A rule processing method, device and storage medium

Abstract

The present application discloses a rule processing method, comprising: upon receiving a firewall rule adjustment instruction sent by a central control node, determining an adjustment operation and a firewall rule to be adjusted based on the firewall rule adjustment instruction; and updating a corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted; wherein the query list set includes a query list generated based on the firewall rule sent by the central control node and received by the rule processing node. The present application also discloses a rule processing device and a storage medium.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a rule processing method, device, and storage medium. Background Art

[0002] With the rapid development of computer science and technology, computers are increasingly used. Within this context, computer security is becoming increasingly important. To ensure computer security, a common approach is to implement a distributed firewall (DFW) using the Internet Protocol (IP) packet filtering system (iptables) to filter data and reduce the vulnerability of computer devices to attacks. DFW is implemented using iptables by sequentially matching iptables rules, or DFW rules, using the kernel's protocol stack (netfilter) architecture.

[0003] However, as the number of DFW rules increases, the operating load of the central processing unit (CPU) in the computer will be seriously increased, resulting in reduced transmission performance of the computer equipment and increased traffic delay of the transmitted data traffic. Summary of the Invention

[0004] In view of this, the embodiments of the present application hope to provide a rule processing method, device and storage medium to solve the problem that the computer's operating load increases when the number of DFW rules increases. A method for processing DFW rules when DFW rules change is proposed, which reduces the computer's operating load, ensures the transmission performance of the computer equipment, and effectively shortens the delay in transmitting data traffic.

[0005] To achieve the above objectives, the technical solution of this application is implemented as follows:

[0006] In one aspect, a rule processing method is provided, the method being applied to a rule processing node, the rule processing node running a virtual machine device, the method comprising:

[0007] If a firewall rule adjustment instruction is received from the central control node, determining an adjustment operation and a firewall rule to be adjusted based on the firewall rule adjustment instruction;

[0008] Based on the adjustment operation and the firewall rules to be adjusted, the corresponding query list set in the rule processing node is updated; wherein the query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node.

[0009] In another aspect, a rule processing device is provided, the rule processing device being configured to run a rule processing node, the device comprising: a memory, a processor, and a communication bus; wherein:

[0010] The memory is used to store executable instructions;

[0011] The communication bus is used to realize the communication connection between the processor and the memory;

[0012] The processor is configured to execute the rule processing program stored in the memory to implement the steps of any one of the above rule processing methods.

[0013] On the other hand, a storage medium stores a rule processing program, which implements the steps of any one of the above rule processing methods when executed by a processor.

[0014] The rule processing method, device, and storage medium provided in the embodiments of the present application, upon receiving a firewall rule adjustment instruction sent by a central control node, determine the adjustment operation and the firewall rule to be adjusted based on the firewall rule adjustment instruction, and update the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted. In this way, the rule processing node updates the query list set corresponding to the rule processing node through the adjustment operation and the firewall rule to be adjusted, and implements firewall rule management through the query list set, solving the current problem of an increase in the number of DFW rules leading to an increase in the computer's operating load. A method for processing DFW rules when DFW rules change is proposed, which reduces the computer's operating load, ensures the transmission performance of the computer device, and effectively shortens the delay of transmitting data traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flowchart of a rule processing method provided in an embodiment of the present application;

[0016] Figure 2 A flowchart of another rule processing method provided in an embodiment of the present application;

[0017] Figure 3 A flowchart of another rule processing method provided in an embodiment of the present application;

[0018] Figure 4 A schematic diagram of an application scenario of a rule processing method provided in an embodiment of the present application;

[0019] Figure 5 A schematic diagram of a configuration interface provided in an embodiment of the present application;

[0020] Figure 6 A schematic diagram of a query list structure provided in an embodiment of the present application;

[0021] Figure 7 A schematic diagram of a session table structure provided in an embodiment of the present application;

[0022] Figure 8 A schematic diagram of a data packet processing flow of a rule processing method provided in an embodiment of the present application;

[0023] Figure 9 A schematic diagram of the structure of a rule processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0025] The embodiment of the present application provides a rule processing method, which is applied to a rule processing node, wherein the rule processing node runs a virtual machine device, and Figure 1 As shown, the method includes the following steps:

[0026] Step 101: If a firewall rule adjustment instruction is received from a central control node, an adjustment operation and firewall rules to be adjusted are determined based on the firewall rule adjustment instruction.

[0027] In an embodiment of the present application, a rule processing node is an operating node managed and controlled by a central control node. Firewall rules are arranged on the rule processing node, and the firewall rules can be arranged by the central control node controlling the rule processing node. The firewall rules in the firewall rules can be implemented by the Extended Berkeley Packet Filter (EBPF) technology. The firewall rule adjustment instruction sent by the central control node can be that after the network administrator sets, adjusts, modifies, etc. the firewall rules of the central control node, the central control node sends the corresponding firewall rule adjustment instruction to the corresponding rule processing node to arrange, modify, etc. the firewall rules at the corresponding rule processing node. After receiving the firewall rule adjustment instruction, the rule processing node can parse the firewall rule adjustment instruction to obtain the corresponding adjustment operation to be performed and the corresponding firewall rule to be adjusted. The firewall rule to be adjusted can be the firewall rule to be arranged in the rule processing node, or it can be the firewall rule currently existing in the rule processing node.

[0028] Step 102: Based on the adjustment operation and the firewall rules to be adjusted, update the corresponding query list set in the rule processing node.

[0029] The query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node.

[0030] In an embodiment of the present application, after the rule processing node receives the adjustment operation and the firewall rules to be adjusted, it updates the query list set about the firewall rules recorded in the rule processing node, so that subsequent rule processing nodes can effectively manage the deployed firewall rules, and further quickly find the corresponding firewall rules according to the query list set, and perform corresponding data protection processing on the received or sent data to ensure the security of the data.

[0031] The rule processing method provided in an embodiment of the present application, upon receiving a firewall rule adjustment instruction sent by a central control node, determines the adjustment operation and the firewall rule to be adjusted based on the firewall rule adjustment instruction, and updates the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted. In this way, the rule processing node updates the query list set corresponding to the rule processing node using the adjustment operation and the firewall rule to be adjusted, and implements firewall rule management through the query list set, solving the current problem of an increase in the number of DFW rules leading to an increase in the computer's operating load. It provides a method for processing DFW rules when DFW rules change, reducing the computer's operating load, ensuring the transmission performance of the computer equipment, and effectively shortening the delay of transmitting data traffic.

[0032] Based on the above embodiments, an embodiment of the present application provides a rule processing method, which is applied to a rule processing node, where a virtual machine device is running. The method includes the following steps:

[0033] Step 201: If a firewall rule adjustment instruction is received from a central control node, an adjustment operation and firewall rules to be adjusted are determined based on the firewall rule adjustment instruction.

[0034] In an embodiment of the present application, after a user performs a firewall configuration operation on a central control node, the central control node generates a corresponding firewall rule adjustment instruction based on the user's firewall device operation, determines the rule processing node that needs to perform firewall rule adjustment, and then sends the firewall rule adjustment instruction to the rule processing node. After receiving the firewall rule adjustment instruction, the rule processing node analyzes the firewall rule adjustment instruction to determine the adjustment operation and the firewall rule to be adjusted.

[0035] Step 202: Based on the adjustment operation and the firewall rule to be adjusted, update the corresponding query list set in the rule processing node.

[0036] The query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node.

[0037] In an embodiment of the present application, the rule processing node responds to the firewall rule adjustment instruction and updates the corresponding query list set in the rule processing node according to the adjustment operation obtained by analysis and the firewall rule to be adjusted.

[0038] Based on the above embodiment, in other embodiments of the present application, step 202 can be implemented by steps 202a to 202e:

[0039] Step 202a: parse the firewall rule to be adjusted and determine the target 10-tuple information corresponding to the firewall rule to be adjusted.

[0040] The target 10-tuple information includes at least: action rule information, source interface identification information, destination interface identification information, source Internet Protocol IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, source port identification information and destination port identification information.

