Access request processing method, device and electronic device

Abstract

The present application proposes a method, device and electronic device for processing access requests, wherein the method includes receiving an access request for accessing a target object; determining a target request processing partition corresponding to the access request from multiple candidate request processing partitions inside a firewall; obtaining a secure access address segment of the target request processing partition, and intercepting the access request according to the secure access address segment. In the present application, secure access to the target object and diversion processing of access requests are achieved, the processing efficiency of the firewall for access requests is improved, and the efficiency of verification and analysis of firewall performance is improved, the manageability of firewall performance verification is achieved, and the verification method and verification effect are optimized.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method, device and electronic device for processing an access request. Background Art

[0002] With the development of technology, the application scope of system-level chips in products is becoming more and more extensive. In order to achieve security control of the system on chip and protect the data in the system, a corresponding security defense system can be configured on the chip.

[0003] In the related art, configuring a security defense system on a chip may affect the operating performance of the chip. Therefore, it is necessary to verify the performance of the chip configured with the security defense system. Summary of the invention

[0004] The purpose of this application is to solve one of the technical problems in the above technology at least to a certain extent.

[0005] The first aspect of the present application proposes a method for processing access requests, including: receiving an access request for accessing a target object; determining a target request processing partition corresponding to the access request from multiple candidate request processing partitions inside a firewall; obtaining a security access address segment of the target request processing partition, and intercepting the access request based on the security access address segment.

[0006] The method for processing an access request proposed in the first aspect of the present application also has the following technical features, including:

[0007] According to one embodiment of the present application, an access request is intercepted based on a security access address segment, including: obtaining a target access address of the access request to a target object; identifying whether the access request is an illegal access request based on the security access address segment and the target access address; and in response to identifying that the access request is an illegal access request, intercepting the illegal access request.

[0008] According to one embodiment of the present application, whether an access request is an illegal access request is identified based on a security access address segment and a target access address, including: in response to the target access address belonging to the security access address segment of the target request processing partition, determining that the access request is a secure access request; in response to the target access address not belonging to the security access address segment of the target request processing partition, determining that the access request is an illegal access request.

[0009] According to an embodiment of the present application, a target request processing partition for an access request is determined from multiple candidate request processing partitions inside a firewall, including: obtaining an identification correspondence between an area identification of the candidate request processing partition and a device identification of a test device, wherein the test device is used to initiate an access request to a target object; determining a target device identification of a target test device that initiates the access request from information carried in the access request; determining a target area identification corresponding to the target device identification based on the identification correspondence, and determining the candidate request processing partition corresponding to the target area identification as the target request processing partition that processes the access request.

[0010] According to an embodiment of the present application, the method also includes: performing performance evaluation on the firewall and the target object, and respectively obtaining a first performance evaluation result of the firewall and a second performance evaluation result of the target object; and evaluating the performance of the target system based on the first performance evaluation result and the second performance evaluation result.

[0011] According to an embodiment of the present application, a first performance evaluation result of a firewall is obtained, including: determining the initiation ratio of illegal access requests from the initiation ratio of access requests; monitoring the interception ratio of illegal access requests by the firewall, and obtaining the interception ratio of the interception ratio in the reception ratio of access requests; evaluating the performance of the firewall according to the initiation ratio and the interception ratio to obtain the first performance evaluation result of the firewall.

[0012] According to one embodiment of the present application, the performance of the firewall is evaluated based on the initiation ratio and the interception ratio to obtain a first performance evaluation result of the firewall, including: obtaining an error value of the initiation ratio and the interception ratio; in response to the error value falling within a set error range, determining that the first performance evaluation result of the firewall is qualified.

[0013] According to one embodiment of the present application, obtaining a second performance evaluation result of the target object includes: obtaining the response delay time of the target object to an access request that is not intercepted by the firewall; and evaluating the performance of the target object based on the response delay time to obtain the second performance evaluation result of the target object.

[0014] According to one embodiment of the present application, the performance of the target object is evaluated according to the response delay time to obtain a second performance evaluation result of the target object, including: obtaining a threshold time of the response delay of the target object; in response to the response delay time being less than or equal to the threshold time, determining that the second performance evaluation result of the target object is qualified.

[0015] According to one embodiment of the present application, the performance of the target system is evaluated based on the first performance evaluation result and the second performance evaluation result, including: in response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, determining that the target system performance evaluation result is qualified.

[0016] The second aspect of the present application proposes a device for processing access requests, including: a receiving module for receiving an access request for accessing a target object; a determination module for determining a target request processing partition corresponding to the access request from multiple candidate request processing partitions inside a firewall; a processing module for obtaining a secure access address segment of the target request processing partition, and intercepting the access request based on the secure access address segment.

[0017] The second aspect of the present application provides an access request processing device, which also has the following technical features, including:

[0018] According to one embodiment of the present application, the processing module is also used to: obtain a target access address of an access request to a target object; identify whether the access request is an illegal access request based on the security access address segment and the target access address; and intercept the illegal access request in response to identifying that the access request is an illegal access request.

[0019] According to one embodiment of the present application, the processing module is also used to: in response to the target access address belonging to the security access address segment of the target request processing partition, determine that the access request is a secure access request; in response to the target access address not belonging to the security access address segment of the target request processing partition, determine that the access request is an illegal access request.

