A Netty-based SDP dynamic firewall cluster implementation method and system

Abstract

The present application proposes a method and system for implementing an SDP dynamic firewall cluster based on Netty. The method includes the following steps: S1, starting the SDP cluster node service, and starting the Netty server of the SDP cluster node to listen, the SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server; S2, starting the Netty client, the Netty client connects to the Netty server of the cluster node according to the node IP address and the listening port number of the Netty server; and S3, after the Netty client successfully connects to the Netty server, activating the Channel channel, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel, and the Netty server receives and dynamically controls the firewall. The present invention is based on the SDP dynamic firewall cluster implementation of Netty technology. Under the SDP dynamic firewall cluster implementation, it has the advantages of lower latency, less resource consumption, and flexible and scalable.

Description

Technical Field

[0001] The present application relates to the technical field of SDP dynamic firewall cluster implementation, and specifically to a Netty-based SDP dynamic firewall cluster implementation method and system. Background Art

[0002] Implementing SDP dynamic firewall clusters over HTTP is a common solution, however, this approach suffers from higher latency. Because HTTP is a short-lived connection and relies on connection-oriented TCP for message transmission, each connection establishment requires a handshake, increasing latency and reducing the timeliness of SDP dynamic firewall clusters.

[0003] Netty is an asynchronous event-driven network application framework. It is used for rapid development of maintainable, high-performance protocol servers and clients. Netty is a NIO client-server framework that enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming, such as TCP and UDP socket servers.

[0004] In view of this, the present invention proposes a Netty-based SDP dynamic firewall cluster implementation method and system with low latency, low resource loss and high flexibility. Summary of the Invention

[0005] In order to solve the problem that the existing HTTP-based approach to SDP dynamic firewall cluster implementation has higher latency and other problems, the present application provides a Netty-based SDP dynamic firewall cluster implementation method and system to solve the above technical defects.

[0006] According to one aspect of the present invention, a method for implementing a Netty-based SDP dynamic firewall cluster is proposed, the method comprising the following steps:

[0007] S1. Start the SDP cluster node service and start the Netty server of the SDP cluster node for listening. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server.

[0008] S2. Start the Netty client, which connects to the Netty server of the cluster node based on the node IP and the listening port number of the Netty server; and

[0009] After S3 and the Netty client successfully connect to the Netty server, the Channel is activated. The Netty client synchronizes the local firewall information to the Netty server through the Channel. The Netty server receives and dynamically controls the firewall.

[0010] In a specific embodiment, in step S3, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel. The Netty server receives and dynamically controls the firewall, which specifically includes the following sub-steps:

[0011] S31. The Netty client serializes the firewall open information maintained by the cluster node and writes it to the Channel channel to synchronize it to the Netty server; and

[0012] S32. The Netty server deserializes the message to obtain the firewall opening information, and replays and dynamically controls the firewall based on the firewall opening information.

[0013] In a specific embodiment, in step S3, after the Netty client successfully connects to the Netty server, the Netty client maintains all Channel channels that are successfully connected to the Netty server.

[0014] In a specific embodiment, after the SDP cluster node service receives the SDP client knocking data packet and the authentication is successful, the SDP cluster node service opens the knocking client IP and dynamically opens the firewall port under the current SDP server.

[0015] In a specific embodiment, after the firewall is successfully opened, the Netty client of the SDP cluster node writes the firewall opening information into the Channel of step S3, and the SDP cluster Netty server listens to and reads the firewall opening information of the Channel to dynamically control the firewall of the server where it is located, thereby realizing the SDP cluster dynamic firewall.

[0016] In a specific embodiment, step S1 further includes: starting the SDP cluster node service, and starting the Netty server of the SDP cluster node for monitoring, opening the select polling mechanism, monitoring receiving, reading, and writing events, and processing pipeline services.

[0017] In the second aspect, the present application provides a Netty-based SDP dynamic firewall cluster implementation system, the system comprising:

[0018] Start the module, start the SDP cluster node service, and start the Netty server of the SDP cluster node for listening. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server.

[0019] The connection module starts the Netty client, which connects to the Netty server of the cluster node based on the node IP and the listening port number of the Netty server; and

[0020] Dynamic control module: After the Netty client successfully connects to the Netty server, the Channel is activated. The Netty client synchronizes the local firewall information to the Netty server through the Channel. The Netty server receives and dynamically controls the firewall.