[0041] In an embodiment of the present application, when a rule processing node updates a query list set corresponding to a rule processing node, it first parses and processes the firewall rules to be adjusted, and determines from the firewall rules to be adjusted the target ten-tuple information corresponding to the firewall rules to be adjusted, which includes at least: action rule information, source interface identification information, destination interface identification information, source Internet Protocol IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, source port identification information, and destination port identification information. The source interface identification information may include multiple source interface identifications. Similarly, the destination interface identification information, source Internet Protocol IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, source port identification information, and destination port identification information may also include multiple corresponding identifications. The type of the source IP information and the destination IP information may be an IP address type or a virtual machine type, which may be determined by actual circumstances.

[0042] After executing step 202a, the rule processing node may choose to execute steps 202b to 202c, step 202d, or step 202e.

[0043] Step 202b: If the adjustment operation is a rule modification operation, a target query list corresponding to the firewall rule to be adjusted is generated based on the target 10-tuple information.

[0044] The query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node; the query list set includes a target query list.

[0045] In an embodiment of the present application, after determining that the adjustment operation is a rule modification operation, the rule processing node generates a target query list corresponding to the firewall rules to be adjusted based on the determined target ten-tuple information. At this time, the firewall rules to be adjusted are firewall rules including the adjusted firewall content.

[0046] Step 202c: Delete the historical rule query list corresponding to the firewall rule to be adjusted.

[0047] Among them, the historical rule query list belongs to the query list set.

[0048] In an embodiment of the present application, when the adjustment operation is a rule modification operation, after generating a target query list corresponding to the firewall rule to be adjusted, the historical rule query list corresponding to the firewall rule to be adjusted is deleted, thereby realizing an update operation on the query list when the adjustment operation is a rule modification operation.

[0049] Step 202d: If the adjustment operation is to add a rule, a target query list corresponding to the firewall rule to be adjusted is generated based on the target 10-tuple information.

[0050] The query list set includes a target query list.

[0051] Step 202e: If the adjustment operation is a rule deletion operation, the historical rule query list corresponding to the firewall rule to be adjusted is deleted.

[0052] Among them, the historical rule query list belongs to the query list set.

[0053] In an embodiment of the present application, when it is determined that the adjustment operation is a rule deletion operation, a historical rule query list corresponding to the firewall rule to be adjusted is determined, and the corresponding historical rule query list is deleted to implement the rule deletion operation.

[0054] It should be noted that steps 202b to 202c, step 202d, and step 202e can be implemented in combination according to actual conditions, that is, in actual application scenarios, the firewall rule adjustment instructions sent by the central control node to the rule processing node may include at least one of the following operations: modifying the rule, adding the rule, and deleting the rule.

[0055] Based on the above embodiment, in other embodiments of the present application, the step of "generating a target query list corresponding to the firewall rule to be adjusted based on the target 10-tuple information" in step 202b and step 202d can be implemented by steps a11 to a17:

[0056] Step a11: If the query list set includes a historical rule query list with the target rule identification information of the firewall rule to be adjusted as a keyword, update the values ​​in the historical rule query list based on the action rule information to obtain a first rule query list.

[0057] The target query list includes a first rule query list.

[0058] In an embodiment of the present application, the elements in the query list set are stored in the form of a keyword (Key, K)-value (Value, V) list (map) to implement information storage. Among them, the keyword in the rule query list is the rule identification information, and the corresponding value is the action rule information. In this way, the corresponding value can be quickly found according to the keyword. In the value, the action rule information corresponding to different rule identification information can be identified according to different bits, and different action rule information can be identified according to different identification information. For example, the action rule information can be allowed and discarded, then 1 can be used to represent allowed, and 0 can be used to represent discarded, etc. Exemplarily, if the queried value is 0x0011, if the rule identification information bit is represented from low to high, and the corresponding value is the action rule information, then it can be determined that the action rule information of rule 0 and rule 1 are both allowed.

[0059] Step a12: If the query list set does not include a historical rule query list with the target rule identification information as a keyword, a second rule query list is generated with the target rule identification information as a keyword and the action rule information as a value.

[0060] The target query list includes a second rule query list.

[0061] Step a13: If it is determined that there is a minimum set between the keywords and target IP information in the target historical IP query list of the query list set, update the keywords in the target historical IP query list based on the minimum set, and update the values ​​in the target historical IP query list based on the target rule identification information to obtain the first IP query list.

[0062] The target IP information is at least source IP information or destination IP information, and the target query list includes a first IP query list.

[0063] Step a14: If the target IP information is reference IP information, update the values ​​in all historical IP query lists in the query list set based on the target rule identification information to obtain a second IP query list.

[0064] The target query list includes a second IP query list.

[0065] Step a15: If it is determined that the target historical IP query list does not exist in the query list set and the target IP information is not the reference IP information, a third IP query list is generated using the target IP information as a keyword and the target rule identification information as a value.

[0066] The target query list includes a third IP query list.

[0067] Step a16: If it is determined that the query list set includes a reference information query list corresponding to the target identification information, the values ​​in the reference information query list are updated based on the target rule identification information to obtain a first target information query list.

[0068] The target identification information is source port identification information, destination port identification information, protocol identification information, source interface identification information or destination interface identification information, and the target query list includes a first target information query list.

[0069] Step a17: If it is determined that the query list set does not include the reference information novelty search list, a second target information query list is generated using the target identification information as a keyword and the target rule identification information as a value.

[0070] The target query list includes a second target information query list.

[0071] In an embodiment of the present application, for a certain firewall rule, the target query list includes at least a rule query list corresponding to the rule identification information (such as the aforementioned first rule query list or second rule query list), a source IP query list corresponding to the source IP information, a destination IP query list corresponding to the destination IP information (such as the aforementioned first IP query list, second IP query list, third IP query list, etc.), a source port query list corresponding to the source port identification information, a destination port query list corresponding to the destination port identification information, a protocol query list corresponding to the protocol identification information, a source interface query list corresponding to the source interface identification information, and a destination interface query list corresponding to the destination interface identification information (such as the aforementioned first target information query list, second target information query list). In this way, the firewall rule is converted into a corresponding query list, so that all virtual machines running on the rule processing node can access the query list, thereby improving the deployment efficiency of the firewall rule.

[0072] Based on the above embodiment, in other embodiments of the present application, the step of "deleting the historical rule query list corresponding to the firewall rule to be adjusted" in step 202c or step 202e can be implemented by steps b11 to b13:

[0073] Step b11: Delete the historical query list corresponding to the source port identification information in the firewall rule to be adjusted.

[0074] In an embodiment of the present application, when executing a rule deletion operation, the historical query list corresponding to the source port identification information in the firewall rule to be adjusted is first deleted.

[0075] Step b12: Delete the query lists corresponding to the destination interface identification information, source IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, and destination port identification information in the firewall rule to be adjusted.

[0076] In an embodiment of the present application, after deleting the historical query list corresponding to the source port identification information, the query lists corresponding to the destination interface identification information, source IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information and destination port identification information are deleted respectively. There is no requirement for the order of deletion of the query lists corresponding to the destination interface identification information, source IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information and destination port identification information, and they can be deleted according to actual conditions.

[0077] Step b13: Delete the query list corresponding to the action rule information.

[0078] In the embodiment of the present application, the rule query list corresponding to the action rule information is deleted last.

[0079] Based on the above embodiments, in other embodiments of the present application, refer to Figure 2 As shown, after the rule processing node executes step 202, it is further used to execute step 203:

[0080] Step 203: Update the session table set based on the adjustment operation and the firewall rules to be adjusted.

[0081] In an embodiment of the present application, the rule processing node detects the adjustment operation and the firewall rules to be adjusted, and after updating the corresponding query list based on the adjustment operation and the firewall rules to be adjusted, updates the session table corresponding to the session in the rule processing node to ensure that the corresponding firewall protection service is subsequently provided according to the updated session.