[0020] According to one embodiment of the present application, the determination module is also used to: obtain an identification correspondence between an area identification of a candidate request processing partition and a device identification of a test device, wherein the test device is used to initiate an access request to a target object; determine a target device identification of a target test device that initiates the access request from information carried in the access request; determine a target area identification corresponding to the target device identification based on the identification correspondence, and determine the candidate request processing partition corresponding to the target area identification as the target request processing partition that processes the access request.

[0021] According to one embodiment of the present application, the device also includes an evaluation module, which is used to: perform performance evaluation on the firewall and the target object, and respectively obtain a first performance evaluation result of the firewall and a second performance evaluation result of the target object; and evaluate the performance of the target system based on the first performance evaluation result and the second performance evaluation result.

[0022] According to one embodiment of the present application, the evaluation module is also used to: determine the initiation ratio of illegal access requests from the initiation ratio of access requests; monitor the interception ratio of illegal access requests by the firewall, and obtain the interception ratio of the interception ratio in the received access requests; evaluate the performance of the firewall based on the initiation ratio and the interception ratio to obtain a first performance evaluation result of the firewall.

[0023] According to one embodiment of the present application, the evaluation module is further used to: obtain error values ​​of the initiation ratio and the interception ratio; and in response to the error value belonging to a set error range, determine that the first performance evaluation result of the firewall is qualified.

[0024] According to one embodiment of the present application, the evaluation module is also used to: obtain the response delay time of the target object to the access request that is not intercepted by the firewall; evaluate the performance of the target object based on the response delay time to obtain a second performance evaluation result of the target object.

[0025] According to an embodiment of the present application, the evaluation module is further used to: obtain a threshold time of a response delay of the target object; and in response to the response delay time being less than or equal to the threshold time, determine that a second performance evaluation result of the target object is qualified.

[0026] According to an embodiment of the present application, the evaluation module is further used to: in response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, determine that the target system performance evaluation result is qualified.

[0027] The third aspect embodiment of the present application proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the access request processing method proposed in the first aspect of the present application.

[0028] The fourth aspect of the present application proposes a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to enable a computer to execute the access request processing method proposed in the first aspect of the present application.

[0029] The fifth aspect of the present application provides a computer program product. When the instruction processor in the computer program product executes, the access request processing method provided in the first aspect of the present application is executed.

[0030] The access request processing method and device proposed in the present application receive the access request of the target object, and determine the target request processing partition corresponding to the access request from multiple candidate request processing partitions divided inside the firewall. Further, the access request is identified and judged according to the secure access address segment of the target request processing partition, and the access request determined to carry an unsecure access address is intercepted and processed. In the present application, the access request of the target object is identified and intercepted by the firewall, thereby achieving secure access to the target object, dividing the firewall into multiple candidate request processing partitions, achieving diversion processing of access requests, improving the efficiency of the firewall in processing access requests, and thus improving the efficiency of verification and analysis of firewall performance, achieving manageability of firewall performance verification, and optimizing the verification method and verification effect.

[0031] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0033] Figure 1 A flowchart of a method for processing an access request according to an embodiment of the present application;

[0034] Figure 2 A flowchart of a method for processing an access request according to another embodiment of the present application;

[0035] Figure 3 A flowchart of a method for processing an access request according to another embodiment of the present application;

[0036] Figure 4 A flowchart of a method for processing an access request according to another embodiment of the present application;

[0037] Figure 5 A schematic diagram of the structure of an access request processing device according to an embodiment of the present application;

[0038] Figure 6 It is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0040] The following describes the access request processing method, device, electronic device and storage medium according to the embodiments of the present application with reference to the accompanying drawings.

[0041] Figure 1 FIG. 1 is a flow chart of a method for processing an access request according to an embodiment of the present application. Figure 1 As shown, the method includes:

[0042] S101: Receive an access request for accessing a target object.

[0043] In the implementation, there is a need for security control and security access of the system on chip (SOC), wherein a corresponding security control system can be set on the SOC chip to protect related functions and related information on the SOC chip.

[0044] Optionally, a corresponding safety control system may be provided at a general information receiving port of the SOC chip, and a corresponding safety control system may also be provided at an information receiving port of a functional module on the SOC chip.

[0045] Among them, a firewall can be set at the information receiving port of the functional module of the SOC chip, so as to achieve protection and security control of the functional module.

[0046] Optionally, an object protected by a firewall may be determined as a target object.

[0047] For example, by setting the target object to the Double Data Rate Synchronous Dynamic Random Access Memory (DDR SDRAM) on the SOC chip, a corresponding firewall can be configured for the DDR storage system, thereby protecting the information stored in the DDR storage system.

[0048] In some implementations, the performance of a target object configured with a firewall may be affected to a certain extent compared to a target object not configured with a firewall.

[0049] Therefore, in order to ensure the operating performance of the target object configured with the firewall, relevant verification and analysis of the performance of the target object may be performed after the firewall is configured.

[0050] Accordingly, in order to realize the security protection of the target object by the firewall, after configuring the firewall for the target object, the interception protection performance of the firewall can also be verified and analyzed.

[0051] In the embodiment of the present application, a corresponding verification environment can be built for the target object configured with a firewall, and corresponding test cases can be constructed to achieve performance verification of the firewall and the target object configured with the firewall.

[0052] Optionally, an access request can be sent to a target object configured with a firewall, and the performance of the firewall can be verified and analyzed through the relevant processing information of the firewall on the access request. Correspondingly, the performance of the target object configured with the firewall can be verified and analyzed through the relevant information of the target object's response to the access request.

[0053] In the implementation, the firewall realizes the security protection of the target object through the relevant identification and interception functions. Therefore, the access request can be received by the firewall in advance.

