Firewall configuration method and apparatus based on proxy service component

Abstract

The present disclosure relates to a firewall configuration method and device based on a proxy service component, an electronic device and a computer readable medium. The method comprises: obtaining a firewall configuration request from a user; storing configuration data in the firewall configuration request in a preset area; forwarding the firewall configuration request to a proxy service component through a message middleware; the proxy service component calls an interface of the firewall according to the firewall configuration request; and issuing the firewall configuration based on the firewall interface. The firewall configuration method and device based on the proxy service component, the electronic device and the computer readable medium can separate the front-end and back-end processing mechanisms of the firewall configuration request, and solve the problems of slow issuing time and inconsistent data between the front-end and back-end when multiple firewall configurations are simultaneously optimized.

Description

Technical Field

[0001] This disclosure relates to the field of computer information processing, and more specifically, to a firewall configuration method, apparatus, electronic device, and computer-readable medium based on a proxy service component. Background Technology

[0002] When configuring a firewall, the service process agent service component (dptech-agent) is generally used. dptech-agent runs on the OpenStack network control node. Neutron-server passes the received user HTTP requests to dptech-agent through rabbitmq-server. dptech-agent then distributes the firewall's services.

[0003] In existing technologies, the dptech-agent service is installed on the OpenStack control node and works in conjunction with OpenStack's native Neutron-server service. The message processing flow is roughly as follows: the request first goes to the Neutron-server via the OpenStack command line or CLI, then is passed to the dptech-agent via the message middleware RabbitMQ, and then the dptech-agent passes it to the firewall device via the device's RESTful interface.

[0004] The existing implementation executes requests in the order of neutron-server, rabbitmq, dptech-agent, and firewall device, and then waits for the response. The request is passed through these three components sequentially, which likely results in a long response time, giving the user a feeling of slowness. Furthermore, with so many components involved, unexpected events can occur at each stage, leading to inconsistencies between the front-end and back-end data in case of exceptions.

[0005] Therefore, there is a need for a new firewall configuration method, apparatus, electronic device, and computer-readable medium based on proxy service components.

[0006] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0007] In view of this, this application provides a firewall configuration method, apparatus, electronic device and computer-readable medium based on a proxy service component, which can separate the firewall configuration request processing mechanism between the front end and the back end, and solve the problems of slow distribution time and inconsistent data between the front end and the back end when optimizing multiple firewall configurations at the same time.

[0008] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0009] According to one aspect of this application, a firewall configuration method based on a proxy service component is proposed. The method includes: obtaining a firewall configuration request from a user; storing the configuration data in the firewall configuration request in a preset area; forwarding the firewall configuration request to a proxy service component through a message middleware; the proxy service component calling a firewall interface according to the firewall configuration request; and distributing firewall configuration based on the firewall interface.

[0010] In one exemplary embodiment of this application, before obtaining a firewall configuration request from a user, the process includes: the user inputting firewall configuration data at the front end of the cloud platform; and generating the firewall configuration request based on the firewall configuration data.

[0011] In one exemplary embodiment of this application, obtaining a firewall configuration request from a user includes: the neutron-server service component obtaining the firewall configuration request.

[0012] In one exemplary embodiment of this application, storing the configuration data in the firewall configuration request in a preset area includes: storing the configuration data in the firewall configuration request in a preset data temporary storage area; and clearing the front-end page data of the cloud platform.

[0013] In one exemplary embodiment of this application, forwarding the firewall configuration request to the proxy service component via a message middleware includes: asynchronously processing the firewall configuration request via a RabbitMQ message middleware to forward it to the proxy service component.

[0014] In one exemplary embodiment of this application, the proxy service component invokes the firewall's interface according to the firewall configuration request, including: determining the type of firewall configuration data in the firewall configuration request; and the proxy service component invoking the firewall's interface according to the type of firewall configuration data.

[0015] In one exemplary embodiment of this application, the distribution of firewall configuration based on the firewall interface includes: distributing one or more firewall configuration data based on the firewall interface; returning a configuration success message when one or more firewall configuration data are successfully configured; and returning a configuration failure message when any firewall configuration data is not successfully configured.

