Memory resource management method, device, computer equipment and medium for cloud firewall

Abstract

The present invention provides a memory resource management method, device, computer equipment and medium for a cloud firewall. The memory management method for a cloud firewall includes: determining large page memory according to the total memory of the cloud firewall. Determining the total session memory occupied by each session in the cloud firewall. Determining the maximum session specification of the cloud firewall according to a first correspondence between a predetermined large page memory and the total memory and session specification of a single session. Through the method provided by the present invention, it is possible to determine the maximum session specification corresponding to the cloud firewall according to the first correspondence between a predetermined large page memory and the total memory and session specification of a single session, thereby maximizing the session specification when the total memory is limited, thereby achieving the purpose of improving product competitiveness.

Description

Technical Field

[0001] The present invention relates to the technical field of firewalls, and in particular to a memory resource management method, device, computer equipment and medium for a cloud firewall. Background Art

[0002] A cloud firewall can be understood as a firewall that runs on different types of cloud hosts or containers. In the related art, for different types of cloud servers or cloud hosts, when a new cloud firewall is added in the presence of an existing cloud firewall, the specifications of the new cloud firewall can be customized according to the configuration ratio of the total memory between the existing cloud firewall and the new cloud firewall. Among them, the specifications of the cloud firewall include at least the following parameters: the maximum concurrent session specification (hereinafter referred to as the session specification) and the maximum number of concurrent TCP connections (if the cloud firewall supports the TCP protocol proxy (TCP-Proxy) function). That is, it can be understood that the specifications of the cloud firewall depend on the total memory that the cloud server can occupy. When the specifications of the cloud firewall have been determined, the maximum session specifications of the cloud firewall can be directly determined based on the specification parameters.

[0003] However, when this method is used to determine the specifications of the cloud firewall, if the customized specifications of the existing cloud firewall are unreasonable, it is easy to cause the specifications of the new cloud firewall to be unreasonable. If the customized session specifications are too large, insufficient memory will affect the function; if they are too small, they will not be able to meet business needs and thus affect the competitiveness of the new cloud firewall. Summary of the invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the defect of unreasonable session specification allocation of cloud firewalls in the prior art, thereby providing a memory resource management method, device, computer equipment and medium for a cloud firewall.

[0005] In a first aspect, the present invention provides a memory management method for a cloud firewall, the method comprising: determining a large page memory according to the total memory of the cloud firewall, determining the total session memory occupied by each session in the cloud firewall, and determining the maximum session specification of the cloud firewall according to a first correspondence between a predetermined large page memory and a single session total memory and a session specification.

[0006] In combination with the first aspect, in a first embodiment of the first aspect, the large page memory includes multiple consumers, and the first corresponding relationship is determined in the following manner: the first corresponding relationship is determined according to a predetermined second corresponding relationship between the memory corresponding to each consumer and the session specification.

[0007] In combination with the first aspect or the first embodiment of the first aspect, in a second embodiment of the first aspect, the method further includes: determining the memory corresponding to each of the consumers according to the second corresponding relationship and the maximum session specification.

[0008] In combination with the first embodiment or the second embodiment of the first aspect, in the third embodiment of the first aspect, a memory mapping method is adopted to map the large page memory to the user state available space of the computer device, and according to the memory size corresponding to each of the consumers, the exclusive memory segment corresponding to each of the consumers is determined and allocated, and the computer device is used to execute the operation of the cloud firewall.

[0009] In a second aspect, the present invention provides a memory management device for a cloud firewall, characterized in that the device includes: a first determination unit, used to determine the large page memory according to the total memory of the cloud firewall. A second determination unit, used to determine the total session memory occupied by each session in the cloud firewall. A third determination unit, used to determine the maximum session specification of the cloud firewall according to a first correspondence between the predetermined large page memory and the total memory of a single session and the session specification.

[0010] In combination with the second aspect, in a first embodiment of the second aspect, the large page memory includes multiple consumers, and the first corresponding relationship is determined by the following units: a relationship determination unit, used to determine the first corresponding relationship based on a predetermined second corresponding relationship between the memory corresponding to each consumer and the session specification.

[0011] In combination with the second aspect or the first embodiment of the second aspect, in the second embodiment of the second aspect, the device also includes: a fourth determination unit, used to determine the memory corresponding to each of the consumers based on the second corresponding relationship and the maximum session specification.