[0054] Among them, the firewall has a corresponding access port, and the firewall receives the access request through the relevant functions of the information received by the access port configuration.

[0055] Optionally, the sending of the access request and the receiving of the access request by the firewall may be achieved through a bus protocol (Advanced Xtensible Interface, AXI) between the initiator of the access request and the firewall.

[0056] S102, determining a target request processing partition corresponding to the access request from a plurality of candidate request processing partitions inside the firewall.

[0057] In an embodiment of the present application, the firewall can implement interception and processing of access requests through its internal access request processing area, wherein the set access request processing area inside the firewall can be divided, and multiple divided processing areas can be obtained and determined as multiple candidate request processing partitions inside the firewall.

[0058] Furthermore, different area attribute information is configured for different candidate request processing partitions, so that different candidate request processing partitions have corresponding processable access requests, thereby achieving diversion processing of received access requests.

[0059] Optionally, the information configuration of the candidate request processing partition can be implemented through the top module (tb_top module) in the verification environment. For example, the received regional attribute information can be poured into the regional attribute register corresponding to the candidate request processing partition through the tb_top module through a set method, and then the regional attribute information of the candidate request processing partition can be configured through the regional attribute register.

[0060] In some implementations, the information of the regional attribute register of the candidate request processing partition can be static information. Therefore, the regional attribute information of all candidate request processing partitions can be poured into the regional attribute register through a setting method, thereby realizing batch configuration of the regional attribute information of all candidate request processing partitions inside the firewall.

[0061] Furthermore, corresponding setting standards can be configured for access requests that can be processed by each candidate request processing partition. When an access request meets the setting standards corresponding to one of the candidate request processing partitions, the candidate request processing partition can be used as the target request processing partition for the access request.

[0062] For example, for candidate request processing partition A, there is a corresponding set standard B for the access request that it can process. When the received access request meets the set standard B, candidate request processing partition A can be used as the target request processing partition for the access request.

[0063] S103, obtaining a security access address segment of a target request processing partition, and intercepting the access request according to the security access address segment.

[0064] In an embodiment of the present application, corresponding access address fragments can be configured for candidate request processing partitions inside the firewall according to the set access address range of the target object, as the secure access address segments corresponding to the candidate request processing partitions.

[0065] Furthermore, when the candidate request processing partition processes an access request as a target request processing partition, it can determine whether the access request is a secure access request based on its corresponding secure access address segment, and then determine whether to intercept it.

[0066] If the access address in the access request belongs to the secure access address segment of the target request processing partition, the access request can be determined to be a secure access request and will not be intercepted.

[0067] Accordingly, if the access address in the access request does not belong to the secure access address segment corresponding to the target request processing partition, the access request may be determined as a non-secure access request and intercepted.

[0068] The access request processing method proposed in the present application receives the access request of the target object, and determines the target request processing partition corresponding to the access request from multiple candidate request processing partitions divided inside the firewall. Further, the access request is identified and judged according to the secure access address segment of the target request processing partition, and the access request determined to carry an unsecure access address is intercepted and processed. In the present application, the access request of the target object is identified and intercepted by the firewall, thereby achieving secure access to the target object, dividing the firewall into multiple candidate request processing partitions, achieving diversion processing of access requests, improving the efficiency of the firewall in processing access requests, and thus improving the efficiency of verification and analysis of firewall performance, achieving manageability of firewall performance verification, and optimizing the verification method and verification effect.

[0069] In the above embodiment, the processing interception of the access request can be combined with Figure 2 Further understanding, Figure 2 FIG. 1 is a flow chart of a method for processing an access request according to another embodiment of the present application. Figure 2 As shown, the method includes:

[0070] S201, obtaining a target access address of an access request to a target object.

[0071] In an embodiment of the present application, the firewall can obtain the intended access address of the initiator of the access request to the target object from the received access request, and determine the access address as the target access address for the initiator of the access request to access the target object.

[0072] Optionally, the firewall may read the trusted information of the received access request through its configured access port, thereby obtaining the target access address carried therein.

[0073] S202: Identify whether the access request is an illegal access request based on the security access address segment and the target access address.

[0074] In the implementation, illegal access requests may appear in the access requests to the target object. In the scenario where the illegal access request successfully accesses the target object, it may cause a certain degree of impact on the security of the information stored on the target object.

[0075] For example, if the target object is set to a storage system on a SOC chip, in a scenario where an illegal access request successfully accesses the storage system, information leakage of the storage system may occur, affecting the information security of the storage system.

[0076] In this scenario, illegal access requests can be intercepted by the configured firewall to prevent illegal access requests from successfully accessing the target object. Therefore, in order to effectively verify the interception performance of the firewall, a set proportion of illegal access requests can be configured in the access requests received by the firewall.

[0077] Optionally, a judgment standard corresponding to an illegal access request may be obtained, and the received access request may be compared with the set judgment standard, and the identification and judgment of the illegal access request may be implemented according to the comparison result.

[0078] Among them, the judgment standard of illegal access request can be set according to the access address.

[0079] For example, the target access address in the access request and the security access address segment corresponding to the target request processing partition corresponding to the access request can be obtained respectively, and based on the relationship between the target access address and the security access address segment, it can be determined whether the access request is an illegal access request.

[0080] Wherein, in response to the target access address belonging to the security access address segment of the target request processing partition, the access request is determined to be a security access request.