[0082] In some application scenarios, the update operation on the session table set can also be implemented periodically, that is, the session table set is scanned periodically to delete sessions in the session table set that have exceeded a set aging time.

[0083] In some application scenarios, the update operation of the scheduled session table set and the update operation of the session table set after detecting the firewall rule adjustment can be combined and applied, and the specific operation can be determined by the actual situation.

[0084] Based on the above embodiment, in other embodiments of the present application, step 203 can be implemented by steps 203a to 203e:

[0085] Step 203a: If the adjustment operation is a rule adding operation, or if the adjustment operation is a rule modifying operation, and the source interface before modification and the destination interface before modification corresponding to the firewall rule to be adjusted are both IP types, and / or the source interface after modification and the destination interface after modification are both IP types, determine the session set to be traversed.

[0086] In an embodiment of the present application, when the adjustment operation is an add rule operation, a set of sessions to be traversed is determined. When the adjustment operation is a modify rule operation, if the source interface before modification and the destination interface before modification in the firewall rule to be adjusted are both IP types, or the source interface after modification and the destination interface after modification in the firewall rule to be adjusted are both IP types, or the source interface before modification and the destination interface before modification in the firewall rule to be adjusted are both IP types, and the source interface after modification and the destination interface after modification in the firewall rule to be adjusted are both IP types, the set of sessions to be traversed is determined.

[0087] Step 203b: If the set of sessions to be traversed includes a first session table corresponding to a first target rule having a higher priority than the firewall rule to be adjusted, determine the source IP information to be matched, the destination IP information to be matched, the protocol identifier information to be matched, the source port information to be matched, and the destination port information to be matched included in the first session table.

[0088] In an embodiment of the present application, if the set of sessions to be traversed does not include the first session table corresponding to the first target rule having a higher priority than the firewall rule to be adjusted, no subsequent operation is performed. When a first target rule having a higher priority than the firewall rule to be adjusted is determined in the set of sessions to be traversed, the first session table corresponding to the first target rule is determined, and the source IP information to be matched, the destination IP information to be matched, the protocol identifier information to be matched, the source port information to be matched, and the destination port information to be matched are determined from the first session table.

[0089] Step 203c: If the source IP information to be matched, the destination IP information to be matched, the protocol identification information to be matched, the source port information to be matched, and the destination port information to be matched respectively match the source IP information, destination IP information, protocol identification information, source port information, and destination port information of the firewall rule to be adjusted, determine the action rule information of the firewall rule information to be adjusted.

[0090] In an embodiment of the present application, when the source IP information to be matched, the destination IP information to be matched, the protocol identification information to be matched, the source port information to be matched, and the destination port information to be matched in the first session table respectively match the source IP information, the destination IP information, the protocol identification information, the source port information, and the destination port information of the firewall rule to be adjusted, the action rule information in the firewall rule information to be adjusted is determined.

[0091] Step 203d: If the action rule information indicates a discard action, delete the first session table.

[0092] Step 203e: If the action rule information indicates that the action is allowed, update the first session table based on the target rule identification information.

[0093] In the embodiment of the present application, when the action rule information indicates that the action is allowed, the value in the first session table is updated to the target rule identification information to implement the update process of the first session table.

[0094] Based on the above embodiment, in other embodiments of the present application, step 203 may also be implemented by steps 203f to 203g:

[0095] Step 203f: If the adjustment operation is a rule deletion operation, determine the session set to be traversed.

[0096] Step 203g: If a second session table corresponding to a rule having the same rule identification information as the target rule identification information exists in the set of sessions to be traversed, the second session table is deleted.

[0097] In an embodiment of the present application, if the second session table corresponding to the rule with the same rule identification information as the target rule identification information does not exist in the set of sessions to be traversed, no subsequent operation is performed. When a second session table corresponding to the rule with the same rule identification information as the target rule identification information is determined to be obtained in the set of sessions to be traversed, the second session table is directly deleted.

[0098] Based on the above embodiment, in other embodiments of the present application, when the adjustment rule is a rule adding operation or a rule deleting operation, the "determining the set of sessions to be traversed" in steps 203a and 203f can be implemented by steps c11 to c12:

[0099] Step c11: If the source IP information type and the destination IP information type in the firewall rule to be adjusted are both IP address types, obtain the session table corresponding to the source interface identification information in the firewall rule to be adjusted and the session table corresponding to the destination interface identification information in the firewall rule to be adjusted to obtain the session set to be traversed.

[0100] Step c12: If at least one of the source IP information type and the destination IP information type in the firewall rule to be adjusted is a virtual machine type, obtain the session table corresponding to the interface identification information of the target virtual machine to obtain a set of sessions to be traversed.

[0101] The target virtual machine is specified by the source IP information and / or destination IP information in the firewall rule to be adjusted.

[0102] Based on the above embodiment, in other embodiments of the present application, step 203 may also be implemented by steps 203h to 203n:

[0103] Step 203h: If the adjustment operation is a rule modification operation, and at least one of the source interface before modification and the destination interface before modification corresponding to the firewall rule to be adjusted is a virtual machine type, or at least one of the source interface after modification and the destination interface after modification is a virtual machine type, based on the firewall rule to be adjusted, determine the set of sessions to be deleted and the set of sessions to be added.

[0104] The session table set includes a set of sessions to be deleted and a set of sessions to be added.

[0105] In an embodiment of the present application, when the adjustment rule is a rule modification operation, since at least one of the source interface before modification and the destination interface before modification corresponding to the firewall rule to be adjusted is a virtual machine type, or at least one of the source interface after modification and the destination interface after modification is a virtual machine type, the firewall rule to be adjusted at this time includes the firewall rule before modification and the firewall rule after modification. In this way, by analyzing the firewall rule to be adjusted, it is possible to determine the set of sessions to be deleted that need to be deleted and the set of sessions to be added that need to be added.

[0106] Step 203i: If the set of sessions to be deleted is not empty, the adjustment operation is updated to a delete rule operation.

[0107] Step 203j: Determine that the session set to be traversed is a session set to be deleted.

[0108] Step 203k: Update the session table set based on the deletion rule operation and the set of sessions to be traversed.

[0109] In the embodiment of the present application, the specific implementation process of step 203k can be implemented with reference to step 203g, and will not be repeated here.

[0110] Step 2031: If the set of sessions to be added is not empty, the update adjustment operation is an add rule operation.

[0111] Step 203m: Determine that the session set to be traversed is the session set to be added.

[0112] Step 203n: Based on the adding rule operation and the set of sessions to be added, update the session table set.

[0113] In the embodiment of the present application, step 203n can be implemented by referring to the implementation process of steps 203b to 203e, which will not be described in detail here.

[0114] Based on the above embodiments, in other embodiments of the present application, refer to Figure 3 As shown, the rule processing node is also used to execute steps 204 to 209:

[0115] Step 204: If a target data packet is detected, determine that the data transmission and reception direction of the target data packet is the target direction.

[0116] In an embodiment of the present application, a target data packet can be a data packet received by a reference virtual machine running in a rule processing node, or a data packet that the reference virtual machine needs to send. The data transmission and reception direction of the target data packet can be the virtual machine data receiving direction, specifically represented by a first virtual machine sending data sending the target data packet to the reference virtual machine, or the virtual machine data sending direction, specifically represented by a reference virtual machine sending the target data to a second virtual machine receiving data.

[0117] Step 205: parse the target data packet to determine the first target tuple information of the target data packet.

[0118] In an embodiment of the present application, a target data packet is parsed to determine first target tuple information corresponding to the target data packet. The first target tuple information includes at least interface identification information, source IP identification information, destination IP identification information, protocol identification information, source port identification information, and destination port information. The interface identification information herein is used to identify identification information of the interface through which the reference virtual machine receives or sends the target data packet.