[0016] In one exemplary embodiment of this application, the method further includes: after the firewall is successfully configured, the proxy service component obtains a configuration success message; the proxy service component transmits the configuration success message to the neutron-server service component; the neutron-server service component writes the configuration data in the preset area into the database; and the configuration data in the database is displayed on the front end.

[0017] In one exemplary embodiment of this application, the method further includes: after the firewall configuration fails, the proxy service component obtains a configuration failure message; the proxy service component transmits the configuration failure message to the neutron-server service component; and the neutron-server service component clears the configuration data in the preset area.

[0018] According to one aspect of this application, a firewall configuration device based on a proxy service component is proposed. The device includes: a request module for obtaining a firewall configuration request from a user; a storage module for storing configuration data in the firewall configuration request in a preset area; a forwarding module for forwarding the firewall configuration request to the proxy service component through a message middleware; an invocation module for the proxy service component to invoke the firewall's interface according to the firewall configuration request; and a distribution module for distributing the firewall configuration based on the firewall interface.

[0019] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0020] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0021] According to the firewall configuration method, apparatus, electronic device, and computer-readable medium based on a proxy service component of this application, the firewall configuration request is obtained from the user; the configuration data in the firewall configuration request is stored in a preset area; the firewall configuration request is forwarded to the proxy service component through a message middleware; the proxy service component calls the firewall interface according to the firewall configuration request; and the firewall configuration is distributed based on the firewall interface. This method can separate the firewall configuration request processing mechanism from the front-end and back-end, solving the problems of slow distribution time and data inconsistency between the front-end and back-end when optimizing multiple firewall configurations at the same time.

[0022] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0023] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0024] Figure 1 This is a system block diagram illustrating a firewall configuration method and apparatus based on a proxy service component, according to an exemplary embodiment.

[0025] Figure 2 This is a flowchart illustrating a firewall configuration method based on a proxy service component according to an exemplary embodiment.

[0026] Figure 3 This is a flowchart illustrating a firewall configuration method based on a proxy service component according to another exemplary embodiment.

[0027] Figure 4 This is a flowchart illustrating a firewall configuration method based on a proxy service component according to another exemplary embodiment.

[0028] Figure 5 This is a block diagram illustrating a firewall configuration apparatus based on a proxy service component according to an exemplary embodiment.

[0029] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0030] Figure 7 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0031] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0032] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0035] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0036] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0037] The technical abbreviations used in this application are explained as follows:

[0038] neutron-server is one of the core components of Neutron, responsible for directly accepting external requests (including CLIAPI, REST API, etc.) and then scheduling the corresponding backend plugins for processing. Neutron has only one main service process, neutron-server, which runs on the network control node and provides the RESTful API as the entry point for accessing Neutron. User HTTP requests received by Neutron-server are ultimately handled by various agents distributed across compute and network nodes.

[0039] OpenStack is a cloud platform management project, not a software application. It allows you to manage large pools of resources in a data center. It comprises many sub-projects. OpenStack's primary goal is to simplify resource management and allocation by virtualizing compute, network, and storage into three main resource pools and providing APIs for interaction.

[0040] Figure 1 This is a system block diagram illustrating a firewall configuration method and apparatus based on a proxy service component, according to an exemplary embodiment.

[0041] like Figure 1 As shown, system architecture 10 may include terminal devices 101, 102, and 103, network 104, server 105, and firewalls 106, 107, and 108. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105; and between server 105 and firewalls 106, 107, and 108. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0042] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send firewall configuration data, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as firewall configuration applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0043] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0044] Server 105 can be a server that provides various services, such as a backend server that provides data support to the firewalls configured by users using terminal devices 101, 102, and 103. The backend server can process the received firewall configuration requests and send the processing results (firewall configuration success message or firewall configuration failure message) back to the terminal devices.

[0045] Server 105 may, for example, obtain a firewall configuration request from a user; server 105 may, for example, store the configuration data in the firewall configuration request in a preset area; server 105 may, for example, forward the firewall configuration request to a proxy service component through a message middleware; the proxy service component in server 105 may, for example, call the firewall interface according to the firewall configuration request; server 105 may, for example, distribute firewall configuration based on the firewall interface.

[0046] Server 105 can be a single physical server, or it can be composed of multiple servers. It should be noted that the firewall configuration method based on the proxy service component provided in this application embodiment can be executed by server 105. Correspondingly, the firewall configuration device based on the proxy service component can be set in server 105.