[0081] It can be understood that when the target access address belongs to the access address within the secure access address segment, it can be judged that the target access address is the secure access address of the target object, and the access request initiated to the target object based on the target access address will not affect the information security of the target object. Therefore, the access request carrying the target access address can be determined as a secure access request.

[0082] Accordingly, in response to the target access address not belonging to the security access address segment of the target request processing partition, the access request is determined to be an illegal access request.

[0083] It can be understood that when the target access address does not belong to the security access address segment corresponding to the target request processing partition, it can be judged that the target access address is an abnormal access address of the target object. When the target object is accessed based on the target access address, there is a possibility of affecting the information security of the target object. Therefore, the access request carrying the target access address can be determined as an illegal access request.

[0084] S203: In response to identifying that the access request is an illegal access request, intercepting the illegal access request.

[0085] In order to prevent illegal access requests from affecting the information security of the target object, the firewall can intercept and process the identified illegal access requests to prevent them from accessing the target object, thereby achieving security protection for the target object.

[0086] For example, the security access address segment of the target request processing partition A corresponding to the access request is set to a1 to a8. When the target access address carried by the access request is a3, it can be determined that the target access address a3 belongs to the security access address segment of the target request processing partition A, and the access request is not an illegal access request.

[0087] Accordingly, when the target access address carried by the access request is a9, it can be determined that the target access address a9 does not belong to the secure access address segment of the target request processing partition A, and the access request can be determined to be an illegal access request and intercepted.

[0088] The access request processing method proposed in the present application obtains the target access address of the access request for accessing the target object, and obtains the security access address segment of the target request processing partition corresponding to the access request, and determines whether the access request is an illegal access request based on the target access address and the security access address segment. Further, when it is determined that the access request is an illegal access request, the access request is intercepted and processed. In the present application, the access request of the target object is identified and intercepted by the firewall, thereby achieving secure access to the target object, and the access request is processed by the candidate request processing partition inside the firewall, thereby improving the processing efficiency of the firewall for the access request, and by controlling the set ratio of illegal access requests received by the access request, the effective verification of the firewall performance is achieved, and the verification method and verification effect are optimized.

[0089] In the above embodiment, the determination of the target request processing partition can be combined with Figure 3 Further understanding, Figure 3 FIG. 1 is a flow chart of a method for processing an access request according to another embodiment of the present application. Figure 3 As shown, the method includes:

[0090] S301, obtaining an identifier correspondence relationship between a region identifier of a candidate request processing partition and a device identifier of a test device, wherein the test device is used to initiate an access request to a target object.

[0091] In some implementations, corresponding access request initiating devices may be configured for the firewall and the target object configured with the firewall, and the initiation of the access request to the target object may be achieved by controlling the devices.

[0092] In order to achieve controllable performance verification of the firewall, device attribute information matching the regional attribute information inside the firewall can be configured for the access request initiating device, so that the access request initiating device has a corresponding candidate request processing partition inside the firewall.

[0093] Furthermore, the device initiating the access request may be determined as a firewall and a test device for performance verification of a target object configured with the firewall.

[0094] Optionally, the initiation of the access request of the test device to the target object can be controlled by a test stimulus generator in the verification environment. The test stimulus generator can generate a test stimulus sequence corresponding to the test device according to the regional attribute information of the candidate request processing partition configuration inside the firewall, and configure the corresponding test device with various information required to initiate the access request through the test stimulus sequence.

[0095] Therefore, there is a set correspondence between the test device and the candidate request processing partitions inside the firewall.

[0096] In an embodiment of the present application, the test device has a corresponding device identifier, and the candidate request processing partition has a corresponding area identifier. Therefore, the correspondence between the test device and the candidate request processing partition can be determined by obtaining the correspondence between the device identifier and the area identifier, thereby determining the corresponding target request processing partition for the access request initiated by the test device.

[0097] Optionally, when configuring the regional attribute information of the candidate request processing partition divided inside the firewall, the regional identification information of the candidate request processing partition can be configured, wherein the identification information can be a digital number or other identification information, which is not limited here.

[0098] Correspondingly, the test device has a corresponding device identification, and relevant identification information can be set for each test device through a setting method, and the identification information corresponding to each device is determined as the device identification of the test device.

[0099] It should be noted that the device identification of the test device and / or the region identification of the candidate request processing partition are unique, and there is a one-to-one correspondence between the device identification of the test device and the region identification of the candidate request processing partition.

[0100] For example, it is assumed that there is a set corresponding relationship between the test device D and the candidate request processing partition F inside the firewall, and the access request initiated by the test device D can use the candidate request processing partition F as its corresponding target request processing partition.

[0101] That is to say, after the association relationship between the test device and the candidate request processing partition is established according to the set method, the target request processing partition corresponding to any access request initiated by the test device is the candidate request processing partition associated with the test device.

[0102] Optionally, a correspondence between the device identification of the test device and the area identification of the candidate request processing partition may be established based on a set condition.

[0103] Among them, the device identification and the area identification having the same digital information can be determined as the device identification and the area identification having a corresponding relationship.

[0104] For example, the device identifiers of the test devices are set to D1, D2, D3, ..., Dn, and the region identifiers of the candidate request processing partitions are set to F1, F2, F3, ..., Fn. Then, there is a corresponding relationship between the device identifier D1 and the region identifier F1, there is a corresponding relationship between the device identifier D2 and the region identifier F2, there is a corresponding relationship between the device identifier D3 and the region identifier F3, and there is a corresponding relationship between the device identifier Dn and the region identifier Fn.