[0119] In some application scenarios, if the target data packet is a fragmented message and is the first data packet of the fragmented message, the source IP identification information, destination IP identification information, identity identification information in the IP header of the target data packet, and interface identification information in the first target tuple information are used as keywords, and the values ​​are the source port identification information and the destination port identification information to update the storage mapping table (map) of the fragmented message, such as the least recently used algorithm (Least Recently Used, LRU) mapping table. In this way, the subsequent corresponding fragmented message can search the corresponding fragmented message map according to the keyword stored in the storage mapping table to obtain the corresponding value, namely the source port identification information and the destination port identification information, so as to quickly process the subsequent message data.

[0120] Step 206: Search for a target session that matches the first target tuple information to obtain a query result.

[0121] In an embodiment of the present application, the first target tuple information is matched with a session table corresponding to the target session. If there is a session table matching the first target tuple information, the query result is determined to be that the target session exists; otherwise, the target session does not exist.

[0122] After the rule processing node executes step 206 , it may choose to execute step 207 or step 208 .

[0123] Step 207: If the query result shows that the target session exists, the target session table corresponding to the target session is updated.

[0124] In the embodiment of the present application, when the query result indicates that a target session exists, the aging time in the target session table corresponding to the target session is updated.

[0125] Step 208: If the query result shows that the target session does not exist, a target session table corresponding to the target session is obtained based on the target direction and the first target tuple information.

[0126] In an embodiment of the present application, when the query result shows that the target session does not exist, the target direction and the first target tuple information are analyzed to generate a target session table corresponding to the target session, or update the target session table with an associated relationship.

[0127] Step 209: Based on the target session, perform a processing operation on the target data packet.

[0128] In an embodiment of the present application, according to the determined target session, corresponding firewall rule protection or firewall filtering processing is performed on the target data packet to achieve processing of the target data packet.

[0129] It should be noted that steps 204 to 209 may be performed before any of the previous steps, or may be performed as an independent embodiment.

[0130] Based on the above embodiment, in other embodiments of the present application, step 208 can be implemented by steps 208a to 208g:

[0131] Step 208a: Determine a first reference session table corresponding to the reference interface identification information in the first target tuple information.

[0132] Step 208b: Determine the information in the first target tuple information except the reference interface identification information to obtain the second target tuple information.

[0133] Step 208c: Match the second target tuple information with the first reference session table to obtain a first matching result.

[0134] In the embodiment of the present application, step 208c may be referred to as a forward matching process.

[0135] Step 208d: If the first matching result is a successful match, update the aging time of the first reference session table to obtain a target session table.

[0136] Step 208e: If the first matching result is unsuccessful, convert the IP direction parameter and the port direction parameter in the first reference session table to obtain a second reference session table.

[0137] In an embodiment of the present application, when the first match result is an unsuccessful match, the IP direction parameter and the port direction parameter in the first reference session table are converted. The conversion process may be: if the IP direction parameter indicates that the source IP identification information and the destination IP identification information are not equal, the IP direction parameter is inverted. For example, when the IP direction parameter is recorded as ipdir, if ipdir is 0, indicating that the source IP identification information and the destination IP identification information are not equal, ipdir is inverted to obtain ipdir of 1; if ipdir is 1, indicating that the source IP identification information and the destination IP identification information are not equal, ipdir is inverted to obtain ipdir of 0. The conversion process of the port direction parameter can refer to the conversion process of the IP direction parameter and will not be described in detail here.

[0138] Step 208f: Match the second target tuple information with the second reference session table to obtain a second matching result.

[0139] In the embodiment of the present application, step 208f may be referred to as a reverse matching process.

[0140] Step 208g: Based on the second matching result and the target direction, obtain a target session table corresponding to the target session.

[0141] In the embodiment of the present application, a target session is established or updated based on the second matching result and the target direction to obtain a target session table corresponding to the target session.

[0142] Based on the above embodiment, in other embodiments of the present application, step 208g can be implemented by steps d11 to d13:

[0143] Step d11: If the second matching result is a successful match, update the search time of the first reference session table to obtain a target session table.

[0144] Step d12: Update the data sending and receiving direction of the first reference session table to a reference direction opposite to the target direction.

[0145] In the embodiment of the present application, if the target direction is the first virtual machine sending the target data packet to the reference virtual machine, the data transmission and reception direction of updating the first reference session table is the reference virtual machine sending the target data packet to the first virtual machine.

[0146] Step d13: If the second matching result is a match failure, a new target session is created based on the first target tuple information to obtain a target session table.

[0147] In an embodiment of the present application, when both the forward match and the reverse match fail, it is determined that there is currently no target session corresponding to the target data packet. Therefore, a new target session corresponding to the target data packet needs to be created. The implementation process of the new target session can refer to the implementation process of steps 203a to 203e, which will not be repeated here.

[0148] Based on the above embodiments, the present application provides a rule processing method. An application scenario of the rule processing method can refer to Figure 4 As shown, it includes a user, a central controller and at least one local controller, wherein the central controller corresponds to the aforementioned central control node, the local controller corresponds to the aforementioned rule processing node, and multiple virtual machines are running in the local controller. The user configures the firewall rules on the central controller side. A configuration interface can refer to Figure 5 As shown, Figure 5 The configuration content shown includes at least the priority, name, source indicating source IP identification information, destination indicating target IP identification information, service, and action indicating action rule identification information of the firewall rule.

[0149] Figure 4 In the scenario shown, the user Figure 5 After configuring the firewall rules for the central controller, the central controller will Figure 5The source and destination configured in the command will send the user-configured firewall rules to the local controller where the corresponding cluster node is located. When the central controller issues firewall rules, it can distribute them according to the following situations: when the source and destination are both specified as virtual machine types, and the virtual machines specified by the source and destination are on the same local controller, the firewall rules are sent to the local controller where the virtual machines indicated by the source and destination are located; when the source and destination are both specified as virtual machine types, and the virtual machines specified by the source and destination are not on the same local controller, the firewall rules are split according to the multiple local controllers where the indicated virtual machines are located, and the firewall rules are sent to the multiple local controllers where the virtual machines indicated by the source and destination are located; when the source and destination are both specified as IP address types, the firewall rules are sent to the local controllers of all hosts in the cluster; when one of the source and destination is specified as IP address type and the other is specified as virtual machine type, and all the specified virtual machines are on the same local controller, the firewall rules are issued to the local controller where all virtual machines are located; when one of the source and destination is specified as IP address type and the other is specified as virtual machine type, and all the specified virtual machines are not on the same local controller, the firewall rules are split according to the local controllers where different virtual machines are located, and the corresponding firewall rules are issued to different local controllers corresponding to different virtual machines.

[0150] After the local controller receives the firewall rules sent by the central controller, the local controller can use the EBPF application to implement the corresponding rule processing method, that is, the local controller parses the firewall rules through the EBPF application and converts the firewall rules into ten-tuple information. The ten-tuple information includes: source interface identification group, source IP group, destination interface identification group, destination IP group, protocol group, source port group, destination port group, rule identification information, action rule information, status information, etc. Among them, the source interface identification group and the destination interface identification group, as well as the source IP group and the destination IP group are composed of Figure 5 The source and destination configurations shown in the figure are converted, for example, if Figure 5 When the source or destination shown in is specified as a virtual machine or a virtual machine group, the set virtual machine information can be converted into a virtual machine interface ip group and a virtual machine interface identification group, wherein the virtual machine interface identification group can be the identification information of the corresponding virtual machine interface in the kernel; if Figure 5 If the source or destination is specified as an IP group, the interface identifier group corresponding to the IP group is set to 0, indicating a wildcard. For example, assume that the local controller receives the following rules:

[0151] Send host source Purpose Serve action state Priority Host 1 IP Group 1 Virtual Machine 1 Protocol Port allow Enable 2

[0152] The local controller converts the rules in the above table to obtain the 10-tuple information as shown in the following table:

[0153]

[0154] Among them, IP group 2 is the IP combination of all interfaces in virtual machine 1, and id1, id2... represent the interface identifiers of virtual machine 1.

