A method and system for providing firewall function for user-mode network protocol stack

Abstract

The present invention relates to a method and system for providing a firewall function for a user-mode network protocol stack. The method part mainly includes: using a switching chip with forwarding and filtering capabilities based on layer 2 link messages as the front-end management switching module; using an analyzer to extract and analyze messages directed to the kernel stack through the management switching module; judging whether the messages entering the kernel stack are of known types and filtering them; based on the user-mode network protocol stack sending and receiving messages, the user-mode network protocol stack itself performs inspections; for messages imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, and registers the corresponding information with the analyzer according to the processing result. The present invention can provide an efficient method for processing network information flow, provide the highest security features, and reduce the possibility of the entire device being interrupted by security threats.

Description

Technical Field

[0001] The present invention relates to the technical field of firewalls, and in particular to a method and system for providing a firewall function for a user-mode network protocol stack. Background Art

[0002] Using the operating system kernel stack cannot meet the requirements of communication equipment specifications, so large-scale equipment, especially distributed multi-board equipment, usually uses a user-mode network protocol stack to solve specification issues.

[0003] On this basis, in order to further improve the actual throughput of the user-mode network protocol stack, DPDK (DataPlane Development Kit) will be introduced to move business data directly from hardware to user space through DMA (Direct Memory Access), bypassing the kernel stack.

[0004] In this case, the throughput rate has been greatly improved, but for the user-mode network protocol stack, if there are attack messages, the user-mode network protocol stack needs to integrate firewall-related mechanisms to confirm normal messages, attack messages, etc. This is a huge pressure on the user-mode network protocol stack.

[0005] Usually, a network firewall with exclusive resources is used to monitor all data passing through the stack, intercept attack messages, and forward normal messages. Combined with related capabilities such as deep packet inspection, security can be greatly improved. However, the firewall consumes a lot of computing resources, and all messages need to "pass through the firewall."

[0006] Therefore, if a firewall is installed in front of the user-mode network protocol stack, the firewall processing process will seriously affect the throughput, which is inconsistent with the purpose of introducing DPDK. If the firewall is integrated into the user-mode network protocol stack, and the user-mode network protocol stack "processes all messages by itself", there are two situations: abnormal messages are directly processed by the user-mode network protocol stack, which is not secure enough and is tightly coupled with the functional user-mode network protocol stack, which is not conducive to functional expansion; abnormal messages are forwarded from the user-mode network protocol stack to the firewall, and valid messages are forwarded to the determined downstream modules, which is still a serial processing mode, which is inconsistent with performance requirements and seriously affects throughput.

[0007] In view of this, how to overcome the defects of the prior art and solve the above-mentioned technical problems is a difficult problem to be solved in this technical field. Summary of the invention

[0008] In response to the defects or improvement needs in the prior art, the present invention provides a method and system for providing a firewall function for a user-mode network protocol stack, which can provide an efficient method for processing network information flows. Without impacting the connection establishment process of the information flow, it can maximize the use of the processing capabilities of the switching chip, business chip and central processing unit in the device, achieve higher processing efficiency with minimal consumption, and provide the highest security features, thereby reducing the possibility of the entire device being interrupted due to security threats.

[0009] The embodiment of the present invention adopts the following technical solution:

[0010] In a first aspect, the present invention provides a method for providing a firewall function for a user-mode network protocol stack, comprising:

[0011] Use a switching chip with the ability to forward and filter Layer 2 link messages as the front-end management switching module to distribute data messages based on MAC layer information;

[0012] An analyzer is used to extract and analyze the messages directed to the kernel stack by the management switch module to determine whether to discard these messages or continue to pass them downstream.

[0013] Determine whether the message entering the kernel stack is of known type and filter it;

[0014] Messages are sent and received based on the user-mode network protocol stack, and the user-mode network protocol stack itself performs checks;

[0015] For messages imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, and registers the corresponding information with the analyzer based on the processing results to affect how future messages arrive at the user-mode network protocol stack.

[0016] Furthermore, for the data message input to the management switch module, the input method includes:

[0017] When serving as the first station, the external port of the management switch module of this station is directly connected to the northbound management terminal, and all data messages are management messages;

[0018] When not serving as the first station, the management switching module of this station is connected to the mirror output port of the business processing chip. The data packets include management packets accompanying the business, and some business packets are also allowed to be processed by the firewall of this station.

[0019] Further, the extracting and analyzing of the message directed to the kernel stack by the management switch module by the analyzer to determine whether to discard the message or continue to transmit it downstream specifically includes:

[0020] Messages that fail the security check are directly discarded.

[0021] For messages that pass the security setting check and belong to special management configuration, the callback interface registered by the service and behavior management module on the user-mode network protocol stack to the analyzer at startup is executed to add relevant configurations; the specific configurations include: the message path settings of the management switching module and the filtering behavior of the kernel stack;

[0022] For messages that have passed the security setting check and the firewall is temporarily unable to determine whether they are security types, the firewall does not perform any action on such messages. At this time, the relevant data messages can pass through the kernel protocol stack to the user-mode network protocol stack.