[0105] Further, the corresponding relationship may be determined as an identifier corresponding relationship between a device identifier of the test device and a region identifier of the candidate request processing partition.

[0106] S302: Determine, from the information carried in the access request, a target device identifier of a target test device that initiates the access request.

[0107] In an embodiment of the present application, the detailed information carried in the access request may include device identification information of the test device that initiated the access request. The firewall can read the information of the access request to obtain relevant information about the test device that initiated the access request.

[0108] The test device that initiates the access request may be determined as the target test device of the access request. When the access request is initiated, the target device identification information of the target test device may be carried in the access request and received and read by the firewall.

[0109] S303: Determine the target area identifier corresponding to the target device identifier according to the identifier correspondence, and determine the candidate request processing partition corresponding to the target area identifier as the target request processing partition for processing the access request.

[0110] In the embodiment of the present application, the area identifier that has a corresponding relationship with the target device identifier can be determined as the target area identifier.

[0111] Further, according to the identifier correspondence relationship between the target device identifier and the target area identifier, it can be determined that there is a correspondence relationship between the test device corresponding to the target device identifier and the candidate request processing partition corresponding to the target area identifier.

[0112] Therefore, it can be determined that the access request initiated by the target test device can be identified and judged by the candidate request processing partition corresponding to the target area identifier and other related processing.

[0113] Furthermore, the candidate request processing partition corresponding to the target area identifier may be determined as the target request processing partition corresponding to the access request carrying the target access address.

[0114] The access request processing method proposed in the present application obtains the identification correspondence between the device identification of the test device and the region identification of the candidate request processing partition. From the received access request, the target device identification of the target test device that initiated the access request is obtained, the corresponding target region identification is determined according to the identification correspondence, and the target request processing partition corresponding to the access request is determined according to the target region identification. In the present application, there is a correspondence between the device identification and the region identification, and the target request processing partition of the access request is determined according to the identification correspondence, which optimizes the method for confirming the target request processing partition, so that the access request initiated by the test device can have a corresponding request processing partition inside the firewall, thereby realizing the diversion processing of the access request and improving the processing efficiency of the access request.

[0115] Furthermore, the performance verification analysis of the firewall and the target object configured with the firewall can be combined with Figure 4 understand, Figure 4 FIG. 1 is a flow chart of a method for processing an access request according to another embodiment of the present application. Figure 4 As shown, the method includes:

[0116] S401, performing performance evaluation on a firewall and a target object, and obtaining a first performance evaluation result of the firewall and a second performance evaluation result of the target object respectively.

[0117] In an embodiment of the present application, a system consisting of a firewall and a target object can be determined as a target system, and a performance evaluation of the target system consisting of the firewall and the target object can be achieved by performing a separate performance evaluation on the firewall and a separate performance evaluation on the target object.

[0118] Optionally, the performance evaluation of the firewall can be achieved through the results of the firewall's identification and interception of illegal access requests in the access requests.

[0119] Among them, the proportion of illegal access requests initiated can be determined from the number of access requests initiated.

[0120] In some implementations, the test stimulus sequence generated by the test stimulus generator can be used to configure the test device with relevant information for initiating an access request, and control the test device to initiate an access request to the target object.

[0121] Optionally, in the control process, the test stimulus generator may control the proportion of illegal access requests in the amount of access requests initiated by controlling the proportion of illegal access addresses carried in the test stimulus sequence.

[0122] Among them, before the performance verification starts, the relevant information about the proportion of illegal access requests in the total access request initiation amount can be configured in the test stimulus generator.

[0123] For example, if the proportion of illegal access requests in the total number of access requests is set to 10%, the data can be configured in the test stimulus generator before the performance verification begins. When generating the test stimulus sequence, the test stimulus generator can generate a corresponding proportion of stimulus sequences carrying illegal access addresses, and based on the portion of stimulus sequences carrying illegal access addresses, illegal access requests with a corresponding proportion can be generated.

[0124] Optionally, the initiation ratio of the illegal access requests configured in the relevant data storage area of ​​the test stimulus generator in the initiation amount of all access requests can be obtained.

[0125] Furthermore, the interception volume of illegal access requests by the firewall can be monitored, and the interception ratio of the interception volume to the received access requests can be obtained.

[0126] Optionally, a corresponding monitoring code may be mounted at the access port of the firewall, thereby enabling the firewall to monitor the interception amount of illegal access requests.

[0127] As a possible implementation method, a setting code for counting the number of illegal access requests intercepted by the firewall can be attached to the access port of the firewall, and the interception amount of illegal access requests can be monitored through the operation of the setting code.

[0128] Furthermore, based on the counted interception volume of illegal access requests and the volume of access requests received by the firewall, the interception ratio corresponding to the illegal access requests in all the access requests received by the firewall is determined.

[0129] As another possible implementation, a setting code for counting the number of security access requests passing through the firewall can be attached to the access port of the firewall, and the passing number of security access requests can be counted by running the setting code.

[0130] Furthermore, based on the counted throughput and the number of access requests received by the firewall, the throughput ratio of safe access requests among all access requests received by the firewall is determined, and then the interception ratio of illegal access requests is determined.

[0131] The performance of the firewall is evaluated according to the initiation ratio and the interception ratio to obtain the first performance evaluation result of the firewall.

[0132] In the embodiment of the present application, the obtained initiation ratio and interception ratio can be compared, and the performance evaluation of the firewall can be implemented based on the comparison result.

