as described above, the matching item of a rule may be a preset value, and the target code of the rule includes a judgment instruction F1. The judgment instruction F1 instructs to determine whether the value to be matched is consistent with the matching item. Executing the matching logic instruction corresponding to the rule includes executing the judgment instruction F1 of the rule to obtain a result of determining whether the value to be matched is consistent with the matching item. If the judgment result indicates that the value to be matched is consistent with the matching item, a match result indicating a match is obtained. If the judgment result indicates that the value to be matched is inconsistent with the matching item, a match result indicating a mismatch is obtained.

[0149] In some embodiments, as described above, the matching item of the rule may be a preset interval, and the target code of the rule includes a judgment instruction F2. The judgment instruction F2 indicates whether the value to be matched is within the preset interval. Among them, executing the matching logic instruction corresponding to the rule includes: executing the judgment instruction F2 of the rule to obtain a judgment result of whether the value to be matched is within the preset interval. If the judgment result indicates that the value to be matched is within the preset interval, a matching result indicating a match is obtained. If the judgment result indicates that the value to be matched is not within the preset interval, a matching result indicating a mismatch is obtained. In this way, a matching result can be obtained without having to compare the value to be matched with each matching item of the rule one by one, thereby improving the efficiency of access control.

[0150] In one example of this embodiment, if the left endpoint of the preset interval is the minimum value of the matching value, then judgment instruction F2 only instructs to determine whether the value to be matched is less than or equal to the right endpoint of the preset interval. That is, in step 803, it is only necessary to determine whether the value to be matched is less than or equal to the right endpoint of the preset interval. When the value to be matched is less than or equal to the right endpoint of the preset interval, a matching result indicating a match is obtained. Otherwise, a matching result indicating a mismatch is obtained. In this way, if the left endpoint of the preset interval is the minimum value of the matching value, there is no need to determine whether the value to be matched is greater than or equal to the left endpoint of the preset interval, which saves judgment operations and further improves the efficiency of access control.

[0151] In another example of this embodiment, if the right endpoint of the preset interval is the maximum value of the matching value, then judgment instruction F2 only instructs to determine whether the value to be matched is greater than or equal to the left endpoint of the preset interval. In other words, in step 803, only whether the value to be matched is greater than or equal to the left endpoint of the preset interval can be determined. When the value to be matched is greater than or equal to the left endpoint of the preset interval, a matching result indicating a match can be obtained. Otherwise, a matching result indicating a mismatch is obtained. In this way, if the right endpoint of the preset interval is the maximum value of the matching value, there is no need to determine whether the value to be matched is less than or equal to the right endpoint of the preset interval, which saves judgment operations and further improves the efficiency of access control.

[0152] When a match result is obtained, the access control terminal 200 may allow or block the target data packet based on the match result in step 804. The target data packet is a data packet sent to the resource terminal 300. In step 804, the access control terminal 200 may allow or block the target data packet from being sent to the resource terminal 300 based on the match result.

[0153] If the matching result indicates that the to-be-matched value matches the rule, it means that the target data packet hits the routing information in the ACL. When the ACL is a whitelist, the access control terminal 200 allows the target data packet to pass through, so as to send the target data packet to the resource terminal 300. In particular, the access control terminal 200 can place the target data packet into the interface between the access control terminal 200 and the resource terminal 300, so as to send the target data packet to the resource terminal 300 through the interface. When the ACL is a blacklist, the access control terminal 200 blocks the target data packet from passing through, so as to avoid sending the target data packet to the resource terminal 300. In particular, the access control terminal 200 can discard the target data packet.

[0154] In some embodiments, the ACL includes multiple routing information. In step 803, the access control terminal 200 may determine whether the target data packet matches the routing information one by one. If a match result is obtained indicating that the target data packet matches a routing information, the access control terminal 200 may execute step 804. If a match result is not obtained indicating that the target data packet matches a routing information, the access control terminal 200 may continue to determine whether the target data packet matches the next routing information.

[0155] When the target data packet does not match any of the multiple routing information, the access control terminal 200 may execute step 804. When the ACL is a whitelist, the access control terminal 200 blocks the target data packet from passing through. When the ACL is a blacklist, the access control terminal 200 allows the target data packet to pass through.

[0156] In summary, the access control method provided by this application incorporates matching items into the code used to execute access control. When the processor loads the code from memory, it also loads the matching items. This eliminates the need to retrieve matching items from memory when determining whether a target data packet matches a rule, reducing the number of memory accesses, saving memory access operations, and improving access control efficiency.