[0023] Furthermore, the messages that fail the security setting check specifically include one or more of messages with mismatched MAC addresses, messages with the same MAC initiating the same connection establishment request multiple times, and messages with the same MAC frequently initiating multiple connection attempts but repeatedly failing the key verification link required by the backend.

[0024] Further, the determining whether the message entering the kernel stack is of a known type and filtering the message specifically includes:

[0025] For unknown type messages, they are considered unsafe and discarded directly;

[0026] For known types of messages, their security is temporarily recognized and handed over to downstream links for inspection;

[0027] For known type messages, if the downstream link finds that there is attack behavior after inspection, the relevant action is executed. The relevant action is handed over to the analyzer for processing through the analyzer's callback method.

[0028] Furthermore, the sending and receiving of messages based on the user-mode network protocol stack, and the checking by the user-mode network protocol stack itself specifically includes:

[0029] The user-mode network protocol stack provides an encapsulated user-mode network protocol stack socket to the application layer, and the user-mode network protocol stack socket can simultaneously receive data coming through the kernel stack, or directly use the data obtained by the service exchange DMA channel;

[0030] When the user-mode network protocol stack receives data from the kernel stack, it determines whether a connection has been established. If not, it establishes a connection, generates a user-mode network protocol stack socket, and starts the corresponding service through the service and behavior management module.

[0031] Furthermore, when determining whether a connection has been established, if a connection has been established, the message will not enter the user mode network protocol stack from the kernel stack.

[0032] Furthermore, for the message imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, specifically including:

[0033] The packets from the analyzer are divided into valid configuration packets and invalid configuration packets, and new filtering behavior configuration is provided for the configuration packets;

[0034] For the message from the kernel stack, if it is a new connection message, a connection instance is established according to the allowed number of connections; if the message from the kernel stack is not a new connection message, it is determined to be an abnormal message with attack behavior, and the features are directly extracted and handed over to the analyzer for corresponding filtering. Future related messages are directly discarded at the hook before the analyzer actually processes the message to the kernel stack through XDP;

[0035] For the messages extracted from the business exchange, normally only the messages of the established connection can be used directly; if they are not the messages of the established connection, they are judged as attack messages and are discarded directly.

[0036] Furthermore, the message transmission path includes:

[0037] The messages that have passed through the analyzer are compared by the analyzer to confirm the legitimacy and security of the messages. All messages that have not passed the security check should be first imported into the analyzer for analysis to determine their future path direction;

[0038] When the analyzer does not consider that the message information needs to be checked within its jurisdiction, the corresponding message will enter the kernel stack and determine the next direction of the message based on the filter configuration of the kernel stack;

[0039] The DPDK-style driver for business exchange is directly extracted to the user-mode network protocol stack.

[0040] On the other hand, the present invention provides a system for providing a firewall function for a user-mode network protocol stack, including a firewall, a user-mode network protocol stack, and a service and behavior management module, wherein the firewall includes a management switching module, an analyzer, and a kernel stack, wherein:

[0041] The management switching module is used to provide forwarding and filtering capabilities based on layer 2 link messages, and distribute data messages based on MAC layer information;

[0042] The analyzer is used to extract and analyze the messages directed to the kernel stack by the management switch module to determine whether to discard these messages or continue to transmit them downstream;

[0043] The kernel stack is used to determine whether the message is of a known type and perform filtering processing;

[0044] The user-mode network protocol stack is used to perform an application layer filtering mechanism check on the messages arriving at itself;

[0045] The service and behavior management module runs based on the user-mode network protocol stack, and is used to determine how to start the service according to the source of the message, and register corresponding information with the analyzer according to the processing result, so as to affect how future messages arrive at the user-mode network protocol stack.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] With low resource consumption: (1) Complete data monitoring and protection of management information flows are obtained; (2) Efficient business information flow detection capabilities are obtained, and only the current station is checked by default; (3) Transit information can be flexibly configured according to the networking form, and some inspection capabilities are also provided for remote devices that do not have firewall capabilities to further reduce overall network risks; (4) The user-mode network protocol stack may still be impacted in this application form, but attacks against "this station" will be able to be stopped to a great extent, and transit behavior can also have a certain degree of security mechanism if the device has sufficient computing power. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A flowchart of a method for providing a firewall function for a user-mode network protocol stack provided in Example 1 of the present invention;

[0050] Figure 2 An expanded flow chart of step 200 provided in Embodiment 1 of the present invention;

[0051] Figure 3 An expanded flow chart of step 300 provided in Embodiment 1 of the present invention;

[0052] Figure 4 An expanded flow chart of step 500 provided in Embodiment 1 of the present invention;

[0053] Figure 5 A timing diagram of message processing provided in Example 1 of the present invention;

[0054] Figure 6 A schematic diagram of inputting data in two directions based on a system provided in Embodiment 2 of the present invention;

[0055] Figure 7 A schematic diagram of the workflow of the service and behavior management module provided in Example 2 of the present invention;

[0056] Figure 8 A schematic diagram of message transmission paths with three different efficiencies provided in Embodiment 3 of the present invention;

[0057] Fig. 9 A schematic diagram of the structure of a device for providing a firewall function for a user-mode network protocol stack provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0059] The present invention is an architecture of a specific functional system, so the specific embodiments mainly illustrate the functional logical relationship between the various structural modules, and do not limit the specific software and hardware implementation methods.