[0133] Among them, the evaluation result obtained by performing performance evaluation on the firewall can be determined as the first performance evaluation result.

[0134] As a possible implementation method, an algorithm may be set to calculate the interception ratio and the initiation ratio to obtain an error value between the interception ratio and the initiation ratio.

[0135] Furthermore, a set error range corresponding to the error value is obtained. When the obtained error value belongs to the set error range, it can be determined that the performance evaluation of the firewall's interception processing of illegal access requests is qualified.

[0136] As shown in Table 1, the target object is set to the storage system on the SOC chip, wherein, among all the read access requests initiated by the test device to the storage system, the initiation corresponding to the read illegal access request accounts for 10%, and correspondingly, among all the write access requests initiated by the test device to the storage system, the initiation corresponding to the write illegal access request accounts for 10%.

[0137] Furthermore, as shown in Table 1, the interception ratio of the firewall for reading illegal access requests and the interception ratio of the firewall for writing illegal requests are obtained respectively, so as to implement the performance evaluation of the firewall and obtain the first evaluation result of the firewall performance evaluation.

[0138] Table 1:

[0139]

[0140] As can be seen from Table 1, the interception ratio of read illegal access requests and the interception ratio of write illegal access requests are both 10.05%.

[0141] Furthermore, an error value 1 is obtained between the 10% initiation ratio of illegal read access requests in read access requests and the 10.05% interception ratio of illegal read access requests in all read access requests received by the firewall, as well as an error value 2 between the 10% initiation ratio of illegal write access requests in write access requests and the 10.05% interception ratio of illegal write access requests in all write access requests received by the firewall.

[0142] Among them, the error value 1 and the error value 2 can be set to belong to the set error range. Then, in the scenario where the firewall's interception performance for illegal access requests is as shown in Table 1, the performance of the firewall can meet the requirements of actual applications, and the first performance evaluation result of the firewall evaluation can be determined to be qualified.

[0143] Furthermore, after the firewall intercepts and filters the access request, the performance evaluation of the target object can be implemented based on the relevant response information of the target object to the access request not intercepted by the firewall, wherein the response delay time of the target object to the access request not intercepted by the firewall can be obtained.

[0144] Optionally, when the target object responds to the access request that is not intercepted by the firewall, its response delay time may be monitored, thereby obtaining the response delay time of the target object to the access request that is not intercepted by the firewall.

[0145] Furthermore, the performance of the target object is evaluated according to the response delay time to obtain a second performance evaluation result of the target object.

[0146] As a possible implementation method, the response delay time of a target object that is not configured with a firewall to an access request, as well as the response delay time of a target object that is configured with a firewall to an access request that is not intercepted by the firewall, can be obtained, thereby evaluating the target object and obtaining a second performance evaluation result of the target object performance evaluation.

[0147] As another possible implementation method, the threshold time corresponding to the response delay time can be obtained, and the obtained response delay time can be compared with the threshold time. When the response delay time is less than or equal to the threshold time, it can be determined that the response delay of the target object currently configured with a firewall will not affect its normal operating performance. Therefore, it can be determined that the second performance evaluation result of the target object in this scenario is qualified.

[0148] As shown in Table 2, by setting the target object to a storage system, statistics can be collected on the storage system's initiation speed and response speed for read access requests, as well as the initiation speed and response speed for write access requests, to obtain relevant information about the storage system's response delay time for read access requests, as well as relevant information about the storage system's response delay time for write access requests.

[0149] Among them, as shown in Table 2, the relevant information about the response delay time of the storage system to a read access request may include the maximum delay time, minimum delay time, and average delay time of the storage system's response to the read access request, and the relevant information about the response delay time of the storage system to a write access request may include the maximum delay time, minimum delay time, and average delay time of the storage system's response to the write access request.

[0150] Furthermore, based on the response speed and related information of the response time shown in Table 2, the performance of the storage system is evaluated to determine that the performance of the storage system shown in Table 2 can still meet actual needs after the firewall is configured, and then it can be determined that the second performance evaluation result of the target object configured with the firewall is qualified.

[0151] Table 2:

[0152]

[0153] S402: Evaluate the performance of the target system according to the first performance evaluation result and the second performance evaluation result.

[0154] In the embodiment of the present application, the performance evaluation of the target system can be implemented according to the detailed contents of the first performance evaluation result and the second performance evaluation result.

[0155] Optionally, in response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, it is determined that the target system performance evaluation result is qualified.

[0156] Among them, when the first performance evaluation result indicates that the firewall performance is qualified, it can be determined that the firewall's interception performance for illegal access requests can meet actual needs. Correspondingly, when the second performance evaluation result indicates that the performance of the target object is appropriate, it can be determined that the performance of the current target object's response to the access request can meet actual needs. Therefore, in this scenario, it can be determined that the target system composed of the firewall and the target object can meet actual application needs.

[0157] Further, it can be determined that the performance evaluation result of the target system is qualified.

[0158] The access request processing method proposed in the present application performs a performance evaluation on the firewall to obtain a first performance evaluation result, performs a performance evaluation on the target object to obtain a corresponding second performance evaluation result, and implements a performance evaluation of the target system based on the first performance evaluation result and the second performance evaluation result. In the present application, by performing performance evaluations on the firewall and the target object respectively, a performance evaluation of the target system composed of the firewall and the target object is implemented, thereby implementing an evaluation of the degree of performance impact of configuring the firewall on the target object, and implementing a performance verification of the security and stability of the target system composed of the firewall and the target object.

