A method for improving firewall forwarding efficiency

Abstract

The application discloses a method for improving the firewall forwarding efficiency, comprising the following steps: constructing a six-tuple structure; when a data packet is received, processing the data packet according to the constructed six-tuple structure to obtain a corresponding six-tuple, calculating a hash value and recording an entry into a hash bucket; broadcasting the data packet under a VLAN corresponding to a VLAN ID in the data packet; when a reply packet of the six-tuple data is received, recording an exit, and thus a pair of forwarding interfaces of the six-tuple is successfully established; when the packet of the six-tuple is received again, the packet is directly forwarded by using the established pair of forwarding interfaces without searching for the interfaces. The application avoids querying the corresponding relationship between a VLAN and a MAC address and an interface under the VLAN, can reuse the existing state information to quickly find the interfaces for forwarding, can quickly adapt to the network topology change and perform self correction, and can greatly improve the firewall forwarding efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method for improving firewall forwarding efficiency. Background Technology

[0002] Firewall technology is a technique that organically combines various software and hardware devices used for security management and screening to help computer networks build a relatively isolated protective barrier between their internal and external networks, thereby protecting the security of user data and information. The main function of firewall technology is to promptly detect and address potential security risks and data transmission issues that may exist during computer network operation. These measures include isolation and protection, and the firewall can also record and detect various operations within the computer network to ensure the security of computer network operation, protect the integrity of user data and information, and provide users with a better and more secure computer network experience.

[0003] Existing firewalls are affected by multiple factors during forwarding, typically requiring lookups in multiple tables. For example, after performing filtering actions, the firewall needs to query the VLAN (Virtual Local Area Network) and then the outgoing interface under that VLAN. This querying significantly impacts the firewall's forwarding efficiency. Therefore, to avoid performing such queries for every data packet, this invention proposes a method to improve firewall forwarding efficiency. Summary of the Invention

[0004] This invention provides a method for improving firewall forwarding efficiency, comprising:

[0005] Construct a six-tuple structure, including source IP, destination IP, source port, destination port, protocol, and VLAN ID;

[0006] When a data packet is received, the data packet is processed according to the constructed six-tuple structure to obtain the corresponding six-tuple, the hash value is calculated and the entry is recorded before entering the hash bucket;

[0007] Broadcast this data packet under the VLAN corresponding to the VLAN ID in the data packet;

[0008] Upon receiving the response packet for the six-tuple data, the exit point is recorded, and the pair of forwarding interfaces for this six-tuple is successfully established.

[0009] Upon receiving the message containing this six-tuple again, there is no need to search for an interface again; the already established forwarding interface can be used directly for fast forwarding.

[0010] One method for improving firewall forwarding efficiency, as described above, involves updating the current entry point when the interface changes, i.e., when the entry point of the received packet differs from the currently stored entry point.

[0011] One method for improving firewall forwarding efficiency, as described above, involves aging out hash values ​​in the hash bucket that have not been used for a certain period of time according to a predetermined cycle.

[0012] As described above, one method to improve firewall forwarding efficiency involves creating a new flow when the VLAN of a flow changes (i.e., the first five tuples in the six-tuple remain the same, only the VLAN ID changes). The old flow is then aged according to the normal aging cycle and its resources are released.

[0013] The present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium contains one or more program instructions, the one or more program instructions being executed by a processor as described above in any of the methods for improving firewall forwarding efficiency.

[0014] The beneficial effects achieved by this invention are as follows: This invention avoids querying the correspondence between VLANs and MAC addresses and interfaces under a certain VLAN, can reuse existing status information to quickly find interfaces for forwarding, and can quickly adapt to changes in network topology and perform self-correction, which can greatly improve the forwarding efficiency of the firewall. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0016] Figure 1 This is a flowchart of a method for improving firewall forwarding efficiency provided in Embodiment 1 of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1

[0019] See Figure 1 Embodiment 1 of the present invention provides a method for improving firewall forwarding efficiency, comprising:

[0020] Step 110: Construct a six-tuple structure, including source IP, destination IP, source port, destination port, protocol, and VLAN ID;

[0021] Step 120: When a data packet is received, process the data packet according to the constructed six-tuple structure to obtain the corresponding six-tuple data, calculate the hash value and record the entry, and then enter the hash bucket.