[0060] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other, and the order of each step can be changed if it is logical and does not conflict. The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0061] Embodiment 1:

[0062] like Figure 1 As shown, an embodiment of the present invention provides a method for providing a firewall function for a user-mode network protocol stack, and the method includes the following steps.

[0063] Step 100: Use a switching chip with forwarding and filtering capabilities based on Layer 2 link messages as the front-end management switching module to distribute data packets based on MAC layer information. In this step, the data message has two inputs: when serving as the first station, the management switching module of this station is directly connected to the northbound management end through its external port, and all data messages are management messages; when not serving as the first station, the management switching module of this station is connected to the mirror output port of the service processing chip, and the data message has management messages that are in line with the service, and some service messages are also allowed to be configured to be processed by the firewall of this station. The input messages of the above two paths have different paths to enter the management switch, and their subsequent processing procedures are similar. It should be noted that the switching chip selected in this step is a switching chip with basic ACL capabilities. As a management switch, based on the above ACL capabilities, it provides flexible and configurable data flow control to the outside world.

[0064] Step 200: Use an analyzer to extract and analyze the messages directed to the kernel stack by the management switching module to determine whether these messages should be discarded or continue to be transmitted downstream. In this step, the analyzer of the data message uses the XDP (XMLData Package, XML-based file format) socket method to extract the message into the user-mode application before it enters the kernel network protocol stack for analysis and processing. At the same time, the analyzer also needs to provide a registration interface to the outside world, allowing external applications to register a callback interface through RPC (Remote Procedure Call Protocol). When there is a matching message during the message processing process, a callback is initiated to adjust the corresponding configuration to prohibit or adjust the direction and path of subsequent related messages. It should be noted that the analyzer can be implemented based on the capabilities such as eBPF and XDP provided by the Linux kernel.

[0065] Step 300: Determine whether the message entering the kernel stack is of a known type and filter it. In this step, the netfilter capability in the Linux kernel is used to extract the message form configuration that is allowed to pass according to the actual business scenario requirements of the device to form a configuration template. It should be noted that even if the security check of the analyzer is passed, it does not mean that it can pass the settings on the kernel side. The inspection fields at different levels are separate.

[0066] Step 400: Based on the user-mode network protocol stack, the user-mode network protocol stack itself performs an inspection based on the message receiving and sending. For this step, the messages that can reach the user-mode network protocol stack after the previous checks are inspected by the user-mode network protocol stack itself, and the messages that can reach the user-mode network protocol stack have been filtered by the analyzer and the kernel stack netfilter related mechanism, and are already "relatively credible" messages, but there may still be abnormal messages at this time, so the application layer filtering mechanism is still needed. In addition, in this step, the user-mode network protocol stack provides the application layer with an encapsulated user-mode network protocol stack socket, which is different from the native socket provided by the kernel in that this user-mode network protocol stack socket has been transferred and can simultaneously receive data from the kernel stack, or directly use the data obtained by the service exchange DMA channel. At this stage, when the user-mode network protocol stack receives data from the kernel stack, it determines whether a connection has been established. If not, a connection is established, a user-mode network protocol stack socket is generated, and the corresponding service is pulled up through the service and behavior management module. The "establishing a connection" here means establishing an actual "connection instance" controlled by the local site when a valid connection request comes from the outside. It should be noted that if the data source is the kernel stack, this data must be data that has not been connected (refer to Figure 5When all connections are created, data is passed from the kernel stack. After the connection is created, the relevant data will be directed to the business chip). If it is a data packet with an established connection, it will not enter the user-mode network protocol stack from the kernel stack, but will come in from the path on the business chip side.

[0067] Step 500: For the message imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, and registers the corresponding information with the analyzer according to the processing result, so as to affect how the future message arrives at the user-mode network protocol stack. Since this service management needs to run based on the user-mode stack, the standard systemd or xinetd monitoring socket is not used, because it is necessary to develop a behavior management function for the packet, in cooperation with the analyzer, to process messages at different stages in different processing units. In this step, "registering the corresponding information with the analyzer according to the processing result, so as to affect how the future message arrives at the user-mode network protocol stack" is a feedback mechanism. Specifically, it allows the message that has been clearly identified as safe or not to pass through the analyzer every time, but to follow the path determined by the configuration formed based on the original analysis result.

[0068] Specifically, Figure 2 As shown, step 200 of this embodiment can be expanded into the following steps according to the three possibilities after analysis.

[0069] Step 201: directly discard the messages that fail the security check. It should be noted that the "messages that fail the security check" here are general. The more common ones in the industry include messages with mismatched MAC addresses, messages with the same MAC initiating the same connection request multiple times, messages with the same MAC frequently initiating multiple connection attempts but repeatedly failing the key verification link required by the backend, etc.

[0070] The rules here are the result of incremental iterations of collected materials and models over time. They may fall within the scope of another patent, so there is no specific reference.