[0159] Corresponding to the access request processing methods proposed in the above-mentioned embodiments, an embodiment of the present application further proposes an access request processing device. Since the access request processing device proposed in the embodiment of the present application corresponds to the access request processing methods proposed in the above-mentioned embodiments, the implementation method of the above-mentioned access request processing method is also applicable to the access request processing device proposed in the embodiment of the present application, and will not be described in detail in the following embodiments.

[0160] Figure 5 FIG. 1 is a schematic diagram of a structure of an access request processing device according to an embodiment of the present application. Figure 5 As shown, the access request processing device 500 includes a receiving module 51, a determining module 52, a processing module 53, and an evaluating module 54, wherein:

[0161] A receiving module 51, configured to receive an access request for accessing a target object;

[0162] A determination module 52, configured to determine a target request processing partition corresponding to the access request from a plurality of candidate request processing partitions inside the firewall;

[0163] The processing module 53 is used to obtain the security access address segment of the target request processing partition and intercept the access request according to the security access address segment.

[0164] In an embodiment of the present application, the processing module 53 is also used to: obtain a target access address of an access request to a target object; identify whether the access request is an illegal access request based on the security access address segment and the target access address; and intercept the illegal access request in response to identifying that the access request is an illegal access request.

[0165] In the embodiment of the present application, the processing module 53 is also used to: in response to the target access address belonging to the security access address segment of the target request processing partition, determine that the access request is a secure access request; in response to the target access address not belonging to the security access address segment of the target request processing partition, determine that the access request is an illegal access request.

[0166] In an embodiment of the present application, the determination module 52 is also used to: obtain an identification correspondence between the area identification of the candidate request processing partition and the device identification of the test device, wherein the test device is used to initiate an access request to the target object; determine the target device identification of the target test device that initiates the access request from the information carried in the access request; determine the target area identification corresponding to the target device identification based on the identification correspondence, and determine the candidate request processing partition corresponding to the target area identification as the target request processing partition that processes the access request.

[0167] In an embodiment of the present application, the device also includes an evaluation module 54, which is used to: perform performance evaluation on the firewall and the target object, and respectively obtain a first performance evaluation result of the firewall and a second performance evaluation result of the target object; and evaluate the performance of the target system based on the first performance evaluation result and the second performance evaluation result.

[0168] In the embodiment of the present application, the evaluation module 54 is also used to: determine the initiation ratio of illegal access requests from the initiation quantity of access requests; monitor the interception quantity of illegal access requests by the firewall, and obtain the interception ratio of the interception quantity in the received quantity of access requests; evaluate the performance of the firewall according to the initiation ratio and the interception ratio to obtain a first performance evaluation result of the firewall.

[0169] In the embodiment of the present application, the evaluation module 54 is further used to: obtain the error value of the initiation ratio and the interception ratio; in response to the error value belonging to the set error range, determine that the first performance evaluation result of the firewall is qualified.

[0170] In an embodiment of the present application, the evaluation module 54 is also used to: obtain the response delay time of the target object to the access request that is not intercepted by the firewall; evaluate the performance of the target object according to the response delay time to obtain a second performance evaluation result of the target object.

[0171] In the embodiment of the present application, the evaluation module 54 is further used to: obtain a threshold time of a response delay of the target object; and in response to the response delay time being less than or equal to the threshold time, determine that the second performance evaluation result of the target object is qualified.

[0172] In the embodiment of the present application, the evaluation module 54 is further used to: in response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, determine that the target system performance evaluation result is qualified.

[0173] The access request processing device proposed in the present application receives the access request of the target object, and determines the target request processing partition corresponding to the access request from the multiple candidate request processing partitions divided inside the firewall. Furthermore, the access request is identified and judged according to the secure access address segment of the target request processing partition, and the access request determined to carry the non-secure access address is intercepted and processed. In the present application, the access request of the target object is identified and intercepted by the firewall, thereby achieving secure access to the target object, dividing the firewall into multiple candidate request processing partitions, achieving diversion processing of access requests, improving the efficiency of the firewall in processing access requests, and thus improving the efficiency of verification and analysis of firewall performance, achieving manageability of firewall performance verification, and optimizing the verification method and verification effect.

[0174] To achieve the above embodiments, the present application also proposes an electronic device, a computer-readable storage medium and a computer program product.

[0175] Figure 6 A block diagram of an electronic device according to an embodiment of the present application. Figure 6 The electronic device shown can be implemented to perform Figures 1 to 4 A method for processing an access request of an embodiment.

[0176] In order to implement the above embodiment, the present application also proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute Figures 1 to 4 A method for processing an access request of an embodiment.

[0177] In order to implement the above embodiment, the present application also proposes a computer program product. When the instruction processor in the computer program product executes, Figures 1 to 4 A method for processing an access request of an embodiment.

[0178] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0179] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0180] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0181] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0182] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0183] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0184] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0185] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for processing an access request, characterized in that: The method is applicable to a system-level chip configured with a security defense system, and the method comprises: receiving an access request for accessing a target object; Determine a target request processing partition corresponding to the access request from a plurality of candidate request processing partitions inside the firewall; Obtaining a security access address segment of the target request processing partition, and intercepting the access request according to the security access address segment; The method further comprises: Performing performance evaluation on the firewall and the target object, and respectively obtaining a first performance evaluation result of the firewall and a second performance evaluation result of the target object; Evaluate the performance of the target system according to the first performance evaluation result and the second performance evaluation result; The obtaining of the first performance evaluation result of the firewall includes: Determine the proportion of illegal access requests initiated from the number of access requests initiated; Monitor the interception amount of the illegal access request by the firewall, and obtain the interception ratio of the interception amount in the received access request; Evaluate the performance of the firewall according to the initiation ratio and the interception ratio to obtain the first performance evaluation result of the firewall; The obtaining a second performance evaluation result of the target object includes: Obtaining a response delay time of the target object to an access request not intercepted by the firewall; The performance of the target object is evaluated according to the response delay time to obtain the second performance evaluation result of the target object.