[0022] Specifically, when a data packet is received, the corresponding six-tuple data is obtained from the data packet according to the six-tuple structure, including the source IP, destination IP, source port, destination port, protocol, and VLAN ID. Then, a hash operation is performed on these data to obtain the hash value corresponding to the six-tuple of the data packet. The interface that received the data packet is used as the entry point, and the hash value is saved into the hash bucket.

[0023] Step 130: Broadcast this data packet under the VLAN corresponding to the VLAN ID in the data packet.

[0024] Step 140: After receiving the return packet of the six-tuple data, record the exit point. At this point, the pair of forwarding interfaces for this six-tuple has been successfully established.

[0025] Specifically, after broadcasting a data packet under a VLAN, when a response to the 6-tuple data is received from a certain interface, it is determined that the receiving interface is the exit point of the 6-tuple data. Thus, the entry and exit points of the 6-tuple data have been determined, meaning that the forwarding interface pair has been successfully established.

[0026] When the message containing this six-tuple is received again in step 150, there is no need to find an interface again; the already established forwarding interface can be used directly for fast forwarding.

[0027] When the interface changes, i.e., when the entry point of the received message differs from the currently stored entry point, the current entry point is updated. Based on the above method, multiple six-tuple hash values ​​may be created, resulting in multiple hash values ​​in the hash bucket. To avoid resource congestion after traffic ends, hash values ​​that have not been used for a certain period (e.g., 3 minutes, 5 minutes, 10 minutes, etc.) in the hash bucket can be aged out periodically.

[0028] When the VLAN of a flow changes (i.e., the first five tuples in the six-tuple remain the same, only the VLAN ID changes), a new flow is created and processed according to the steps described above, while the old flow ages out according to the normal aging cycle and releases resources.

[0029] Corresponding to the above embodiments, this embodiment of the invention provides a device for improving firewall forwarding efficiency. The system includes: at least one memory and at least one processor.

[0030] The memory is used to store one or more program instructions;

[0031] A processor is used to run one or more program instructions to implement a method to improve the forwarding efficiency of a firewall.

[0032] Corresponding to the above embodiments, this embodiment of the invention provides a computer-readable storage medium containing one or more program instructions, which are executed by a processor to provide a method for improving firewall forwarding efficiency.

[0033] The embodiments disclosed in this invention provide a computer-readable storage medium storing computer program instructions that, when executed on a computer, cause the computer to perform the aforementioned method for improving firewall forwarding efficiency.

[0034] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0035] The various methods, steps, and logic diagrams disclosed in the embodiments of this invention can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods.

[0036] The storage medium can be memory, such as volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0037] Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory.

[0038] Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0039] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0040] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using a combination of hardware and software. When applied as software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0041] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for improving firewall forwarding efficiency, characterized in that, include: Construct a six-tuple structure, including source IP, destination IP, source port, destination port, protocol, and VLAN ID; When a data packet is received, the data packet is processed according to the constructed six-tuple structure to obtain the corresponding six-tuple, the hash value is calculated and the entry is recorded before entering the hash bucket; Broadcast this data packet under the VLAN corresponding to the VLAN ID in the data packet; Upon receiving the response packet for the six-tuple data, the exit point is recorded, and the pair of forwarding interfaces for this six-tuple is successfully established. Upon receiving the message containing this six-tuple again, there is no need to search for an interface again; the established forwarding interface can be used directly for fast forwarding. When the VLAN of a flow changes, if the first five tuples of the six-tuple remain unchanged and only the VLAN ID changes, a new flow is created, and the old flow ages out according to the predetermined aging period and releases resources.

2. The method for improving firewall forwarding efficiency as described in claim 1, characterized in that, When the interface changes, if the entry point of the received message is different from the currently stored entry point, the current entry point will be updated.

3. The method for improving firewall forwarding efficiency as described in claim 1, characterized in that, Hash values ​​that have not been used for a certain period of time are aged out according to a predetermined aging cycle.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains one or more program instructions, which are executed by a processor as described in any one of claims 1-3, to improve firewall forwarding efficiency.

Images