[0047] Figure 2 This is a flowchart illustrating a firewall configuration method based on a proxy service component according to an exemplary embodiment. The firewall configuration method 20 based on a proxy service component includes at least steps S202 to S210.

[0048] like Figure 2 As shown, in S202, a firewall configuration request from the user is obtained. For example, the neutron-server service component obtains this firewall configuration request. The cloud platform requests the request to neutron-server via a web page or command line.

[0049] In one embodiment, before obtaining a firewall configuration request from a user, the process includes: the user inputting firewall configuration data at the front end of the cloud platform; and generating the firewall configuration request based on the firewall configuration data. Normally, the neutron-server stores the data in the neutron database, which is then perceived by the client's page and throughout the overall process. This can easily lead to data inconsistencies between the front end and back end due to interruptions in subsequent stages of the request. Furthermore, the client cannot promptly perceive the data inconsistency, creating potential risks for future failures.

[0050] In step S204, the configuration data from the firewall configuration request is stored in a preset area. Alternatively, the configuration data from the firewall configuration request can be stored in a preset temporary data storage area; the front-end page data of the cloud platform is then cleared.

[0051] When a request arrives at the neutron-server, the requested data is first placed in the data staging area without being written to the database. At this time, the front-end page is empty, but the client perceives the request as completed and does not need to pay attention to the subsequent processing flow. Other requests can continue to be sent, achieving asynchronous request and data processing and separation between the front-end and the back-end.

[0052] In S206, the firewall configuration request is forwarded to the proxy service component via a message middleware. The firewall configuration request can be processed asynchronously and forwarded to the proxy service component via RabbitMQ message middleware.

[0053] After the data is placed in the temporary storage area, the front end can send other requests normally without being aware of the back end processing flow. This request is then passed to the dptech-agent component through the RabbitMQ message middleware. After receiving the request, dptech-agent determines the request type and calls the corresponding RESTful interface of the firewall device to configure and distribute the firewall device.

[0054] In S208, the proxy service component invokes the firewall's interface based on the firewall configuration request. The type of firewall configuration data in the firewall configuration request can be determined; the proxy service component invokes the firewall's interface based on the type of firewall configuration data.

[0055] In S210, firewall configuration is distributed based on the firewall interface. One or more firewall configuration data can be distributed based on the firewall interface; if one or more firewall configuration data are successfully configured, a configuration success message is returned; if any firewall configuration data fails to be configured, a configuration failure message is returned.

[0056] Different request types may correspond to different response methods. If the request only needs to send one configuration to the device, such as a virtual system, then the return success is determined by receiving the success status code of this message. If the request only needs to send multiple configurations to the device, such as packet filtering, address objects, service objects, etc., then the return success is determined by receiving the success status codes of all RESTful requests. Only when all requests return success is the overall request considered successful.

[0057] The failure determination principle is that if a request fails, it is considered a failure. However, for the mechanism of this solution, if a failure is determined, the request needs to be resent. In cases where multiple configurations need to be sent to the device, some configurations may be sent successfully, such as address objects, while packet filtering may fail to be sent due to network or other reasons. In such cases, the request is considered a failure. However, when resending the request, the address object may already exist. If the RESTful interface returns that the address object already exists, it needs to be determined that the configuration was sent successfully. Otherwise, the request will never be able to be sent normally.

[0058] According to the firewall configuration method based on a proxy service component of this application, the firewall configuration request from the user is obtained; the configuration data in the firewall configuration request is stored in a preset area; the firewall configuration request is forwarded to the proxy service component through a message middleware; the proxy service component calls the firewall interface according to the firewall configuration request; and the firewall configuration is distributed based on the firewall interface. This method can separate the firewall configuration request processing mechanism from the front-end and back-end, and solve the problems of slow distribution time and data inconsistency between the front-end and back-end when optimizing multiple firewall configurations at the same time.

[0059] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0060] Figure 3 This is a flowchart illustrating a firewall configuration method based on a proxy service component according to another exemplary embodiment. Figure 3 The process shown in step 30 is... Figure 2 Supplementary description of the process shown.

[0061] like Figure 3 As shown, in S302, firewall configuration is distributed based on the firewall interface.