[0021] In a specific embodiment, in the dynamic control module, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel, and the Netty server receives and dynamically controls the firewall, specifically including the following sub-steps:

[0022] S31. The Netty client serializes the firewall open information maintained by the cluster node and writes it to the Channel channel to synchronize it to the Netty server; and

[0023] S32. The Netty server deserializes the message to obtain the firewall opening information, and replays and dynamically controls the firewall based on the firewall opening information.

[0024] In a specific embodiment, in the dynamic control module, after the Netty client successfully connects to the Netty server, the Netty client maintains all Channel channels that are successfully connected to the Netty server.

[0025] In a third aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, any of the above methods is implemented.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] The present invention connects the Netty server of other service nodes through the Netty client of the SDP cluster. When the client knocks on the door, the SDP service performs single-packet authorization after receiving the knock data packet, and performs firewall control on the server where the current SDP service is located. At the same time, all firewalls of the cluster are dynamically controlled through the Netty channel established by the cluster. That is, the present invention is based on the SDP dynamic firewall cluster implementation of Netty technology. Under the SDP dynamic firewall cluster implementation, it has the advantages of lower latency, less resource consumption, and flexible and scalable. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Other features, objects and advantages of the present application will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0029] Figure 1It is a flowchart of the Netty-based SDP dynamic firewall cluster implementation method according to the present application;

[0030] Figure 2 This is a schematic diagram of the main framework of the Netty-based SDP dynamic firewall cluster implementation method according to the present application;

[0031] Figure 3 This is a schematic diagram of a Netty-based SDP dynamic firewall cluster implementation system according to the present application;

[0032] Figure 4 It is a structural diagram of a computer system suitable for implementing the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0034] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0035] Figure 1 The flowchart of the Netty-based SDP dynamic firewall cluster implementation method of this application is shown in Figure 1. Figure 1 The method comprises the following steps:

[0036] S1. Start the SDP cluster node service and start the Netty server of the SDP cluster node for listening. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server.

[0037] In this embodiment, after the SDP cluster node service is started, the Netty server of the SDP cluster node is started to monitor, the select polling mechanism is turned on, the receiving, reading and writing events are monitored, and the pipeline business is processed.

[0038] S2. Start the Netty client. The Netty client connects to the Netty server of the cluster node based on the node IP and the listening port number of the Netty server.

[0039] Figure 2 The main framework diagram of the Netty-based SDP dynamic firewall cluster implementation method according to this application is shown in Figure 2. Figure 1 and Figure 2For example, if SDP cluster node 1 (server 1) starts the Netty server listener, the Netty client of SDP cluster node 2 (server 2) connects to the Netty server of SDP cluster node 1 (server 1), and the Netty client of SDP cluster node 3 (server 3) connects to the Netty server of SDP cluster node 1 (server 1). In other words, the Netty client of each SDP cluster service node will establish a connection with the Netty server of each other node.

[0040] Continue to refer Figure 1 , further comprising step S3, after the Netty client is successfully connected to the Netty server, activating the Channel channel, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel, and the Netty server receives and dynamically controls the firewall.

[0041] In this embodiment, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel. The Netty server receives and dynamically controls the firewall, specifically including the following sub-steps:

[0042] S31. The Netty client serializes the firewall open information maintained by the cluster node and writes it to the Channel channel to synchronize it to the Netty server; and

[0043] S32. The Netty server deserializes the message to obtain the firewall opening information, and replays and dynamically controls the firewall based on the firewall opening information.

[0044] Moreover, after the Netty client successfully connects to the Netty server, the Netty client maintains all Channel channels that are successfully connected to the Netty server.

[0045] When the SDP cluster node service receives the SDP client's knock packet and successfully authenticates it, it opens the knocking client's IP address and dynamically opens the firewall port on the current SDP server. After the firewall is successfully opened, the Netty client on the SDP cluster node writes the firewall opening information to all successfully connected channels maintained in step S3. The SDP cluster Netty server listens for and reads the firewall opening information from the channel to dynamically control the firewall on the server, implementing a dynamic firewall for the SDP cluster.