[0012] In combination with the first embodiment or the second embodiment of the second aspect, in the third embodiment of the second aspect, the device also includes: an allocation unit, which is used to map the large page memory to the user state available space of the computer device by adopting a memory mapping method, and determine and allocate the exclusive memory segment corresponding to each consumer according to the memory size corresponding to each consumer, and the computer device is used to execute the operation of the cloud firewall.

[0013] According to the third aspect, an embodiment of the present invention further provides a computer device, comprising a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the memory resource management method of the cloud firewall of the first aspect and any one of its optional embodiments by executing the computer instructions.

[0014] According to a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the memory resource management method of the cloud firewall of the first aspect and any one of its optional embodiments.

[0015] Through the method provided by the present invention, the maximum session specification corresponding to the cloud firewall can be determined according to the first corresponding relationship between the predetermined large page memory and the total memory of a single session and the session specification, thereby maximizing the session specification when the total memory is limited, thereby achieving the purpose of improving product competitiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 The present invention is a flowchart of a memory management method of a cloud firewall according to an exemplary embodiment.

[0018] Figure 2 It is a schematic diagram of a memory pool layout proposed according to an exemplary embodiment.

[0019] Figure 3 The present invention is a flowchart of another memory management method of a cloud firewall proposed according to an exemplary embodiment.

[0020] Figure 4 The present invention is a flowchart of another memory management method of a cloud firewall proposed according to an exemplary embodiment.

[0021] Figure 5 The present invention is a flowchart of another memory management method of a cloud firewall proposed according to an exemplary embodiment.

[0022] Figure 6 It is a structural block diagram of a memory management device of a cloud firewall proposed according to an exemplary embodiment.

[0023] Figure 7 It is a schematic diagram of the hardware structure of a computer device proposed according to an exemplary embodiment. DETAILED DESCRIPTION

[0024] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] According to the total memory that can be occupied by the cloud firewall, the specification of the cloud firewall can be determined, and then through the determined specification parameters, the session specification of the cloud firewall can be directly determined.

[0026] In the related art, for different types of cloud servers or cloud hosts, when an existing cloud firewall is added, the specifications of the new cloud firewall can be customized according to the configuration ratio of the total memory between the existing cloud firewall and the new cloud firewall. For example, when the configuration ratio of the total memory between the new cloud firewall and the existing cloud firewall is 2, the customized specifications of the new cloud firewall are twice the specifications of the existing cloud firewall.

[0027] However, when this method is used to determine the specifications of the cloud firewall, if the customized specifications of the existing cloud firewall are unreasonable, it is easy to cause the specifications of the new cloud firewall to be unreasonable. For example, if the customized specifications are too small, the session specifications of the new cloud firewall cannot meet the business needs, the memory resource utilization rate is low, and the competitiveness of the new cloud firewall is affected.

[0028] In order to solve the above problems, a cloud firewall memory resource management is provided in an embodiment of the present invention, which is used in a computer device. It should be noted that its execution subject can be a cloud firewall memory resource management device, which can be implemented as part or all of a storage device through software, hardware, or a combination of software and hardware. The computer device can be a cloud host or a container or a server, and the server can be a single server or a server cluster composed of multiple servers. In the following method embodiments, the execution subject is taken as an example of a computer device for explanation.

[0029] The computer device in the embodiment of the present invention is used to control the operation of the cloud firewall. The cloud firewall can provide an IO, resource and CPU intensive service based on the Intel Data Plane Development Kit (DPDK) provided by Intel.

[0030] Through the memory management method of the cloud firewall provided by the present invention, the maximum session specification corresponding to the cloud firewall can be determined according to the first corresponding relationship between the predetermined large page memory and the total memory of a single session and the session specification, and then the session specification can be maximized when the total memory is limited, thereby achieving the purpose of improving product competitiveness.

[0031] Figure 1 FIG. 1 is a flow chart of a memory management method of a cloud firewall according to an exemplary embodiment. Figure 1 As shown, the memory management method of the cloud firewall includes the following steps S101 to S103.

[0032] In step S101, large page memory is determined according to the total memory of the cloud firewall.

[0033] In the embodiment of the present invention, the large page memory can be understood as the memory occupied by the forwarding plane of the cloud firewall. Since the number of page table cache (Translation lookaside buffer, TLB) misses is small in the large page memory, the number of page fault interrupts is also small, therefore, the use of large page memory is helpful to improve the forwarding plane performance of the cloud firewall.

[0034] Therefore, in order to determine the maximum session specification that the cloud firewall can support, the large page memory that can provide memory for the session specification is first determined based on the total memory of the cloud firewall.