[0062] In S304, after the firewall is successfully configured, the proxy service component receives a configuration success message.

[0063] In S306, the proxy service component transmits the configuration success message to the neutron-server service component; the neutron-server service component writes the configuration data in the preset area into the database; the configuration data in the database is displayed on the front end.

[0064] If the firewall configuration is successfully distributed, a success message is returned to the dptech-agent component. This message is then transmitted back to the neutron-server via RabbitMQ. Upon receiving the success message, the neutron-server writes the data in the temporary storage area to the neutron database. Once the database contains content, the data displayed on the page will be normal, and the overall request distribution will be successful.

[0065] In S308, after a firewall configuration failure, the proxy service component receives a configuration failure message.

[0066] In S310, the proxy service component transmits the configuration failure message to the neutron-server service component; the neutron-server service component clears the configuration data in the preset area, and the front end does not display any data.

[0067] If the firewall configuration fails to be distributed, the failure message is returned to the dptech-agent component. This message is then passed back to the neutron-server via RabbitMQ. Upon receiving the failure message, the neutron-server clears the data in the temporary storage area, leaving the page data blank and returning a failure message.

[0068] If a request fails to be sent, or if a successfully sent request fails to be properly responded to the neutron-server due to network anomalies or other reasons, the temporary storage area will be judged as failed based on the timeout period. In this case, the cloud platform will not write to the database, and the cloud platform will not have any data. The request needs to be resent. The technology in this application can guarantee that if there is data inconsistency or request loss, the cloud platform database will not have any data, and the customer can detect it immediately and resend the request.

[0069] It is worth mentioning that the mechanism for agent message delivery requests can also be achieved by asynchronously processing the responses of the two components, neutron-server and dptech-agent, in the traditional way. For example, neutron-server can return success first, and then dptech-agent can deliver the configuration. However, this solution can only solve the problem of slow delivery time, but cannot solve the problem of data inconsistency between the front end and the back end.

[0070] The firewall configuration method based on the proxy service component proposed in this application can solve two problems existing in the current agent distribution mechanism: the distribution time is too long, which affects the user experience, and it can ensure the consistency of data between the front end and the back end. If a problem occurs due to network or other reasons, it can be resolved in a timely manner and the data can be re-distributed.

[0071] Figure 4This is a flowchart illustrating a firewall configuration method based on a proxy service component according to another exemplary embodiment. Figure 4 The process shown in step 40 is... Figure 2 A detailed description of the process shown.

[0072] like Figure 4 As shown in S402, the neutron-server service component obtains the firewall configuration request.

[0073] In S404, firewall configuration requests are stored in the data staging area.

[0074] In S406, RabbitMQ messages are forwarded to firewall configuration requests.

[0075] In S408, the dptech-agent component obtains the firewall configuration request and performs the configuration.

[0076] In S410, the firewall obtains configuration data.

[0077] In S412, it is determined whether the configuration has been successfully distributed.

[0078] In S414, a message is returned to the neutron-server, and configuration data is written to the database for display.

[0079] In S416, a message is returned to neutron-server to clear the configuration data in the temporary storage area and prevent it from being displayed.

[0080] In the firewall configuration method based on the proxy service component of this application, an agent message processing mechanism is proposed, which separates the front-end and back-end processing and sets up a temporary storage area first. Only after receiving a success message from the device will the data be written to the database, which ensures both timely delivery and data integrity.

[0081] The firewall configuration method based on proxy service components in this application optimizes both slow delivery time and data inconsistency between the front-end and back-end by separating the request processing mechanism between the front-end and back-end, adding a temporary storage area to replace the mechanism of writing to the database, and coordinating the judgment of results.

[0082] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0083] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0084] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0085] Figure 5 This is a block diagram illustrating a firewall configuration apparatus based on a proxy service component, according to an exemplary embodiment. Figure 5 As shown, the firewall configuration device 50 based on the proxy service component includes: a request module 502, a storage module 504, a forwarding module 506, a calling module 508, and a distribution module 510.

[0086] The request module 502 is used to obtain firewall configuration requests from users; the request module 502 is also used by the neutron-server service component to obtain the firewall configuration requests.