[0071] Step 202: For messages that pass the security setting check and belong to special management configuration, execute the callback interface registered by the service and behavior management module on the user-mode network protocol stack side to the analyzer at startup to add relevant configurations; the specific configuration includes: the message path setting of the management switching module, the filtering behavior of the kernel stack, etc.

[0072] Step 203: For messages that have passed the security setting check and are of a type that the firewall cannot determine whether they are safe, the firewall does not perform any action on such message data. At this time, the relevant data message can reach the user-mode network protocol stack through the kernel protocol stack.

[0073] Specifically, Figure 3 As shown, step 300 of this embodiment can be expanded into the following steps for determining whether the type is known.

[0074] Step 301: For unknown type messages, they are considered unsafe and are directly discarded.

[0075] Step 302: For messages of known types, their security is temporarily recognized and handed over to downstream links for inspection.

[0076] Step 303: For known type messages, if the downstream link finds that there is an attack behavior after inspection, relevant actions need to be performed; note that this relevant action is not performed by the netfilter of the kernel stack, but is handed over to the analyzer for processing through the callback method of the analyzer mentioned above.

[0077] Specifically, Figure 4 As shown, in step 500 of this embodiment, for the message imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, which can be specifically expanded into the following steps.

[0078] Step 501: The messages from the analyzer are divided into valid configuration messages and invalid configuration messages, and new filtering behavior configuration is provided for the configuration messages. The new filtering behavior configuration provided here refers to the configuration for a "specific message structure". For example, a message structure:

[0079] stu{

[0080] int type=1

[0081] int len ​​= 2

[0082] int data = {3,4};

[0083] }

[0084] For this structure, we mark it as "a structure I recognize", so that next time a similar structure appears, it will be considered legal and can flow downstream. Before the configuration, it will be directly discarded. This new filtering behavior configuration is equivalent to a whitelist system.

[0085] Step 502: For the message coming from the kernel stack, if it is a new connection message, a connection instance is established according to the allowed number of connections; if the message coming from the kernel stack is not a new connection message, it is determined to be an abnormal message with attack behavior, and the features are directly extracted and handed over to the analyzer for corresponding filtering. Future related messages are directly discarded at the hook before the analyzer actually processes the message to the kernel stack through XDP.

[0086] Step 503: For the messages extracted by the service exchange, generally speaking, they can only be messages with established connections, and they are allowed to be used directly; if there is a special situation where the message is not a message with established connections, it will be judged as an attack message and discarded directly. Then you can also configure the service exchange filtering behavior. The service exchange filtering behavior configures whether the message should go to the analyzer, the kernel stack, or the service chip directly after receiving the relevant message. It should be noted here that only the service exchange chip is directly controlled by the user-mode network protocol stack service and behavior management module. For this step, simply put, a message itself carries the status attributes of this message. If the status carried by this message is not "connection established", but it comes from the service exchange side, it can be discarded directly.

[0087] Finally, after the above steps, the data directed by the management switching module to the business switching (data source one) and the data that can be directed to the user-mode network protocol stack through the business switching (data source two) are already very "safe" data. The upper-layer service module directly references them and no longer needs to pay attention to security features.

[0088] This embodiment can further illustrate the scheme of the present invention from the perspective of the timing of message processing. Figure 5 As shown in the figure, it is a message processing timing diagram provided in this embodiment, wherein the vertical axis is the time axis, and the following actions are performed in order from top to bottom: the service and behavior management module (i.e. Figure 5 The analyzer registers the default behavior with the management switch module (i.e. Figure 5Management exchange) configures management exchange filtering behavior; the analyzer configures kernel filtering behavior to the kernel stack; for packets that are not determined to be safe, if the analyzer determines that they are unsafe packets, they are directly discarded at the analyzer; if they are safe management configuration messages, the management configuration is retained and the user stack (that is, the user-mode network protocol stack) registration callback is executed; the service and behavior management module sends registration behavior to the analyzer; the analyzer configures management exchange filtering behavior to the management exchange module; the analyzer configures kernel filtering behavior to the kernel stack; for packets with relatively safe management configuration but for establishing connections, those that should be directly discarded based on the configuration are discarded at the management exchange module, and those that can be diverted to the kernel stack based on the configuration are diverted to the kernel stack; for application connection requests that are not recognized by the kernel configuration, they are discarded after the kernel detects abnormalities; for recognized requests, they are diverted from the kernel stack to the user stack; if the user stack determines that it is an abnormal connection If the connection is not received, it will be discarded; for normal connection requests, the user stack will hand over the unconnected message to the service and behavior management module. It should be noted that the normal "establishment" connection request can only come from the kernel stack, which is managed by the user stack and handed over to the service and behavior management module; if the service and behavior management module determines that it is an abnormal connection, it will be discarded and the filtering behavior will be registered with the analyzer; the analyzer configures the management exchange filtering behavior to the management exchange module; the analyzer configures the kernel filtering behavior to the kernel stack; the service and behavior management module pulls up the service to establish a connection, and then configures the analyzer to divert traffic to the business exchange; the analyzer configures the management exchange filtering behavior to the management exchange module; the analyzer configures the kernel filtering behavior to the kernel stack; next, based on the configuration, divert traffic to the business exchange, the management exchange module diverts traffic to the user stack through the business exchange, and the user stack directly uses the service and behavior management module to pull up the service based on the existing connection.