[0035] In one example, to ensure the stable operation of the cloud firewall system, the system memory corresponding to the cloud firewall system is determined and reserved in the total memory of the cloud firewall, and then the large page memory is obtained according to the difference between the total memory of the cloud firewall and the system memory. In one implementation scenario, the system memory is 1G, and the free memory accounts for 10% of the total memory.

[0036] In step S102, the total session memory occupied by each session in the cloud firewall is determined.

[0037] In the embodiment of the present invention, in order to make full use of large page memory, the total session memory required for each session when the cloud firewall is running is first determined, and then the maximum session specification that the large page memory can support is determined.

[0038] In step S103, the maximum session specification of the cloud firewall is determined according to a predetermined first correspondence between large page memory and the total memory of a single session and the session specification.

[0039] In the embodiment of the present invention, the correspondence between the huge page memory and the total memory of a single session and the session specification is established in advance, and then when the huge page memory and the total session memory are determined, the maximum session specification of the cloud firewall can be directly determined to make full use of the huge page memory. The total memory of a single session includes the memory occupied by a single session entry and the memory occupied by other consumers related to the session.

[0040] In one example, the first corresponding relationship can be a proportional function relationship, and then the first corresponding relationship is: large page memory = total session memory * session specification. Therefore, when the large page memory and the total session memory are determined, the maximum session specification that the cloud firewall can support can be determined based on the quotient between the large page memory and the total session memory of a single session. For example: if the large page memory is 3G and the total session memory is 6M, the maximum session specification = 3G / 6M = 512K. If the large page memory is 15G and the total session memory is 6M, the maximum session specification = 15G / 6M = 2560K.

[0041] Through the above embodiment, the maximum session specification corresponding to the cloud firewall can be determined according to the first correspondence between the predetermined large page memory and the total memory and session specification of a single session, and then the session specification can be maximized when the total memory is limited, thereby achieving the purpose of improving product competitiveness.

[0042] In one embodiment, the large page memory includes multiple consumers: memory cache, session table, fragment serialization, hash table, association table, TCP connection table and L7Service memory pool. Since the functions of each consumer are implemented based on the session, it can be understood that among all consumers in the large page memory, except for the session table itself, the memory corresponding to other consumers has a linear relationship with the size of the session specification, and the larger the session specification, the more memory each consumer needs to consume. Therefore, the second correspondence between the memory corresponding to each consumer and the session specification is predetermined, and then the first correspondence between the large page memory and the total memory of a single session and the session specification is determined.

[0043] In one implementation scenario, when the cloud firewall is running, different consumers require different amounts of memory, which results in different corresponding memory pool sizes. The memory pool sizes required by each consumer can be ranked from high to low as follows: Figure 2 As shown. Among them, Figure 2It is a schematic diagram of a memory pool layout proposed according to an exemplary embodiment. The Hash bucket is the name of the memory pool corresponding to the Hash table. Therefore, based on the session specification, the second corresponding relationship between the session specification and the consumer can be determined, and then the first corresponding relationship can be determined. Among them, r1~r5 respectively represent the proportional relationship between each consumer and the session specification. In one example, r1~r5 can be set according to demand, for example: to increase the Hash bucket to reduce Hash conflicts, when determining r3, r3 can be set to 1 / 8, and then when determining the memory corresponding to the Hash table, that is, based on the determined session specification, 1 / 8 of the session specification is determined as the specification corresponding to the Hash table. In order to ensure that the network of the session is in a stable state, when determining r5, r5 can be set to 1 / 2, and then when determining the memory corresponding to the TCP connection table, that is, based on the determined session specification, 1 / 2 of the session specification is determined as the specification corresponding to the TCP connection table.

[0044] Therefore, when determining the first correspondence between session specifications and large page memory, the following formula can be used for determination:

[0045] Total memory = system memory + huge page memory;

[0046] Among them, large page memory = Mbuf_Mem (memory corresponding to Mbuf) + Sess_Mem (memory corresponding to session specification table) + Serialize_Mem (memory corresponding to shard serialization) + Hashbucket_Mem (memory corresponding to hash table) + Associate_Mem (memory corresponding to association table) + TCPConn_Mem (memory corresponding to TCP connection table) + Service_Mem (memory corresponding to L7Service memory pool);

[0047] Mbuf_Mem = Mbuf_Cnt (Mbuf quantity) * Mbuf_Size (Mbuf size) = Sess_Cnt (session specification) * r1 * Mbuf_Size;