[0087] Storage module 504 is used to store the configuration data in the firewall configuration request in a preset area; storage module 504 is also used to store the configuration data in the firewall configuration request in a preset data temporary storage area; and to clear the front-end page data of the cloud platform.

[0088] The forwarding module 506 is used to forward the firewall configuration request to the proxy service component through a message middleware; the forwarding module 506 is also used to asynchronously process the firewall configuration request through the RabbitMQ message middleware to forward it to the proxy service component.

[0089] The calling module 508 is used by the proxy service component to call the firewall interface according to the firewall configuration request; the calling module 508 is also used to determine the type of firewall configuration data in the firewall configuration request; the proxy service component calls the firewall interface according to the type of firewall configuration data.

[0090] The distribution module 510 is used to distribute firewall configuration data based on the firewall interface. The distribution module 510 is also used to distribute one or more firewall configuration data sets based on the firewall interface; when one or more firewall configuration data sets are successfully configured, a configuration success message is returned; when any firewall configuration data set is not successfully configured, a configuration failure message is returned.

[0091] According to the firewall configuration device based on the proxy service component of this application, the firewall configuration request is obtained from the user; the configuration data in the firewall configuration request is stored in a preset area; the firewall configuration request is forwarded to the proxy service component through a message middleware; the proxy service component calls the firewall interface according to the firewall configuration request; and the firewall configuration is distributed based on the firewall interface. This method can separate the firewall configuration request processing mechanism at the front end and the back end, and solve the problems of slow distribution time and data inconsistency between the front end and the back end when optimizing multiple firewall configurations at the same time.

[0092] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0093] The following reference Figure 6 To describe an electronic device 600 according to this embodiment of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0094] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0095] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 610 can perform actions such as... Figure 2 , Figure 3 , Figure 4 The steps are shown in the figure.

[0096] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0097] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0098] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0099] Electronic device 600 can also communicate with one or more external devices 600' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 600, and / or any device that allows electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0100] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 7 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0101] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0102] In summary, the firewall configuration method based on the proxy service component disclosed herein is also a message processing method for the proxy service component. It can solve both the problem of slow message requests and the problem of inconsistent request data between the front-end and back-end. Specifically, after a request is sent to Neutron, it is first stored in a staging area. Cloud platform requests are sent to the Neutron-server via a page or command line. Normally, the Neutron-server stores the data in the Neutron database. This can lead to inconsistencies between the front-end and back-end data, which are easily perceived by the client and in the overall process, due to interruptions in subsequent stages of the request. Furthermore, the client cannot promptly perceive the data inconsistency, creating potential risks for future failures. In this solution, after a request arrives at the Neutron-server, the requested data is first placed in the staging area without being written to the database. At this point, the front-end page is empty, but the client perceives the request as completed and does not need to pay attention to subsequent processing. Other requests can continue to be sent, achieving asynchronous request and data processing and separation of the front-end and back-end. The request is transmitted to dptech-agent via RabbitMQ. After the data is placed in the temporary storage area, the frontend can send other requests normally without being aware of the backend processing flow. This request, however, continues to be passed to the dptech-agent component via the RabbitMQ message middleware. Upon receiving the request, dptech-agent determines the request type and calls the corresponding RESTful API of the firewall device to send the configuration. The success of the firewall configuration sending is determined as follows: different request types may correspond to different response methods. If the request only needs to send one configuration to the device, such as a virtual system, a success status code indicating receipt of this message will be returned. If the request only needs to send multiple configurations, such as packet filtering, address objects, and service objects, a success status code indicating receipt of success status codes from all RESTful requests will be returned; only when all return success will the entire request be considered successful. The failure determination principle is that if a request fails, it is considered a failure. However, for this solution's mechanism, if a failure is determined, the request needs to be resent. In cases where multiple configurations need to be sent to the device, some configurations might be sent successfully (e.g., address objects might be sent successfully), while packet filtering might fail due to network or other reasons. In such cases, the request is considered a failure. However, when resending the request, the address object might already exist. If the RESTful API returns an existing address object, it needs to be considered a successful configuration; otherwise, the request will never be able to be sent correctly. The Agent receives the firewall configuration sending result and returns the result.If the firewall configuration is successfully distributed, a success message is returned to the dptech-agent component. This message is then relayed back to the neutron-server via RabbitMQ. Upon receiving the success message, the neutron-server writes the data in the temporary storage area to the neutron database. Once the database contains data, the page displays normal data, and the overall request distribution is successful. If the firewall configuration distribution fails, a failure message is returned to the dptech-agent component. This message is then relayed back to the neutron-server via RabbitMQ. Upon receiving the failure message, the neutron-server clears the data in the temporary storage area, resulting in a blank page and a failure message indicating the request distribution failed. If a request fails to be sent, or if a successfully sent request fails to be properly relayed to the neutron-server due to network anomalies or other reasons, the temporary storage area will be judged as failed based on the timeout period. In this case, the cloud platform will not write to the database, and since the cloud platform has no data, the request needs to be resent. This design ensures that if there is data inconsistency or request loss, the cloud platform database will not have any data, allowing customers to detect the issue immediately and resend the request. This disclosure can solve two problems existing in the current agent-based request mechanism: the request time is too long, affecting user experience, and it can ensure data consistency between the front-end and back-end. If a problem occurs due to network or other reasons, it can be resolved in a timely manner and the request can be resent.