[0089] In summary, the embodiments of the present invention can achieve complete data monitoring and protection of management information flows with relatively low resource consumption; it can obtain the ability to detect efficient business information flows, and only check this station by default; in addition, the transit information can be flexibly configured according to the networking form, and some inspection capabilities are also provided for remote devices that do not have firewall capabilities, so as to further reduce the overall network risk; based on the above effects, the user-mode network protocol stack may still be impacted in this application form, but the attack behavior against "this station" will be able to be stopped to a great extent, and the transit behavior can also have a certain degree of security mechanism when the device computing power is sufficient.

[0090] Embodiment 2:

[0091] Based on the method for providing a firewall function for a user-mode network protocol stack provided in Example 1, this Example 2 provides a system for providing a firewall function for a user-mode network protocol stack to implement the method in Example 1.

[0092] refer to Figure 6As shown, the system of this embodiment includes a firewall, a user-mode network protocol stack, and a service and behavior management module, wherein the firewall includes a management switching module, an analyzer, and a kernel stack, wherein: the management switching module is used to provide forwarding and filtering capabilities based on layer 2 link messages, and distribute data messages based on MAC layer information; the analyzer is used to extract and analyze messages directed to the kernel stack by the management switching module to determine whether these messages are discarded or continue to be transmitted downstream; the kernel stack is used to determine whether the message is of a known type and perform filtering processing; the user-mode network protocol stack is used to check the application layer filtering mechanism for the messages arriving at itself; the service and behavior management module runs based on the user-mode network protocol stack, is used to determine how to start the service according to the source of the message, and registers the corresponding information with the analyzer according to the processing result, so as to affect how future messages arrive at the user-mode network protocol stack.

[0093] Continue to refer Figure 6 As shown in the figure, for the management switch module, the datagram has two inputs:

[0094] (1) When serving as the first station, the external port of the management switch module of this station is directly connected to the northbound management terminal, and all data messages are management messages.

[0095] (2) When not acting as the first station, the management switch module of this station is connected to the service processing chip (i.e. Figure 6 The mirror output port of the NP in the figure is used as the output port of the analyzer. The data packets are management packets that are related to the service, and some service packets can also be configured to be processed by the firewall of this station. It should be noted that any packet can theoretically be imported into the analyzer through the service processing chip and the port of the management switch. The "some service packets can be configured" mentioned here is mainly to explain that the capacity of this "firewall" is limited and it is impossible to process everything. If there is a real need, the particularly necessary service-related content can be diverted to be processed.

[0096] The paths through which the input messages of the above two paths enter the management switching module are different, but the subsequent processing flows are similar.

[0097] For the analyzer, the analyzer also needs to provide a registration interface to the outside world, allowing external applications to register a callback interface through RPC. If there is a matching message during the message processing, a callback is initiated to adjust the corresponding configuration to prohibit or adjust the direction and path of subsequent related messages. There are three possibilities for messages entering this level. One is that they do not pass the security setting check and are directly discarded. One is that they pass the security setting check and belong to special management configuration. If this is the case, it is necessary to execute the callback interface registered by the behavior management module to the analyzer at startup on the user-mode network protocol stack side to add relevant configurations. Specific configurations include the message path settings for management exchange, the filtering behavior of the kernel stack, etc. One is that they pass the security check and belong to the type that the firewall cannot determine whether it is safe. The firewall does not perform any action on this type of data. At this time, the relevant data message can pass the kernel protocol stack to reach the user-mode network protocol stack side.

[0098] For the kernel stack, the netfilter capability in the Linux kernel is used to extract the packet form configuration allowed to pass according to the actual business scenario requirements of the device to form a configuration template. There are three possible ways to process the packet: unknown type packets are considered unsafe and discarded directly; known type packets are temporarily recognized as safe and handed over to the downstream link for inspection; known type packets are considered to have attack behaviors after inspection in the downstream link and relevant actions need to be executed; note that this action is not executed by the netfilter of the kernel stack, but is handed over to the analyzer for processing through the callback method of the analyzer mentioned above.

[0099] For the user-mode network protocol stack, among the above messages, the messages that can reach the user-mode network protocol stack after the previous checks are checked by the user-mode network protocol stack itself. The messages that can reach the user-mode network protocol stack have been filtered by the analyzer and the kernel stack netfilter related mechanisms, and are already "relatively reliable" messages, but there may still be abnormal messages at this time, so the application layer filtering mechanism is still needed. The user-mode network protocol stack provides an encapsulated "socket" to the application layer. The difference from the native socket provided by the kernel is that this socket has been transferred and can simultaneously receive data from the kernel stack, or directly use the data obtained by the service exchange DMA channel. At this stage, the data source is the kernel stack, and this data must be data that has not been connected. Therefore, after receiving the data, the user-mode network protocol stack establishes a connection, generates a user-mode network protocol stack socket, and pulls up the corresponding service through the service and behavior management module.