[0048] Sess_Mem = Sess_Cnt (session specification) * Sess_Size (session size);

[0049] Serialize_Mem = Serialize_Cnt (fragment serialization quantity) * Serialize_Size (fragment serialization size) = Sess_Cnt (session specification) * r2 * Serialize_Size;

[0050] Hashbucket_Mem = Hashbucket_Cnt (number of hash tables) * Hashbucket_Size (size of hash tables) = Session_Cnt (session specification) * r3 * Hashbucket_Size;

[0051] Associate_Mem = Associate_Cnt (number of associated tables) * Associate_Size (number of associated tables) = Sess_Cnt (session size) * r4 * Associate_Size;

[0052] TCPConn_Mem = TCPConn_Cnt (TCP connection table quantity) * 2 * TCPConn_Size (TCP connection table size) = SessCnt (session specification) * r5 * TCPConn_Size;

[0053] Service_Mem = SessCnt (session size) * Service_Mem_Per_Sess;

[0054] To facilitate intuitive explanation of the second correspondence, the second correspondence between the session specification and each consumer can be shown in Table 1:

[0055]

[0056] Table 1

[0057] Among them, the Intrusion Prevention System (IPS) is a security mechanism that analyzes network traffic, detects intrusions (including buffer overflow attacks, Trojans, worms, etc.), and terminates intrusions in real time through certain response methods to protect enterprise information systems and network architectures from harm. Unified Threat Management (UTM) is a system that can provide one or more security functions, integrate multiple security features into a hardware device, and form a standard unified management platform.

[0058] Furthermore, large page memory = Sess_Cnt*(r1*Mbuf_Size+Sess_Size+r2*Serialize_Size+r3*Hashbucket_Size+r4*Associate_Size+r5*TCPConn_Size+Service_Mem_Per_Sess);

[0059] Let Mem_Per_Sess (memory required for each session) = (r1*Mbuf_Size+Sess_Size+r2*Serialize_Size+r3*Hashbucket_Size+r4*Associate_Size+r5*TCPConn_Size+Service_Mem_Per_Sess);

[0060] Then, the first corresponding relationship is: huge page memory = Session_Cnt*Mem_Per_Sess. Then, when the memory required for each session is determined, the maximum session specification can be determined based on the corresponding relationship between huge page memory and session specifications. For example, if the memory required for each session = 6M, and the huge page memory is 3G, then the maximum session specification = 3G / 6M = 512k.

[0061] In one implementation scenario, the total session memory occupied by each session may be determined based on the corresponding memory of the L7Service memory pool and r1-r5.

[0062] Figure 3 FIG. 1 is a flowchart of another memory management method of a cloud firewall according to an exemplary embodiment. Figure 3 As shown, the memory management method of the cloud firewall includes the following steps.

[0063] In step S301, large page memory is determined according to the total memory of the cloud firewall.

[0064] In step S302, the total session memory occupied by each session in the cloud firewall is determined.

[0065] In step S303, the maximum session specification of the cloud firewall is determined according to a predetermined first correspondence between large page memory and the total memory of a single session and the session specification.

[0066] In step S304, the memory corresponding to each consumer is determined according to the second corresponding relationship and the maximum session specification.

[0067] In the embodiment of the present invention, when the maximum session specification is determined, according to the second correspondence between the memory corresponding to each consumer and the session specification, the memory corresponding to each consumer can be determined in the large page memory, and the memory occupied by each consumer during the operation of the cloud firewall can be clarified. For example: the maximum session specification = 512k, then Mbuf_Mem = 512k*r1*Mbuf_Size; Serialize_Mem = 512k*r2*Serialize_Size; Hashbucket_Mem = 512k*r3*Hashbucket_Size; Associate_Mem = 512k*r4*Associate_Size; TCPConn_Mem = 512k*r5*TCPConn_Size; Service_Mem = 512k*Service_Mem_Per_Sess.

[0068] Through the above embodiment, based on the determined first correspondence and second correspondence, it is possible to clarify the maximum session specification that can be supported by the large page memory of the cloud firewall and the memory occupied by the consumer when the cloud firewall is running.

[0069] Figure 4 FIG. 1 is a flowchart of another memory management method of a cloud firewall according to an exemplary embodiment. Figure 4 As shown, the memory management method of the cloud firewall includes the following steps.

[0070] In step S401, large page memory is determined according to the total memory of the cloud firewall.