2. The method according to claim 1, characterized in that The intercepting the access request according to the secure access address segment includes: Obtaining a target access address of the access request to the target object; Identify whether the access request is an illegal access request according to the secure access address segment and the target access address; In response to identifying that the access request is an illegal access request, the illegal access request is intercepted.

3. The method according to claim 2, characterized in that The step of identifying whether the access request is an illegal access request according to the secure access address segment and the target access address includes: In response to the target access address belonging to the secure access address segment of the target request processing partition, determining that the access request is a secure access request; In response to the target access address not belonging to the secure access address segment of the target request processing partition, the access request is determined to be the illegal access request.

4. The method according to claim 1, characterized in that The step of determining a target request processing partition for the access request from a plurality of candidate request processing partitions within the firewall includes: Acquire an identification correspondence between a region identification of the candidate request processing partition and a device identification of a test device, wherein the test device is used to initiate an access request to the target object; Determine, from the information carried in the access request, a target device identifier of a target test device that initiates the access request; According to the identifier correspondence, a target area identifier corresponding to the target device identifier is determined, and a candidate request processing partition corresponding to the target area identifier is determined as a target request processing partition for processing the access request.

5. The method according to claim 1, characterized in that The evaluating the performance of the firewall according to the initiation ratio and the interception ratio to obtain the first performance evaluation result of the firewall includes: Obtaining an error value between the initiation ratio and the interception ratio; In response to the error value belonging to a set error range, it is determined that the first performance evaluation result of the firewall is qualified.

6. The method according to claim 1, characterized in that The evaluating the performance of the target object according to the response delay time to obtain the second performance evaluation result of the target object includes: Acquire a threshold time of a response delay of the target object; In response to the response delay time being less than or equal to the threshold time, it is determined that the second performance evaluation result of the target object is qualified.

7. The method according to claim 5 or 6, characterized in that: The evaluating the performance of the target system according to the first performance evaluation result and the second performance evaluation result includes: In response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, it is determined that the target system performance evaluation result is qualified.

8. A device for processing access requests, characterized in that: The device is arranged in a system-level chip equipped with a security defense system, and the device comprises: A receiving module, used for receiving an access request for accessing a target object; A determination module, used to determine a target request processing partition corresponding to the access request from a plurality of candidate request processing partitions inside the firewall; A processing module, used for obtaining a security access address segment of the target request processing partition, and intercepting the access request according to the security access address segment; The device further comprises an evaluation module, which is used for: Performing performance evaluation on the firewall and the target object, and respectively obtaining a first performance evaluation result of the firewall and a second performance evaluation result of the target object; Evaluate the performance of the target system according to the first performance evaluation result and the second performance evaluation result; The evaluation module is also used to: Determine the proportion of illegal access requests initiated from the number of access requests initiated; Monitor the interception amount of the illegal access request by the firewall, and obtain the interception ratio of the interception amount in the received access request; Evaluate the performance of the firewall according to the initiation ratio and the interception ratio to obtain the first performance evaluation result of the firewall; The evaluation module is also used to: Obtaining a response delay time of the target object to an access request not intercepted by the firewall; The performance of the target object is evaluated according to the response delay time to obtain the second performance evaluation result of the target object.

9. The device according to claim 8, characterized in that The processing module is further used for: Obtaining a target access address of the access request to the target object; Identify whether the access request is an illegal access request according to the secure access address segment and the target access address; In response to identifying that the access request is an illegal access request, the illegal access request is intercepted.

10. The device according to claim 9, characterized in that The processing module is further used for: In response to the target access address belonging to the secure access address segment of the target request processing partition, determining that the access request is a secure access request; In response to the target access address not belonging to the secure access address segment of the target request processing partition, the access request is determined to be the illegal access request.

11. The device according to claim 8, characterized in that The determining module is further used for: Acquire an identification correspondence between a region identification of the candidate request processing partition and a device identification of a test device, wherein the test device is used to initiate an access request to the target object; Determine, from the information carried in the access request, a target device identifier of a target test device that initiates the access request; According to the identifier correspondence, a target area identifier corresponding to the target device identifier is determined, and a candidate request processing partition corresponding to the target area identifier is determined as a target request processing partition for processing the access request.

12. The device according to claim 8, characterized in that The evaluation module is also used to: Obtaining an error value between the initiation ratio and the interception ratio; In response to the error value belonging to a set error range, it is determined that the first performance evaluation result of the firewall is qualified.

13. The device according to claim 8, characterized in that The evaluation module is also used to: Acquire a threshold time of a response delay of the target object; In response to the response delay time being less than or equal to the threshold time, it is determined that the second performance evaluation result of the target object is qualified.

14. The device according to claim 12 or 13, characterized in that The evaluation module is also used to: In response to the first performance evaluation result indicating that the firewall performance is qualified, and the second performance evaluation result indicating that the target object performance is qualified, it is determined that the target system performance evaluation result is qualified.

15. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

16. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images