[0100] For the service and behavior management module, since this service and behavior management module needs to run based on the user state stack and does not use the standard systemd or xinetd monitoring socket, it is necessary to develop a behavior management function for the package and cooperate with the analyzer to process the packets at different stages in different processing units. Figure 7 As shown in the figure, it is the workflow of the service and behavior management module. This module summarizes data from three possible sources, extracts configuration here, creates connections according to the degree of trust, and pulls up specific service instances of the backend as follows: For the messages from the analyzer, there may be "valid configuration messages" and "invalid configuration messages", and the configuration messages provide "new" filtering behavior configuration; for the messages from the kernel stack, if it is a new connection message, a connection instance can be established according to the number of allowed connections; and if the message from the kernel stack is not a "new connection message", it must be an abnormal message with attack behavior, and the features are directly extracted and handed over to the analyzer for corresponding filtering. Future related messages are directly discarded at the hook before the analyzer actually processes the message to the kernel stack through XDP; for the messages extracted from the business exchange, in general, it can only be "established connection messages", which are allowed to be used directly; if there is a special situation that it is not an established connection message, then it is an attack message, and the configuration business exchange filtering behavior is executed. It should be noted here that only the business exchange chip is directly controlled by the user-mode network protocol stack service and behavior management module.

[0101] Based on the above technical solution, different processing units group and filter messages based on the capabilities of the hardware and kernel. The messages that finally reach the user-mode network protocol stack have been free of most threats; the service and behavior management module only needs to process the remaining relatively safe messages.

[0102] Embodiment 3:

[0103] Based on the method and system for providing a firewall function for a user-mode network protocol stack provided in Examples 1 and 2, this Example 3 further illustrates the present invention from the perspective of the message transmission path.

[0104] like Figure 8 As shown, this embodiment provides three message transmission paths.

[0105] First, the slow path: the message passing through the analyzer needs to be compared with the analyzer to confirm the legitimacy and security of the message. In principle, all messages that have not passed the security check should be imported into the analyzer for analysis to calibrate their future path direction. This is considered to be the slowest path in this solution. It is not because the processing efficiency here is low. There are two reasons: for "attack messages", it can never reach the service on the user-mode network protocol stack side; for configuration messages, since they need to be processed and confirmed by the analyzer, the callback confirmation configuration of the service and behavior management on the user-mode network protocol stack is executed. The execution process is relatively "complex" and the timeliness requirement is not high.

[0106] Second, the middle path: when the analyzer does not consider that the information within its jurisdiction needs to be checked, the corresponding message will enter the kernel stack and confirm the next step of the message based on the filtering configuration of the kernel stack. Note that the "filtering configuration" here is still issued by the analyzer; this path is considered the second most efficient path in this solution because it needs to be filtered by the kernel stack and parsed and encapsulated by the kernel to form a socket on the application side, and the data transmission path is longer.

[0107] Third, the fast path: the DPDK driver of the business exchange is directly extracted to the user-mode network protocol stack. Because it reaches the user-mode network protocol stack directly without any other intermediate processing links, for the backend service, this data also uses the socket interface provided by the user-mode network protocol stack. Without the intermediate links, the message transmission efficiency of this path is the highest.

[0108] Next, we will analyze the actual transmission and application paths of configuration messages, other normal service messages, and attack messages based on the above three transmission paths for specific messages.

[0109] Configuration message: The configuration message here refers specifically to the configuration of "service and behavior management". Its final recipient can only be the service and behavior management module, and the following usage scenarios are available:

[0110] The server (i.e., the service and behavior management module) uses a TCP connection and a socket at port $PORT_MNG to receive messages. Assuming that the current client is connected to the local management switch module, the server creates a TCP connection and uses a socket at port $PORT_MNG, and sends data to the socket. Assuming that the sender MAC of the current management message is known, the management switch module has configured the MAC as a secure MAC, which can be directed to the kernel stack through switching. It should be noted that management messages refer to messages transmitted on the management channel. In addition to configuration messages, they may also be messages in other forms such as status and events. In other words, configuration messages are a subset of management messages.

[0111] Before entering the kernel stack, the analyzer uses the eBPF and XDP capabilities provided by the kernel to insert a hook in front of the kernel stack to check whether the information is credible. At this time, you can check whether the source address, destination address, and payload of the configuration message are compliant. At this time, you need to use the data registered with the analyzer by the service and behavior management module, and call related callbacks. This data complies with the configuration data behavior (it should be noted that it is not necessary and cannot be judged on the content of the entire payload. Only basic compliance checks are required to determine whether the source is legal. Judging the legitimacy of the source involves other levels of technology such as certificates, signature verification, etc., which are not related to this application, so they are not repeated).

[0112] There are many ways to determine whether a configuration message is legal. Here are a few examples:

[0113] A. The link layer determines that the MAC of the client connected to the local management is not within the range of known secure MACs. When the XDP hook intercepts it before entering the kernel stack, it can be determined and discarded directly to prevent illegal clients from trying to write configurations.

[0114] B. Certificate judgment: The client's MAC may not be within the known secure MAC range, but the device is just about to be deployed, and a means is needed to write at least the first secure MAC. If the MAC is no longer within the known range and the message itself does not have the agreed certificate features, the message is considered to be illegal and is discarded directly.