[0155] The local controller updates the query list set in the local controller with the ten-tuple information obtained by the above conversion. The query list set may include 8 types of list elements, which can be exemplified by referring to Figure 6 As shown, it includes: source interface hash list (map), destination interface hash list, source IP identification list, destination IP identification list, protocol hash list, destination port hash list, source port hash list, and action rule matrix list. Figure 6 In each list, only two groups of different keyword-value objects are listed as examples. In actual application, the number of keyword-value objects in each list is determined by actual conditions and is not specifically limited here. Figure 6 The query list set shown is a shared list set that is accessible to all virtual machines in the local controller. Figure 6 In the list shown, the source IP identification list and the destination IP identification list are of Link Manager Protocol (LMP) hash list (map) type, the corresponding keyword key is the IP information and mask in the IP group, the numerical value is a bitmap value, and each bit represents the corresponding rule identifier; the port and protocol map can be a hash map type, the corresponding key is the port or protocol number, the value is a bitmap value, and each bit represents the corresponding rule identifier; the action rule map can be an array type, the corresponding key is the rule identifier, and the value is the action rule (for example, allow 1 or discard 0).

[0156] The specific process of the local controller updating the query list set in the local controller with the ten-tuple information obtained by the above conversion is as follows: for the source interface identification group, when the source interface identification in the source interface identification group is updated to the hashmap of the source interface, if the source interface identification group contains multiple interface identifications, each interface identification is used as the key to update the map corresponding to the hash map of the source interface. The specific update process is: using the source interface identification as the key, if the corresponding value is obtained from the source interface hash map of the query list set, and the bit in the value corresponding to the rule identification has been set to 1, then no update is required, otherwise the bit in the value corresponding to the rule identification is set to 1, and the other bits remain unchanged; if the corresponding value is not obtained from the source interface hash map of the query list set, then using the source interface identification as the key, the bitmap corresponding to the rule identification is set to 1 to create the corresponding key-value pair, and store it in the source interface hash map. For example, assuming that the source interface identification group contains two interfaces, namely source interface 1 and source interface 2, and the corresponding rule identification is 2, the Hashmap before and after the update can be shown in the following table:

[0157]

[0158] If the source or destination of the received message is an IP group and the source interface ID is 0, the bits corresponding to the rule IDs in all key-to-value pairs in the source interface hash map are set to 1. The protocol and port update process is the same as the source interface update process described above and will not be described in detail here.

[0159] The update process for action rules is as follows: using rule identification information as key, converting action into value, and updating the action rule matrix list.

[0160] When updating the IP address (i.e., the source IP identification list and the destination IP identification list), the following situations exist: (1) The IP address in the ten-tuple information is the minimum set of other rules included in the query list set; (2) The IP addresses in the ten-tuple information are all 0, that is, the wildcard situation. For (1), update the bits of the minimum set. For example, there is rule 1 in the query list set, and its source IP is configured as 192.168.0.0 / 16. The source IP of rule 2 in the ten-tuple information is 192.168.1.0 / 24. Then, the minimum set extracted is 192.168.1.0 / 24. Therefore, with the minimum set 192.168.1.0 / 24 as the key and the value 110, it means that the IP address range is used by both rule 1 and rule 2. When there is a subsequent match for the 192.168.1.0 network segment message, the longest mask match is used to obtain a value of 110, which means that both rule 1 and rule 2 are matched. For (2), update the bits corresponding to the new rule identifiers in the values ​​of all keys before the update to 1, and add a new entry with the key 0 and the value corresponding to the current rule ID. For example, if there are rules 1 and 2 before the update, and the newly added rule is rule 3, and the IP address corresponding to rule 3 is 0, the map table changes as follows:

[0161] Key value Before update 192.168.1.0 / 24 10 Before update 192.168.2.0 / 26 100 After update 0.0.0.0 / 0 100 After update 192.168.1.0 / 24 1010 After update 192.168.2.0 / 26 1100

[0162] It should be noted that in the update Figure 6 When updating the lists in the table, the requirements for different update operations can be: if a new firewall rule is added, the action map is updated first, and then other maps are updated; if a firewall rule is deleted, the map table entry corresponding to the source port identifier indicated by the firewall rule is deleted first, and then the map table entries of other matching fields are deleted, and finally the action map entry is deleted; if a firewall rule is modified, the modification of the firewall rule is converted into adding and deleting rules, and the map table is updated first according to the processing flow of adding rules, and then the corresponding old map table is deleted according to the processing method of deleting rules.

[0163] After the local controller uses the above method to update the map table for the received firewall rules, it notifies the session scanning thread to rescan the session and use the newly added firewall rules to filter the already created sessions. If a session matches the new firewall rules, and the new firewall rules have a higher priority than the rules that matched when the session was created, and the new rules are for packet loss processing, the session will be deleted.

[0164] Each session can be recorded using a session map. The table organization of the session map can refer to Figure 7 As shown, each interface corresponds to a map. The key organization in the session map can be shown in the following table:

[0165]

[0166] In the above table, IP1 is used to indicate the smaller of the source IP and destination IP in the message; IP2 is used to indicate the larger of the source IP and destination IP in the message; ipdir is used to indicate whether the source IP of the message is greater than the destination IP. If the source IP in the message is less than the destination IP, ipdir is 0; if the source IP is greater than the destination IP, ipdir is 1; if the source IP and destination IP are equal, ipdir is 2; portdir is used to indicate whether the source port number of the message is greater than the destination port number. If the source port number in the message is less than the destination port number, portdir is 0; if the source port number is greater than the destination port number, portdir is 1; if the source port number and destination port number are equal, portdir is 2. For example, if message A is received (source ip: 1.1.1.2, destination ip: 1.1.10.1, protocol number: 7, source port: 12, destination port: 10), when a new session is created, the key in its session table entry is: IP1 is 1.1.1.2, IP2 is 1.1.10.1, protocol number is 7, PORT1 is 10, PORT2 is 12, ipdir is 0, portdir is 1; if message B is received (source ip: 1.1.10.2, destination ip: 1.1.10.1, protocol number: 7, source port 122, destination port: 5000), when a new session is created, the key in its session table entry is: IP1 is 1.1.1.2, IP2 is 1.1.10.1, protocol number is 7, PORT1 is 10, PORT2 is 12, ipdir is 0, portdir is 1 The key is: IP1 is 1.1.10.1, IP2 is 1.1.10.2, protocol number is 7, PORT1 is 122, PORT2 is 5000, ipdir is 1, and portdir is 0; if message C is received (source IP: 1.1.10.2, destination IP: 1.1.10.1, protocol number: 7, source port: 5000, destination port: 5000), when a new session is created, the key in its session table entry is: IP1 is 1.1.10.1, IP2 is 1.1.10.2, protocol number is 7, PORT1 is 5000, PORT2 is 5000, ipdir is 1, and portdir is 2.

[0167] Correspondingly, the organization of the value in the session map can be shown in the following table:

[0168] Matching rule ID Aging time Matching rule ID Aging time

[0169] The scanning and matching process for sessions when creating new firewall rules is as follows: traverse the session tables corresponding to the source interface and destination interface in the newly created firewall rule. If the source interface and destination interface in the firewall rule are both configured with IP addresses, then traverse and scan the session tables of all interfaces of the local controller; if the source interface and destination interface in the firewall rule have a configured virtual machine or virtual machine group, then traverse and scan the interface session table corresponding to the configured virtual machine. Among them, the process of traversing, scanning and matching the corresponding interface session table can be: if there is a rule identifier of the value in the session table item that is greater than the added firewall rule identifier (wherein, the smaller the rule identifier, the higher the priority), then the key (6-tuple) in the session table item is converted into the form of message source IP, destination IP, protocol, source port and destination port, and the converted parameters are matched with the source IP, destination IP, protocol, source port and destination port in the newly added firewall rule respectively; if the match is successful, it is determined whether the action of the newly added firewall rule is discard or allow, if it is discard, the session table item is deleted; if it is allow, the rule identifier of the value in the current session table item is updated to the rule identifier of the newly added firewall rule.