[0157] The embodiment of the present application further provides an access control terminal 900. As shown in FIG9 , the access control terminal 900 includes:

[0158] A receiving module 910 is configured to receive a target data packet, wherein the target data packet includes a value to be matched;

[0159] An acquisition module 920 is configured to acquire a target code of at least one rule in an access control list (ACL), wherein the target code includes a matching logic instruction and a matching item corresponding to each rule, wherein the matching item is used to determine whether the to-be-matched value matches the rule corresponding to the matching item;

[0160] An execution module 930 is configured to execute the matching logic instruction based on the matching item and the value to be matched, and obtain a matching result of the rule corresponding to the value to be matched and the matching item;

[0161] The control module 940 is configured to allow or block the target data packet from passing through based on the matching result.

[0162] In some embodiments, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol (IP) address, a destination port, and a destination IP address.

[0163] In some embodiments, before receiving the target data packet, the acquisition module 920 is used to: acquire the matching item; and generate the target code based on the matching logic instruction corresponding to the at least one rule and the matching item.

[0164] In an example of this embodiment, the matching item is a default value, and the acquisition module 920 is used to generate a default code based on the matching logic instruction of the at least one rule and the matching item, wherein the default code indicates to skip executing the matching logic instruction.

[0165] In an example of this embodiment, the matching item is a preset value, and the acquisition module 920 is used to: generate a first judgment code based on the matching logic instruction of the at least one rule and the matching item, and the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0166] In an example of this embodiment, the matching item is a preset interval, and the preset interval includes a left endpoint and a right endpoint. The acquisition module 920 is used to: determine that the left endpoint is the minimum value of the value to be matched, and generate a second judgment code based on the matching logic instruction of the at least one rule and the matching item, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or, determine that the right endpoint is the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instruction of the at least one rule and the matching item, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0167] In some embodiments, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to a dictionary tree structure.

[0168] The receiving module 910, the acquiring module 920, the executing module 930, and the controlling module 940 can all be implemented by software or hardware. For example, the following describes the implementation of the receiving module 910, taking the receiving module 910 as an example. Similarly, the implementation of the acquiring module 920, the executing module 930, and the controlling module 9400 can refer to the implementation of the receiving module 910.

[0169] As an example of a software functional unit, the receiving module 910 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the receiving module 910 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0170] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0171] As an example of a hardware functional unit, the receiving module 910 may include at least one computing device, such as a server. Alternatively, the receiving module 910 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0172] The multiple computing devices included in the receiving module 910 can be distributed in the same region or in different regions. The multiple computing devices included in the receiving module 910 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the receiving module 910 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0173] It should be noted that, in other embodiments, the receiving module 910 can be used to execute any step in the method shown in FIG8 , the acquiring module 920 can be used to execute any step in the method shown in FIG8 , the executing module 930 can be used to execute any step in the method shown in FIG8 , and the controlling module 940 can be used to execute any step in the method shown in FIG8 . The steps that the receiving module 910 , the acquiring module 920 , the executing module 930 , and the controlling module 940 are responsible for implementing can be specified as needed. By having the receiving module 910 , the acquiring module 920 , the executing module 930 , and the controlling module 940 respectively implement different steps in the method shown in FIG8 , all functions of the access control terminal 900 are realized.

[0174] This application also provides a computing device 1000. As shown in Figure 10, computing device 1000 includes a bus 1002, a processor 1004, a memory 1006, and a communication interface 1008. Processor 1004, memory 1006, and communication interface 1008 communicate with each other via bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 1000.

[0175] Bus 1002 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG10 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 1002 may include a path for transmitting information between various components of computing device 1000 (e.g., memory 1006, processor 1004, and communication interface 1008).

[0176] The processor 1004 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0177] The memory 1006 may include volatile memory, such as random access memory (RAM). The memory 1006 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0178] The memory 1006 stores executable program code, and the processor 1004 executes the executable program code to respectively implement the functions of the aforementioned receiving module 910, acquisition module 920, execution module 930, and control module 940, thereby implementing the method shown in Figure 8. In other words, the memory 1006 stores instructions for executing the method shown in Figure 8.

[0179] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0180] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0181] As shown in Figure 11 , the computing device cluster includes at least one computing device 1000. The memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same instructions for executing the method shown in Figure 8 .

[0182] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also respectively store some instructions for executing the method shown in Figure 8. In other words, the combination of one or more computing devices 1000 can jointly execute the instructions for executing the method shown in Figure 8.

[0183] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster can store different instructions, each used to execute part of the functions of the access control terminal 900. In other words, the instructions stored in the memory 1006 in different computing devices 1000 can implement the functions of one or more modules among the receiving module 910, the obtaining module 920, the executing module 930, and the controlling module 940.