[0115] The results of the judgment are:

[0116] If the source is determined to be illegal, all packets from the source are blocked based on pre-set rules to avoid any subsequent processing and reduce consumption. Blocking methods include discarding using XDP and filtering MAC addresses using the netfilter provided by the kernel.

[0117] If the source is determined to be legitimate, the relevant data message is directly imported based on the RPC interface registered by the service and behavior management module, and the service and behavior management module performs the next processing, such as: the configuration information contains "new trusted client information, including MAC address, certificate, etc., support for new service (and port) opening, etc."

[0118] Normal messages for other services: Like configuration messages, other services also have protocol types and ports. The difference is that other services cannot "configure" themselves and can only be used directly. If a service port of the device is not opened through the configuration message described above, any message directed to the port will be directly discarded without being directed to the user-mode network protocol stack. Assuming that it is still a client connected to the upper port of the management switch module, this client has been configured as trusted. It accesses the "normal" message of the $SRV_PORT port service using the TCP protocol, and we have used the configuration message to inform the device that the service port needs to be opened.

[0119] The first message sent by the client to try to establish a connection will be sent to the kernel stack through the management switch module. Since the client has been configured to be trusted and the port has been configured as an open service, the kernel stack forwards the message directly to the user-mode network protocol stack.

[0120] When the user-mode network protocol stack receives the data, it establishes a connection and creates a socket to send data to the real service without exceeding the maximum number of connection instances allowed by the service. At the same time, it sends a message to the analyzer to inform that future related data flows will no longer pass through the kernel stack but will be directly imported into the user-mode network protocol stack, and to notify the business exchange that future message packets will be directly extracted to the user-mode network protocol stack; then, the service formally establishes a connection, and related message packets will be sent out from the user-mode network protocol stack through the business exchange, and subsequent messages will no longer pass through the kernel stack. In this case, a more efficient and secure connection establishment process is achieved.

[0121] Attack message: There are many types of attacks, and here are some common examples.

[0122] DDoS attacks usually involve multiple clients sending connection requests to the server intensively for a long period of time, causing the server to be overwhelmed with invalid connection requests and unable to provide services to legitimate connections. In this case, there may be a large number of connection request messages using different MAC addresses input. In the management switch module, since they are not marked as known trusted clients, the relevant data will not pass through the kernel stack but will be directly discarded.

[0123] Assuming that the DDoS message is sent through a legitimate MAC address, it can reach the user-mode network protocol stack through path two through the kernel stack. At this time, the user-mode network protocol stack can manage the service by limiting the number of connections with the same MAC address, thereby limiting the establishment of formal connections. Therefore, the relevant message stays at the stage where it can reach path two and cannot reach path three. The connection capacity will not be consumed because the DDoS attacker has guessed the legitimate MAC address.

[0124] To sum up, this embodiment can maximize the use of the processing capabilities of the switching chip, business chip and central processing unit within the device without causing any impact on the connection establishment process of the information flow, achieve higher processing efficiency with minimum consumption, and provide the highest security features, thereby reducing the possibility of the entire device being interrupted due to security threats.

[0125] Embodiment 4:

[0126] Based on the method for providing a firewall function for a user-mode network protocol stack provided in the above embodiment 1, the present invention also provides a device for providing a firewall function for a user-mode network protocol stack that can be used to implement the above method and system, such as Fig. 9 , which is a schematic diagram of the device architecture of an embodiment of the present invention. The device of this embodiment that provides a firewall function for a user-mode network protocol stack includes one or more processors 21 and a memory 22. Fig. 9 A processor 21 is taken as an example.

[0127] The processor 21 and the memory 22 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0128] The memory 22, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the method for providing a firewall function for a user-mode network protocol stack in Example 1. The processor 21 executes various functional applications and data processing of the device for providing a firewall function for a user-mode network protocol stack by running the non-volatile software programs, instructions and modules stored in the memory 22, that is, the method for providing a firewall function for a user-mode network protocol stack in Example 1 is implemented.

[0129] The memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 22 may optionally include a memory remotely arranged relative to the processor 21, and these remote memories may be connected to the processor 21 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] The program instructions / modules are stored in the memory 22. When executed by one or more processors 21, the method for providing a firewall function for a user-mode network protocol stack in the above-mentioned embodiment 1 is executed. For example, the method described above is executed. Figure 1-Figure 4 The steps shown.

[0131] A person skilled in the art may understand that all or part of the steps in the various methods of the embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0132] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention. The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

Claims

1. A method for providing a firewall function for a user-mode network protocol stack, It is characterized in that include: Use a switching chip with the ability to forward and filter Layer 2 link messages as the front-end management switching module to distribute data messages based on MAC layer information; An analyzer is used to extract and analyze the messages directed to the kernel stack by the management switch module to determine whether to discard these messages or continue to pass them downstream. Determine whether the message entering the kernel stack is of known type and filter it; Messages are sent and received based on the user-mode network protocol stack, and the user-mode network protocol stack itself performs checks; For messages imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, and registers the corresponding information with the analyzer based on the processing results to affect how future messages arrive at the user-mode network protocol stack.