[0170] The session scan and match process for deleting firewall rules is as follows: traverse the session tables corresponding to the source and destination interfaces in the deleted firewall rules. If both the source and destination are configured with IP addresses in the firewall rules, traverse and scan the session tables of all interfaces on the local controller for matching. If the source and destination in the firewall rules have a configured virtual machine or virtual machine group, traverse and scan the interface session tables corresponding to all configured virtual machines for matching. The process of traversing and scanning the corresponding interface session tables is as follows: if the rule identifier of the value in the session table entry is the same as the identifier of the deleted firewall rule, the session table entry is directly deleted. If the rule ID of the value in the session table entry is less than or greater than the ID of the deleted firewall rule, no processing is performed.

[0171] The scanning and matching process for modifying firewall rules is as follows: if the source and destination of the firewall rules before and after modification are both of IP type, that is, the source and destination are both of IP type before modification and the source and destination are also of IP type after modification, then the session tables of all interfaces of the local controller are traversed and scanned for matching. The specific process can refer to the aforementioned traversal and scanning and matching process for sessions when creating new firewall rules, which will not be described in detail here.

[0172] If one of the source and destination in the firewall rules before and after modification is of IP type, that is, the source and destination are both IP type before modification, or the source and destination are both IP type after modification, then the session tables of all interfaces of the local controller are traversed and scanned for matching. The specific process can refer to the aforementioned traversal and scanning matching process for sessions when creating new firewall rules, which will not be described in detail here.

[0173] If at least one of the source and destination of the firewall before modification contains a virtual machine type, or at least one of the source and destination of the firewall rule after modification contains a virtual machine type, then it is possible to determine the interface lists corresponding to three virtual machines: the interface list that is reduced after comparison between before and after modification, the unchanged interface list, and the newly added interface list; for the reduced interface list, the matching process is the same as the session matching process for deleting firewall rules; for the newly added interface list, the matching process is the same as the matching process for creating new firewall rules; for the modified interface list, when traversing the session table, if there is a rule identifier greater than or equal to the value in the session table item (the rule identifier is greater than or equal to the value), the match is completed. The smaller the value, the higher the priority) is, the modified firewall rule identifier is used, the key in the session table item is converted into the form of message source IP, destination IP, protocol, source port and destination port, and the converted parameters are matched with the modified firewall rule source IP, destination IP, protocol, source port and destination port. If the match is successful, the action of the modified firewall rule is checked to see whether it is discard or allow. If it is discard, the session table item is deleted; if it is allow, if the rule identifier in the session table item is the same as the modified rule identifier, it is not processed, otherwise the rule identifier of the value in the current session table item is updated to the modified rule identifier.

[0174] For session scanning, you can also set a scheduled scanning method to traverse all session table entries corresponding to the local controller, match whether the aging time in the session table entry is greater than the current time, and if it is greater than the current time, delete the current session table entry.

[0175] The local controller's processing flow for data packets can refer to Figure 8 As shown:

[0176] Step e11: The local controller detects the data packet, parses the data packet, and extracts the six-tuple information of the message.

[0177] Among them, when the data packet reaches the hook point of the kernel terminal (Terminal Computer, TC) of the local controller, the sending and receiving direction of the data packet is determined according to the hook point. For example, when the data packet is sent in the direction of the virtual machine, it can be represented by 0, and when the data packet is received in the direction of the virtual machine, it can be represented by 1. The sending and receiving direction of the data packet is saved, for example, it can be saved in the first field of skb->cb.

[0178] The local controller performs message parsing and processing, and extracts the message six-tuple information, which can be the interface identifier, source IP, destination IP, protocol, source port, and destination port in sequence.

[0179] It should be noted that if the data packet is a fragmented message and is the first packet of the fragmented message, the source IP, destination IP, ID in the IP header of the data packet, and interface identifier are used as keys, and the value is the source port and destination port to update the fragment map, so that after other fragmented messages are detected subsequently, the fragment map can be found according to the source IP, destination IP, ID in the IP header, and interface ID to obtain the source port and destination port, thereby realizing fast message fragment distribution.

[0180] Step e12: Match the corresponding session table according to the interface information in the message six-tuple information, and then perform matching processing on the message five-tuple information except the interface information in the message six-tuple information to obtain a matching result.

[0181] Among them, the message quintuple (source IP, destination IP, protocol, source port, destination port) in the message six-tuple information is converted into the session key, and the session is matched to obtain the matching result; if the match is successful, it is determined that the matching result is a successful match, which means that the message direction is the same as the direction when the new session table entry is created (indicating that it is a forward match), and the second field of skb->cb is set to 0, and the message five-tuple information is converted into the session key, and the corresponding session table entry is found. At this time, only the aging time of the session table is updated; if the match fails, the ipdir and portdir in the session map table corresponding to the current interface are converted. The conversion rule is: if ipdir is not 2, that is, the source IP and destination IP are not equal, then ipdir=! ipdir (if ipdir is 0 when the match is not successful, then ipdir is set to 1; if ipdir is 1 when the match is not successful, then ipdir is set to 0); the portdir conversion rules are the same as the ipdir conversion rules and are not described in detail here; session matching is performed again based on the converted session key and the message quintuple (which can be understood as matching in the opposite direction). If the match is successful, the matching result is determined to be a successful match, the second field of skb→cb is set to 2, and session matching is performed based on the converted key (which can be understood as matching in the opposite direction), and the timestamp of the found session table entry is updated; if the match fails after ipdir and portdir are converted, the matching result is determined to be a match failure.

[0182] Step e13: When the matching result is a match failure, a session table is obtained according to the data sending and receiving direction and the message six-tuple information.

[0183] Among them, (1) when the matching result is a match failure, the sending and receiving direction of the data packet is determined, that is, the value stored in the first field in skb→cb. (2) If the sending and receiving direction of the data packet is the sending direction of the virtual machine, the rule query list corresponding to the source interface identifier is matched according to the current virtual machine interface identifier; if the match fails, it returns directly, exits the EBPF program flow, and directly goes to the kernel protocol stack; if the match is successful, the value in the rule query list corresponding to the source interface identifier is saved to the global bit query list (bitmap) of the current central processing unit, for example, it can be recorded as PER_VALUE. (3) If the sending and receiving direction of the data packet is the receiving direction of the virtual machine, the rule query list corresponding to the destination interface identifier is matched according to the current virtual machine interface id. If the match fails, it returns directly and exits the EBPF program flow; if the match is successful, the value in the rule query list corresponding to the destination interface identifier is saved to the global bitmap table of the current central processing unit, for example, it can be recorded as PER_VALUE. (4) When the source interface identifier is successfully matched or the destination interface identifier is successfully matched, the five-tuple information of the message in the six-tuple information of the message is matched. The matching process is unified as follows: According to the extracted IP information, protocol or port, the corresponding rule list is matched. After the match is successful, the corresponding value is bitwise ANDed with PER_VALUE to update the value of PER_VALUE. When all the five-tuples are matched, each bit in PER_VALUE represents the rule identifier that the current data packet can match. (5) The smallest bit set to 1 in the updated PER_VALUE is extracted to obtain the rule identifier. For example, if PER_VALUE is 11100, the rule identifier is identified from 0 from the lowest bit to the highest bit. It can be determined that the smallest bit set to 1 is the second bit, so the rule identifier can be determined to be 2. (6) According to the extracted rule identifier, the action map table corresponding to the current interface is searched to obtain the action. According to whether the action is to allow or drop the packet; if it is to drop, the packet is directly dropped; if it is allowed, a new session table is created.

[0184] Step e14: When the matching result is successful, the aging time of the session table is updated.