[0046] Netty's design is carefully crafted based on the experience gained from implementing many protocols such as FTP, SMTP, HTTP, and various binary and text-based legacy protocols. Netty successfully finds ways to achieve ease of development, performance, stability, and flexibility without any compromise. Netty has the following features: at the design level: it provides a unified API that supports multiple transmission types, both blocking and non-blocking; a simple and powerful threading model; based on a flexible and extensible event model, it can clearly separate concerns 4. True connectionless datagram socket support. At the usage level: there are very complete Javadoc documents and rich example codes as reference; no other dependencies are required, JDK5 (Netty3.0) or JDK6 (Netty4.0) is sufficient. At the performance level: it has higher throughput and lower latency than JAVA's core API; it has lower resource consumption; and it minimizes unnecessary memory copying. At the security level: it has complete SSL / TLS and StartTLS support.

[0047] The present invention connects the Netty server of other service nodes through the Netty client of the SDP cluster. When the client knocks on the door, the SDP service performs single-packet authorization after receiving the knock data packet, and performs firewall control on the server where the current SDP service is located. At the same time, all firewalls of the cluster are dynamically controlled through the Netty channel established by the cluster. That is, the present invention is based on the SDP dynamic firewall cluster implementation of Netty technology. Under the SDP dynamic firewall cluster implementation, it has the advantages of lower latency, less resource consumption, and flexible and scalable.

[0048] Further references Figure 3 As an implementation of the above method, this application provides an embodiment of a Netty-based SDP dynamic firewall cluster implementation system. Figure 1 Corresponding to the method embodiment shown, the system can be specifically applied to various electronic devices. The system 300 includes the following modules:

[0049] Start module 310, start the SDP cluster node service, and start the Netty server of the SDP cluster node to listen. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server;

[0050] The connection module 320 starts the Netty client, and the Netty client connects to the Netty server of the cluster node according to the node IP and the listening port number of the Netty server; and

[0051] Dynamic control module 330, after the Netty client successfully connects to the Netty server, activates the Channel channel, and the Netty client synchronizes the local firewall information to the Netty server through the Channel channel. The Netty server receives and dynamically controls the firewall.

[0052] In a specific embodiment, in the dynamic control module, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel, and the Netty server receives and dynamically controls the firewall, specifically including the following sub-steps:

[0053] S31. The Netty client serializes the firewall open information maintained by the cluster node and writes it to the Channel channel to synchronize it to the Netty server; and

[0054] S32. The Netty server deserializes the message to obtain firewall open information and replays and dynamically controls the firewall based on the firewall open information. Furthermore, after the Netty client successfully connects to the Netty server, the Netty client maintains all channels that have successfully connected to the Netty server.

[0055] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements any of the above methods.

[0056] Reference below Figure 4 , which shows a structural diagram of a computer system 400 suitable for implementing a terminal device or server of an embodiment of the present application. Figure 4 The terminal device or server shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0057] like Figure 4 As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage unit 408 into a random access memory (RAM) 403. Various programs and data required for the operation of the system 400 are also stored in the RAM 403. The CPU 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0058] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, and the like; an output section 407 including a liquid crystal display (LCD), a speaker, and the like; a storage section 408 including a hard disk and the like; and a communication section 409 including a network interface card such as a LAN card or a modem. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 410 as needed, so that a computer program read therefrom can be installed into the storage section 408 as needed.

[0059] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the central processing unit (CPU) 401, the above-mentioned functions defined in the method of the present application are executed. It should be noted that the computer-readable medium described in the present application can be a computer-readable signal medium or a computer-readable medium or any combination of the above two. The computer-readable medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wire, optical cable, RF, or any suitable combination thereof.

[0060] Computer program code for performing the operations of the present application can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0061] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0062] The modules involved in the embodiments of the present application may be implemented in software or in hardware. The units described may also be provided in a processor. For example, they may be described as follows: a processor includes a receiving module, an acquisition module, a determination module, a calculation module, and a generation module. The names of these units do not, in some cases, constitute limitations on the units themselves. For example, the receiving unit may also be described as a "module that obtains preset, target user configuration information in response to determining that the verification request information includes a user name, a request time, a user signature code, and a client application code."