[0184] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG12 shows a possible implementation. As shown in FIG12 , two computing devices 1000A and 1000B are connected via a network. Specifically, the connection to the network is made via a communication interface in each computing device. In this type of possible implementation, the memory 1006 in the computing device 1000A stores instructions for executing the functions of the receiving module 910 and the acquiring module 920. At the same time, the memory 1006 in the computing device 1000B stores instructions for executing the functions of the execution module 930 and the control module 940.

[0185] It should be understood that the functionality of the computing device 1000A shown in FIG12 may also be accomplished by multiple computing devices 1000. Similarly, the functionality of the computing device 1000B may also be accomplished by multiple computing devices 1000.

[0186] The present application also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similar to the connection method of the computing device cluster described in Figures 11 and 12. However, the memory 1006 in one or more computing devices 1000 in this computing device cluster can store the same instructions for executing the method shown in Figure 8.

[0187] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also respectively store some instructions for executing the method shown in Figure 8. In other words, the combination of one or more computing devices 1000 can jointly execute the instructions for executing the method shown in Figure 8.

[0188] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the method shown in FIG8 .

[0189] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device, or a host migration device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the method shown in FIG8 .

[0190] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An access control method, characterized in that: The method comprises: receiving a target data packet, wherein the target data packet includes a value to be matched; Obtaining a target code of at least one rule in an access control list (ACL), wherein the target code includes a matching logic instruction and a matching item corresponding to each of the rules, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; Based on the matching item and the value to be matched, the matching logic instruction is executed to obtain a matching result of the rule corresponding to the value to be matched and the matching item; Based on the matching result, the target data packet is allowed or blocked from passing.

2. The method according to claim 1, characterized in that The value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

3. The method according to claim 1 or 2, characterized in that: Before receiving the target data packet, the method further includes: Obtaining the matching item; The target code is generated based on the matching logic instructions corresponding to the at least one rule and the matching items.

4. The method according to claim 3, characterized in that The matching item is a default value, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Based on the matching logic instruction of the at least one rule and the matching item, a default code is generated, wherein the default code indicates to skip executing the matching logic instruction.

5. The method according to claim 3, characterized in that: The matching item is a preset value, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Based on the matching logic instruction of the at least one rule and the matching item, a first judgment code is generated, wherein the first judgment code indicates whether the to-be-matched value is consistent with the matching item.

6. The method according to claim 3, characterized in that: The matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Determine that the left endpoint is the minimum value of the to-be-matched value, and generate a second judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the second judgment code indicates whether the to-be-matched value is less than or equal to the right endpoint; or, Determine that the right endpoint is the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

7. The method according to any one of claims 1 to 6, characterized in that: The target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

8. An access control terminal, characterized in that: The access control terminal includes: A receiving module, used for receiving a target data packet, wherein the target data packet includes a value to be matched; An acquisition module, used to acquire a target code of at least one rule in an access control list ACL, wherein the target code includes a matching logic instruction and a matching item corresponding to each of the rules, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; An execution module, configured to execute the matching logic instruction based on the matching item and the value to be matched, and obtain a matching result of a rule corresponding to the value to be matched and the matching item; The control module is used to allow or prevent the target data packet from passing based on the matching result.

9. The access control terminal according to claim 8, characterized in that: The value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

10. The access control terminal according to claim 8 or 9, characterized in that: Before receiving the target data packet, the acquisition module is used to: Obtaining the matching item; The target code is generated based on the matching logic instructions corresponding to the at least one rule and the matching items.

11. The access control terminal according to claim 10, characterized in that: The matching item is a default value, and the acquisition module is used to: Based on the matching logic instruction of the at least one rule and the matching item, a default code is generated, wherein the default code indicates to skip executing the matching logic instruction.

12. The access control terminal according to claim 10, characterized in that: The matching item is a preset value, and the acquisition module is used to: Based on the matching logic instruction of the at least one rule and the matching item, a first judgment code is generated, wherein the first judgment code indicates whether the to-be-matched value is consistent with the matching item.

13. The access control terminal according to claim 10, characterized in that: The matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and the acquisition module is used to: Determine that the left endpoint is the minimum value of the to-be-matched value, and generate a second judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the second judgment code indicates whether the to-be-matched value is less than or equal to the right endpoint; or, Determine that the right endpoint is the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

14. The access control terminal according to any one of claims 8 to 13, characterized in that: The target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

15. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 7.

16. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 7.

17. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 7.

Images