[0185] For example, if there is a ten-tuple of information corresponding to the firewall rules shown in the following table (wherein the status information is not shown):

[0186]

[0187] In this way, based on the above table, the corresponding source interface hash list key-value is recorded as: 12-110; the corresponding source IP identification list key-value is recorded as: 1.1.1.0 / 24-010, 2.2.2.0 / 24-100; the corresponding destination interface hash list key-value is recorded as: 18-010, 9-100; the corresponding destination IP identification list key-value is recorded as: 1.1.1.0 / 24-010, 2.2.1.0 / 24-100; the corresponding protocol hash list key-value is recorded as: 16-010, 17-100; the corresponding source port hash list key-value is recorded as: 12-010, 1000-100; the corresponding destination port identification list key-value is recorded as: 2000-110; the corresponding action rule matrix list key-value is recorded as: 1-1, 2-0. Thus, based on the above query rule list, the implementation process of the rule processing method when the virtual machine VMA sends the packet A to the virtual machine VMB can be as follows:

[0188] 1. When packet A (1.1.1.1:12-→1.1.1.2:2000, protocol 16) from VMA to VMB is sent out from interface 12, VMA determines the direction of the packet and sets skb→[0] to 0.

[0189] 2. Extract the six-tuple information of message A through the firewall rules;

[0190] 3. Find the session table with interface ID 12.

[0191] Among them, first extract the key of the forward session table item as shown in the following table, and perform session table item search:

[0192] IP1 IP2 protocol PORT1 PORT2 ipdir portdir 1.1.1.1 1.1.1.2 16 12 122 0 0

[0193] Since it is a new message A, it cannot be matched in the forward direction. At this time, a reverse session table search is required. The corresponding keys for the reverse search are shown in the following table:

[0194] IP1 IP2 protocol PORT1 PORT2 ipdir portdir 1.1.1.1 1.1.1.2 16 12 122 1 1

[0195] At this point, it still cannot be found, so skb→cb[1] is set to 1 to indicate that a new session table entry needs to be created.

[0196] 4. The process of creating a new session table entry is as follows: interface matching. Since skb→cb[0] is 0, the source interface hash list is searched according to the interface identifier 12, and the value 110 is obtained, which is saved in PER_VALUE; then the source IP identifier list is matched, and the value 010 is obtained. After calculating with PER_VALUE, PER_VALUE is updated to 010; then the destination IP identifier list, protocol hash list, source port hash list, and destination port hash list are matched, and PER_VALUE is updated to 010; the smallest bit in PRE_VALUE is extracted as rule identifier 1; the action rule information corresponding to rule identifier 1 is searched, and the value is 1, indicating permission;

[0197] 5. Determine whether to create a new session table entry or update the session table entry based on the value of skb→cb[1]: Since skb→cb[1] is 1, a new session table entry is created based on the message quintuple. The key of the session table entry can be as shown in the following table, the state in the value is NEW, the rule id is the currently matched rule id 1, and the aging time (for example, 200s, customized according to different protocols).

[0198] IP1 IP2 protocol PORT1 PORT2 ipdir portdir 1.1.1.1 1.1.1.2 16 12 122 0 0

[0199] It should be noted that, for explanations of the same steps or concepts in this embodiment as in other embodiments, reference can be made to the descriptions in other embodiments and will not be repeated here.

[0200] The rule processing method provided in an embodiment of the present application, upon receiving a firewall rule adjustment instruction sent by a central control node, determines the adjustment operation and the firewall rule to be adjusted based on the firewall rule adjustment instruction, and updates the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted. In this way, the rule processing node updates the query list set corresponding to the rule processing node using the adjustment operation and the firewall rule to be adjusted, and implements firewall rule management through the query list set. This solves the current problem of an increase in the number of DFW rules leading to an increase in the computer's operating load. It provides a method for processing DFW rules when DFW rules change, reducing the computer's operating load, ensuring the transmission performance of the computer equipment, and effectively shortening the delay of transmitted data traffic.

[0201] Based on the above embodiments, the present invention provides a rule processing device 3, which can be applied to Figures 1 to 3 In the corresponding embodiment, refer to Figure 9 As shown, the rule processing device 3 includes: a memory 31, a processor 32 and a communication bus 33; wherein:

[0202] Memory 31, for storing executable instructions;

[0203] Communication bus 33, used to realize communication connection between processor and memory;

[0204] The processor 32 is configured to execute the rule processing program stored in the memory to implement the following steps:

[0205] If a firewall rule adjustment instruction is received from the central control node, the adjustment operation and the firewall rule to be adjusted are determined based on the firewall rule adjustment instruction;

[0206] Based on the adjustment operation and the firewall rules to be adjusted, the corresponding query list set in the rule processing node is updated; wherein the query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node.

[0207] In other embodiments of the present application, when the processor executes the step of updating the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted, it can be implemented by the following steps:

[0208] Parsing the firewall rule to be adjusted and determining target 10-tuple information corresponding to the firewall rule to be adjusted; wherein the target 10-tuple information includes at least: action rule information, source interface identification information, destination interface identification information, source Internet Protocol (IP) information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, source port identification information, and destination port identification information;

[0209] If the adjustment operation is a rule modification operation, generating a target query list corresponding to the firewall rule to be adjusted based on the target 10-tuple information; wherein the query list set includes the target query list;

[0210] Delete the historical rule query list corresponding to the firewall rule to be adjusted; the historical rule query list belongs to the query list set;

[0211] If the adjustment operation is a rule addition operation, generating a target query list corresponding to the firewall rule to be adjusted based on the target 10-tuple information; wherein the query list set includes the target query list;

[0212] If the adjustment operation is a rule deletion operation, the historical rule query list corresponding to the firewall rule to be adjusted is deleted; wherein the historical rule query list belongs to the query list set.

[0213] In other embodiments of the present application, when the processor executes the step of generating a target query list corresponding to the firewall rule to be adjusted based on the target ten-tuple information, it can be implemented by the following steps:

[0214] If the query list set includes a historical rule query list with the target rule identification information of the firewall rule to be adjusted as a keyword, updating the values ​​in the historical rule query list based on the action rule information to obtain a first rule query list; wherein the target query list includes the first rule query list;

[0215] If the query list set does not include a historical rule query list with the target rule identification information as a keyword, a second rule query list is generated with the target rule identification information as a keyword and the action rule information as a value; wherein the target query list includes the second rule query list;

[0216] If it is determined that a minimum set exists between the keywords in the target historical IP query list and the target IP information in the query list set, updating the keywords in the target historical IP query list based on the minimum set, and updating the values ​​in the target historical IP query list based on the target rule identification information to obtain a first IP query list; wherein the target IP information is at least the source IP information or the destination IP information, and the target query list includes the first IP query list;

[0217] If the target IP information is the reference IP information, updating the values ​​in all historical IP query lists in the query list set based on the target rule identification information to obtain a second IP query list; wherein the target query list includes the second IP query list;

[0218] If it is determined that the target historical IP query list does not exist in the query list set, and the target IP information is not the reference IP information, a third IP query list is generated using the target IP information as a keyword and the target rule identification information as a value; wherein the target query list includes the third IP query list;

[0219] If it is determined that the query list set includes a reference information query list corresponding to the target identification information, updating the values ​​in the reference information query list based on the target rule identification information to obtain a first target information query list; wherein the target identification information is source port identification information, destination port identification information, protocol identification information, source interface identification information, or destination interface identification information, and the target query list includes the first target information query list;

[0220] If it is determined that the query list set does not include the reference information novelty search list, a second target information query list is generated using the target identification information as a keyword and the target rule identification information as a value; wherein the target query list includes the second target information query list.

[0221] In other embodiments of the present application, when the processor executes the step of deleting the historical rule query list corresponding to the firewall rule to be adjusted, it can be implemented by the following steps:

[0222] Delete the historical query list corresponding to the source port identification information in the firewall rule to be adjusted;

[0223] Delete the query lists corresponding to the destination interface identification information, source IP information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, and destination port identification information in the firewall rule to be adjusted;

[0224] Delete the query list corresponding to the action rule information.

[0225] In other embodiments of the present application, after the processor executes the step of updating the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted, it is further configured to execute the following steps:

[0226] Update the session table set based on the adjustment operation and the firewall rules to be adjusted.