[0071] In step S402, the total session memory occupied by each session in the cloud firewall is determined.

[0072] In step S403, the maximum session specification of the cloud firewall is determined according to a predetermined first correspondence between large page memory and the total memory of a single session and the session specification.

[0073] In step S404, the memory corresponding to each consumer is determined according to the second corresponding relationship and the maximum session specification.

[0074] In step S405, the large page memory is mapped to the user state available space of the computer device by memory mapping, and the exclusive memory segment corresponding to each consumer is determined and allocated according to the memory size corresponding to each consumer.

[0075] In an embodiment of the present invention, a memory mapping method is used to map large page memory to the user state available space of a computer device, for example, by calling the mmap() function, the large page memory is mapped to the user state available space of the computer device. In the user state available space, according to the memory size corresponding to each consumer, the exclusive memory segment corresponding to each consumer is determined and allocated, so that the memory occupied by each consumer can be managed separately and independently, so that when the cloud firewall is running, they do not interfere with each other, thereby making the allocation of large page memory more reasonable. Among them, the computer device is used to execute the operation of the cloud firewall.

[0076] Through the above embodiments, the maximum session specification that the cloud firewall can support during operation and the memory corresponding to each consumer can be determined based on the large page memory, and each consumer can be managed separately based on memory mapping, which helps to make full use of the large page memory and improve the performance of the cloud firewall.

[0077] In one implementation scenario, after the specifications of the cloud firewall are determined, when the cloud firewall is started, the total memory of the cloud firewall can be initialized by reading the specification parameters through the static configuration file, and then the maximum session specifications and the memory corresponding to each consumer are determined and initialized according to the first correspondence and the second correspondence, so that each consumer can be managed separately later. The static configuration file includes the values ​​corresponding to r1 to r5. The specific implementation process is as follows: Figure 5 shown. Figure 5 The present invention is a flowchart of another memory management method of a cloud firewall proposed according to an exemplary embodiment.

[0078] In step S501, the system memory and the total session memory occupied by each session are determined through the static configuration file.

[0079] In step S502, large page memory is determined according to the total memory and system memory of the cloud firewall, and the large page memory is initialized.

[0080] In step S503, the maximum session specification is determined according to the first corresponding relationship and the large page memory.

[0081] In step S504, the memory corresponding to each consumer is determined according to the second corresponding relationship and the maximum session specification.

[0082] In step S505, the mmap() function is called to map the large page memory to the user mode available space of the computer device, and the exclusive memory segment corresponding to each consumer is determined and allocated according to the memory corresponding to each consumer.

[0083] In step S506, the memory pool corresponding to each memory segment is initialized.

[0084] In step S507, it is determined whether the initialization of each memory segment is completed.

[0085] In the embodiment of the present invention, if the initialization is completed, the cloud firewall can operate normally. If there are unfinished initialized memory segments, the initialization will continue until all are completed.

[0086] Through the above embodiment, the static configuration file can adjust the session specifications according to the actual total memory size of the cloud firewall, and then maximize the session specifications based on the first corresponding relationship and the large page memory of the cloud firewall. And any coefficient of r1 to r5 in the second corresponding relationship can be adjusted according to actual needs, which is helpful to dynamically adjust the maximum session specifications and improve the product competitiveness of the cloud firewall.

[0087] Furthermore, in the test scenario, since the specifications of the cloud firewalls are proportional to the memory size, there is no need to repeatedly traverse all cloud firewalls when testing the cloud firewalls, which helps to simplify the testing workload and thus helps to simplify the delivery and maintenance of the cloud firewalls.

[0088] Based on the same inventive concept, the present invention also provides a memory management device for a cloud firewall.

[0089] Figure 6 FIG. 1 is a structural block diagram of a memory management device of a cloud firewall according to an exemplary embodiment. Figure 6 As shown, the memory management device of the cloud firewall includes a first determination unit 601, a second determination unit 602 and a third determination unit 603.

[0090] The first determining unit 601 is used to determine the large page memory according to the total memory of the cloud firewall.

[0091] The second determining unit 602 is used to determine the total session memory occupied by each session in the cloud firewall.

[0092] The third determining unit 603 is used to determine the maximum session specification of the cloud firewall according to a predetermined first correspondence between the large page memory and the total memory of a single session and the session specification.

[0093] In one embodiment, the large page memory includes multiple consumers, and the first corresponding relationship is determined by the following unit: a relationship determination unit, used to determine the first corresponding relationship based on a predetermined second corresponding relationship between the memory corresponding to each consumer and the session specification.