[0103] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0104] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0105] The aforementioned computer-readable medium carries one or more programs. When these programs are executed by a device, the computer-readable medium performs the following functions: obtaining a firewall configuration request from a user; storing the configuration data in the firewall configuration request in a preset area; forwarding the firewall configuration request to a proxy service component via a message middleware; the proxy service component invoking the firewall's interface according to the firewall configuration request; and distributing firewall configuration based on the firewall interface.

[0106] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and placed in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0107] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0108] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A firewall configuration method based on a proxy service component, characterized in that, include: Retrieve firewall configuration requests from users; The configuration data in the firewall configuration request is stored in a preset area, including: storing the configuration data in the firewall configuration request in a preset data temporary storage area; clearing the front-end page data of the cloud platform, so that the customer perceives this request as completed and does not need to pay attention to the subsequent processing flow, and can continue to send other requests, so that the requests and data are asynchronous; The firewall configuration request is forwarded to the proxy service component via a message middleware; The proxy service component invokes the firewall's interface based on the firewall configuration request; Firewall configurations are distributed based on the firewall's interface; After the firewall is successfully configured, the proxy service component receives a configuration success message and transmits it to the neutron-server service component. The neutron-server service component then writes the configuration data from the preset zone into the database. After the firewall configuration fails, the proxy service component obtains the configuration failure message and transmits it to the neutron-server service component. The neutron-server service component clears the configuration data in the preset area. The cloud platform will not write the configuration data to the database and needs to reissue the configuration request.

2. The method as described in claim 1, characterized in that, Before obtaining firewall configuration requests from users, the following steps are included: Users input firewall configuration data at the front end of the cloud platform; The firewall configuration request is generated based on the firewall configuration data.

3. The method as described in claim 1, characterized in that, Obtain firewall configuration requests from users, including: The neutron-server service component obtains the firewall configuration request.

4. The method as described in claim 1, characterized in that, The firewall configuration request is forwarded to the proxy service component via a message middleware, including: The firewall configuration request is processed asynchronously via the RabbitMQ message middleware and forwarded to the proxy service component.

5. The method as described in claim 1, characterized in that, The proxy service component invokes the firewall's interfaces based on the firewall configuration request, including: Determine the type of firewall configuration data in the firewall configuration request; The proxy service component invokes the firewall's interface based on the type of the firewall configuration data.

6. The method as described in claim 1, characterized in that, The distribution of firewall configurations based on the firewall's interface includes: One or more firewall configuration data are sent based on the firewall's interface; When one or more firewall configuration data are successfully configured, a configuration success message is returned; If any firewall configuration data fails to be configured, a configuration failure message will be returned.

7. A firewall configuration apparatus based on a proxy service, used to implement the firewall configuration method based on a proxy service component as described in claim 1, characterized in that, include: The request module is used to retrieve firewall configuration requests from users; The storage module is used to store the configuration data in the firewall configuration request in a preset area; The forwarding module is used to forward the firewall configuration request to the proxy service component through a message middleware; The calling module is used by the proxy service component to call the firewall's interface based on the firewall configuration request; The distribution module is used to distribute firewall configurations based on the firewall's interface.

Images