[0063] As another aspect, the present application also provides a computer-readable medium, which may be included in the server described in the above embodiment; or may exist independently and not be assembled into the server. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the server, the server: receives a verification request message sent by a client of a target user; in response to determining that the verification request message includes a user name, a request time, a user signature code, and a client application code, obtains preset configuration information of the target user, wherein the configuration information includes a preset user password corresponding to the user name; determines whether the verification request message is valid based on the request time, and in response to determining that it is valid, determines whether a preset storage area includes a user signature code; in response to determining that it is not included, stores the user signature code in a preset storage area, and calculates a server application code based on the user password, the request time, and the user signature code; in response to determining that the server application code matches the client application code, generates verification success information for indicating that the verification request is a legitimate request.

[0064] In addition, the computer-readable medium may be included in the terminal device described in the above embodiment, or may exist independently without being incorporated into the terminal device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the terminal device, the terminal device: obtains user information input by the target user, wherein the user information includes a user name and a user password; generates a user signature code representing the target user based on the user information; determines a request time; calculates a client application code based on the user password, the request time, and the user signature code; generates verification request information including the user name, the request time, the user signature code, and the client application code; and sends the verification request information to the server.

[0065] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for implementing an SDP dynamic firewall cluster based on Netty, characterized in that: The following steps are involved: S1. Start the SDP cluster node service and start the Netty server of the SDP cluster node for monitoring. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server. S2. Start the Netty client, which connects to the Netty server of the cluster node according to the node IP and the listening port number of the Netty server; and S3. After the Netty client successfully connects to the Netty server, a Channel is activated. The Netty client synchronizes the local firewall information to the Netty server through the Channel. The Netty server receives and dynamically controls the firewall. It includes the following sub-steps: S31, the Netty client serializes the firewall opening information maintained by the cluster node, writes it into the Channel channel and synchronizes it to the Netty server; and S32. The Netty server deserializes the message to obtain firewall opening information, and replays and dynamically controls the firewall according to the firewall opening information.

2. The method for implementing a Netty-based SDP dynamic firewall cluster according to claim 1, wherein: In step S3, after the Netty client successfully connects to the Netty server, the Netty client maintains all Channels that are successfully connected to the Netty server.

3. The method for implementing a Netty-based SDP dynamic firewall cluster according to claim 1, wherein: After the SDP cluster node service receives the SDP client knocking data packet and the authentication is successful, the SDP cluster node service opens the knocking client IP and dynamically opens the firewall port under the current SDP server.

4. The method for implementing a Netty-based SDP dynamic firewall cluster according to claim 3, wherein: After the firewall is successfully opened, the Netty client of the SDP cluster node writes the firewall opening information into the Channel of step S3. The SDP cluster Netty server listens to and reads the firewall opening information of the Channel to dynamically control the firewall of the server where it is located, thereby realizing the SDP cluster dynamic firewall.

5. The method for implementing a Netty-based SDP dynamic firewall cluster according to claim 1, wherein: Step S1 also includes: starting the SDP cluster node service, and starting the Netty server of the SDP cluster node to monitor, opening the select polling mechanism, monitoring the receiving, reading, and writing events, and processing the pipeline business.

6. A Netty-based SDP dynamic firewall cluster implementation system, characterized in that: The system comprises: Start the module, start the SDP cluster node service, and start the Netty server of the SDP cluster node for listening. The SDP cluster node service obtains the IP addresses of other nodes in the cluster and the listening port number of the Netty server; A connection module starts a Netty client, and the Netty client connects to the Netty server of the cluster node according to the node IP and the listening port number of the Netty server; and Dynamic control module, after the Netty client successfully connects to the Netty server, activates the Channel channel, the Netty client synchronizes the local firewall information to the Netty server through the Channel channel, and the Netty server receives and dynamically controls the firewall; It includes the following sub-steps: S31, the Netty client serializes the firewall opening information maintained by the cluster node, writes it into the Channel channel and synchronizes it to the Netty server; and S32. The Netty server deserializes the message to obtain firewall opening information, and replays and dynamically controls the firewall according to the firewall opening information.

7. The Netty-based SDP dynamic firewall cluster implementation system according to claim 6, characterized in that: In the dynamic control module, after the Netty client successfully connects to the Netty server, the Netty client maintains all Channel channels that are successfully connected to the Netty server.

8. A computer-readable storage medium, wherein a computer program is stored in the medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images