[0094] In another embodiment, the device further includes: a fourth determining unit, configured to determine the memory corresponding to each consumer according to the second corresponding relationship and the maximum session specification.

[0095] In another embodiment, the device also includes: an allocation unit, which is used to map large page memory to the user state available space of the computer device by adopting a memory mapping method, and determine and allocate the exclusive memory segment corresponding to each consumer according to the memory size corresponding to each consumer, and the computer device is used to execute the operation of the cloud firewall.

[0096] The specific limitations and beneficial effects of the memory management device of the cloud firewall can be found in the above-mentioned limitations on the memory management method of the cloud firewall, which will not be repeated here. The above-mentioned modules can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0097] Figure 7 FIG. 1 is a schematic diagram of a hardware structure of a computer device according to an exemplary embodiment. Figure 7 As shown, the device includes one or more processors 710 and a memory 720, and the memory 720 includes a persistent memory, a volatile memory, and a hard disk. Figure 7 A processor 710 is taken as an example. The device may also include: an input device 730 and an output device 740.

[0098] The processor 710, the memory 720, the input device 730 and the output device 740 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0099] The processor 710 may be a central processing unit (CPU). The processor 710 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. A general-purpose processor may be a microprocessor or the processor may be any conventional processor.

[0100] The memory 720 is a non-transient computer-readable storage medium, including persistent memory, volatile memory and hard disk, and can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the business management method in the embodiment of the present application. The processor 710 executes various functional applications and data processing of the server by running the non-transient software programs, instructions and modules stored in the memory 720, that is, any of the above-mentioned memory management methods of the cloud firewall is implemented.

[0101] The memory 720 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data required for use, etc. In addition, the memory 720 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 720 may optionally include a memory remotely arranged relative to the processor 710, and these remote memories may be connected to the data processing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0102] The input device 730 can receive input digital or character information and generate key signal input related to user settings and function control. The output device 740 can include display devices such as a display screen.

[0103] One or more modules are stored in the memory 720, and when executed by one or more processors 710, the execution is as follows: Figure 1-Figure 5 The method shown.

[0104] The above-mentioned product can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to Figure 1-Figure 5 Related description of the illustrated embodiment.

[0105] The embodiment of the present invention also provides a non-transitory computer storage medium, which stores computer executable instructions, and the computer executable instructions can execute the authentication method in any of the above method embodiments. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0106] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A memory management method for a cloud firewall, characterized in that: The method comprises: Determining huge page memory according to the total memory of the cloud firewall; Determining the total session memory occupied by each session in the cloud firewall; Determining the maximum session specification of the cloud firewall according to a first correspondence between a predetermined large page memory and a single session total memory and a session specification; The large page memory includes multiple consumers, and the first corresponding relationship is determined in the following manner: Determining the first corresponding relationship according to a predetermined second corresponding relationship between the memory corresponding to each consumer and the session specification; Determining the memory corresponding to each of the consumers according to the second corresponding relationship and the maximum session specification; The large page memory is mapped to the user state available space of the computer device by memory mapping, and the exclusive memory segment corresponding to each consumer is determined and allocated according to the memory size corresponding to each consumer; the computer device is used to execute the operation of the cloud firewall.

2. A memory management device for a cloud firewall, characterized in that: The device comprises: A first determining unit, configured to determine a large page memory according to a total memory of the cloud firewall; A second determining unit, configured to determine a total session memory occupied by each session in the cloud firewall; A third determining unit, configured to determine the maximum session specification of the cloud firewall according to a predetermined first correspondence between the large page memory and the total memory of a single session and the session specification; The large page memory includes multiple consumers, and the first corresponding relationship is determined by the following units: a relationship determination unit, configured to determine the first corresponding relationship according to a predetermined second corresponding relationship between the memory corresponding to each consumer and the session specification; The device also includes: A fourth determining unit, configured to determine a memory corresponding to each of the consumers according to the second corresponding relationship and the maximum session specification; An allocation unit is used to map the large page memory to the user state available space of the computer device by memory mapping, and determine and allocate the exclusive memory segment corresponding to each consumer according to the memory size corresponding to each consumer. The computer device is used to execute the operation of the cloud firewall.

3. A computer device, characterized in that: It includes a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the memory resource management method of the cloud firewall according to claim 1 by executing the computer instructions.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the memory resource management method of the cloud firewall according to claim 1.

Images