2. The method for providing a firewall function for a user-mode network protocol stack according to claim 1, It is characterized in that The data packets input to the management switch module can be input in the following ways: When serving as the first station, the external port of the management switch module of this station is directly connected to the northbound management terminal, and all data messages are management messages; When not serving as the first station, the management switching module of this station is connected to the mirror output port of the business processing chip. The data packets include management packets accompanying the business, and some business packets are also allowed to be processed by the firewall of this station.

3. The method for providing a firewall function for a user-mode network protocol stack according to claim 1, It is characterized in that The extracting and analyzing of the message directed to the kernel stack by the management switch module by the analyzer to determine whether to discard the message or continue to transmit it downstream specifically includes: Messages that fail the security check are directly discarded. For messages that pass the security setting check and belong to special management configuration, the callback interface registered by the service and behavior management module on the user-mode network protocol stack to the analyzer at startup is executed to add relevant configurations; the specific configurations include: the message path settings of the management switching module and the filtering behavior of the kernel stack; For messages that have passed the security setting check and the firewall is temporarily unable to determine whether they are security types, the firewall does not perform any action on such messages. At this time, the relevant data messages can pass through the kernel protocol stack to the user-mode network protocol stack.

4. The method for providing a firewall function for a user-mode network protocol stack according to claim 3, It is characterized in that The messages that fail the security setting check specifically include one or more of messages with mismatched MAC addresses, messages with the same MAC initiating the same connection establishment request multiple times, and messages with the same MAC frequently initiating multiple connection attempt requests but repeatedly failing the key verification link required by the backend.

5. The method for providing a firewall function for a user-mode network protocol stack according to claim 3, It is characterized in that The determining whether the message entering the kernel stack is of a known type and filtering the message specifically includes: For unknown type messages, they are considered unsafe and discarded directly; For known types of messages, their security is temporarily recognized and handed over to downstream links for inspection; For known type messages, if the downstream link finds that there is attack behavior after inspection, the relevant action is executed. The relevant action is handed over to the analyzer for processing through the analyzer's callback method.

6. The method for providing a firewall function for a user-mode network protocol stack according to claim 5, It is characterized in that The sending and receiving of messages based on the user-mode network protocol stack, and the checking by the user-mode network protocol stack itself specifically includes: The user-mode network protocol stack provides an encapsulated user-mode network protocol stack socket to the application layer, and the user-mode network protocol stack socket can simultaneously receive data coming through the kernel stack, or directly use the data obtained by the service exchange DMA channel; When the user-mode network protocol stack receives data from the kernel stack, it determines whether a connection has been established. If not, it establishes a connection, generates a user-mode network protocol stack socket, and starts the corresponding service through the service and behavior management module.

7. The method for providing a firewall function for a user-mode network protocol stack according to claim 6, It is characterized in that When determining whether a connection has been established, if a connection has been established, the message will not enter the user mode network protocol stack from the kernel stack.

8. The method for providing a firewall function for a user-mode network protocol stack according to claim 6, It is characterized in that For the message imported into the service and behavior management module, the service and behavior management module determines how to start the service based on the source of the message, specifically including: The packets from the analyzer are divided into valid configuration packets and invalid configuration packets, and new filtering behavior configuration is provided for the configuration packets; For the message from the kernel stack, if it is a new connection message, a connection instance is established according to the allowed number of connections; if the message from the kernel stack is not a new connection message, it is determined to be an abnormal message with attack behavior, and the features are directly extracted and handed over to the analyzer for corresponding filtering. Future related messages are directly discarded at the hook before the analyzer actually processes the message to the kernel stack through XDP; For the messages extracted from the business exchange, normally only the messages of the established connection can be used directly; if they are not the messages of the established connection, they are judged as attack messages and are discarded directly.

9. The method for providing a firewall function for a user-mode network protocol stack according to any one of claims 1 to 8, It is characterized in that The message delivery path includes: The messages that have passed through the analyzer are compared by the analyzer to confirm the legitimacy and security of the messages. All messages that have not passed the security check should be first imported into the analyzer for analysis to determine their future path direction; When the analyzer does not consider that the message information needs to be checked within its jurisdiction, the corresponding message will enter the kernel stack and determine the next direction of the message based on the filter configuration of the kernel stack; The DPDK-style driver for business exchange is directly extracted to the user-mode network protocol stack.

10. A system for providing firewall functionality for a user-mode network protocol stack, It is characterized in that It includes a firewall, a user-mode network protocol stack, and a service and behavior management module. The firewall includes a management switch module, an analyzer, and a kernel stack, wherein: The management switching module is used to provide forwarding and filtering capabilities based on layer 2 link messages, and distribute data messages based on MAC layer information; The analyzer is used to extract and analyze the messages directed to the kernel stack by the management switch module to determine whether to discard these messages or continue to transmit them downstream; The kernel stack is used to determine whether the message is of a known type and perform filtering processing; The user-mode network protocol stack is used to perform an application layer filtering mechanism check on the messages arriving at itself; The service and behavior management module runs based on the user-mode network protocol stack, and is used to determine how to start the service according to the source of the message, and register corresponding information with the analyzer according to the processing result, so as to affect how future messages arrive at the user-mode network protocol stack.

Images