[0227] In other embodiments of the present application, when the processor executes the step of updating the session table set based on the adjustment operation and the firewall rule to be adjusted, it can be implemented by the following steps:

[0228] If the adjustment operation is a rule adding operation, or if the adjustment operation is a rule modifying operation, and the source interface before modification and the destination interface before modification corresponding to the firewall rule to be adjusted are both IP types, and / or the source interface after modification and the destination interface after modification are both IP types, determining a session set to be traversed;

[0229] If the set of sessions to be traversed includes a first session table corresponding to a first target rule having a higher priority than the firewall rule to be adjusted, determining source IP information to be matched, destination IP information to be matched, protocol identifier information to be matched, source port information to be matched, and destination port information to be matched, included in the first session table;

[0230] If the source IP information to be matched, the destination IP information to be matched, the protocol identification information to be matched, the source port information to be matched, and the destination port information to be matched respectively match the source IP information, the destination IP information, the protocol identification information, the source port information, and the destination port information of the firewall rule to be adjusted, determining the action rule information of the firewall rule information to be adjusted;

[0231] If the action rule information indicates a discard action, deleting the first session table;

[0232] If the action rule information indicates that the action is allowed, the first session table is updated based on the target rule identification information; wherein the target rule identification information is used to identify the firewall rule to be adjusted.

[0233] In other embodiments of the present application, when the processor executes the step of updating the session table set based on the adjustment operation and the firewall rule to be adjusted, it can also be implemented by the following steps:

[0234] If the adjustment operation is a rule deletion operation, determine the session set to be traversed;

[0235] If there is a second session table corresponding to a rule whose rule identification information is the same as the target rule identification information in the to-be-traversed session set, the second session table is deleted; wherein the target rule identification information is used to identify the firewall rule to be adjusted.

[0236] In other embodiments of the present application, when the adjustment rule is a rule adding operation or a rule deleting operation, when the processor executes the step of determining the session set to be traversed, the following steps may be performed:

[0237] If the source IP information type and the destination IP information type in the firewall rule to be adjusted are both IP address types, obtain the session table corresponding to the source interface identification information in the firewall rule to be adjusted and the session table corresponding to the destination interface identification information in the firewall rule to be adjusted to obtain the session set to be traversed;

[0238] If at least one of the source IP information type and the destination IP information type in the firewall rule to be adjusted is a virtual machine type, obtain the session table corresponding to the interface identification information of the target virtual machine to obtain the session set to be traversed; wherein the target virtual machine is specified by the source IP information and / or destination IP information in the firewall rule to be adjusted.

[0239] In other embodiments of the present application, when the processor executes the step of updating the session table set based on the adjustment operation and the firewall rule to be adjusted, it can also be implemented by the following steps:

[0240] If the adjustment operation is a rule modification operation, and at least one of the pre-modification source interface and the pre-modification destination interface corresponding to the firewall rule to be adjusted is a virtual machine type, or at least one of the post-modification source interface and the post-modification destination interface is a virtual machine type, determining a set of to-be-deleted sessions to be deleted and a set of to-be-added sessions to be added based on the firewall rule to be adjusted; wherein the session table set includes the set of to-be-deleted sessions and the set of to-be-added sessions;

[0241] If the set of sessions to be deleted is not empty, the update adjustment operation is a delete rule operation;

[0242] Determine that the session set to be traversed is the session set to be deleted;

[0243] Based on the deletion rule operation and the set of sessions to be traversed, the session table set is updated;

[0244] If the set of sessions to be added is not empty, the update adjustment operation is to add a rule operation;

[0245] Determine that the session set to be traversed is the session set to be added;

[0246] Based on the add rule operation and the set of sessions to be added, the session table set is updated.

[0247] In other embodiments of the present application, the processor is further configured to perform the following steps:

[0248] If a target data packet is detected, determining that the data transmission and reception direction of the target data packet is the target direction;

[0249] Parsing the target data packet to determine first target tuple information of the target data packet;

[0250] Searching for a target session that matches the first target tuple information to obtain a query result;

[0251] If the query result shows that the target session exists, update the target session table corresponding to the target session;

[0252] If the query result shows that the target session does not exist, the target session table corresponding to the target session is obtained based on the target direction and the first target tuple information;

[0253] Based on the target session, a processing operation is performed on the target data packet.

[0254] In other embodiments of the present application, if the query result is that the target session does not exist, the processor may obtain a target session table corresponding to the target session based on the target direction and the first target tuple information by performing the following steps:

[0255] Determine a first reference session table corresponding to the reference interface identification information in the first target tuple information;

[0256] Determine information other than the reference interface identification information in the first target tuple information to obtain second target tuple information;

[0257] Matching the second target tuple information with the first reference session table to obtain a first matching result;

[0258] If the first matching result is a successful match, the aging time of the first reference session table is updated to obtain the target session table;

[0259] If the first matching result is unsuccessful, converting the IP direction parameter and the port direction parameter in the first reference session table to obtain a second reference session table;

[0260] Matching the second target tuple information with the second reference session table to obtain a second matching result;

[0261] Based on the second matching result and the target direction, a target session table corresponding to the target session is obtained.

[0262] In other embodiments of the present application, when the processor executes the step of obtaining a target session table corresponding to the target session based on the second matching result and the target direction, the step may be implemented by the following steps:

[0263] If the second matching result is a successful match, the search time of the first reference session table is updated to obtain the target session table;

[0264] Updating the data sending and receiving direction of the first reference session table to a reference direction opposite to the target direction;

[0265] If the second matching result is a matching failure, a new target session is created based on the first target tuple information to obtain a target session table.

[0266] It should be noted that the information interaction process between nodes in this embodiment can refer to the information interaction process described in the aforementioned method embodiment, and will not be repeated here.

[0267] The rule processing device provided in an embodiment of the present application, upon receiving a firewall rule adjustment instruction sent by a central control node, determines an adjustment operation and a firewall rule to be adjusted based on the firewall rule adjustment instruction, and updates the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted. In this way, the rule processing node updates the query list set corresponding to the rule processing node using the adjustment operation and the firewall rule to be adjusted, and firewall rule management is achieved through the query list set. This solves the current problem of an increase in the number of DFW rules leading to an increase in computer operating load, and provides a method for processing DFW rules when DFW rules change, thereby reducing the computer operating load, ensuring the transmission performance of the computer device, and effectively shortening the delay of transmitted data traffic.

[0268] Based on the above embodiments, the embodiments of the present application provide a computer-readable storage medium, referred to as a storage medium, which stores one or more rule processing methods, and the one or more rule processing methods can be executed by one or more processors to implement the following. Figures 1 to 3 The rule processing method provided in the corresponding embodiment will not be described in detail here.

[0269] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0270] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0271] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, ..., air conditioner, or network communication link device, etc.) to execute the methods described in each embodiment of the present application.

[0272] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0273] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0274] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0275] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the description and drawings of this application, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A rule processing method, characterized in that: The method is applied to a rule processing node, where a virtual machine device is running. The method includes: If a firewall rule adjustment instruction is received from the central control node, the firewall rule adjustment instruction is parsed to obtain an adjustment operation and a firewall rule to be adjusted; Based on the adjustment operation and the firewall rules to be adjusted, the corresponding query list set in the rule processing node is updated; wherein the query list set includes a query list generated according to the firewall rules sent by the central control node and received by the rule processing node, and the query list set is used to find the corresponding firewall rules.

2. The method according to claim 1, characterized in that The updating of the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted includes: Parsing the firewall rule to be adjusted, and determining target 10-tuple information corresponding to the firewall rule to be adjusted; wherein the target 10-tuple information includes at least: action rule information, source interface identification information, destination interface identification information, source Internet Protocol (IP) information, destination IP information, source interface identification information, destination interface identification information, protocol identification information, source port identification information, and destination port identification information; If the adjustment operation is a rule modification operation, generating a target query list corresponding to the firewall rule to be adjusted based on the target 10-tuple information; wherein the query list set includes the target query list; Deleting a historical rule query list corresponding to the firewall rule to be adjusted; wherein the historical rule query list belongs to the query list set; If the adjustment operation is a rule addition operation, generating a target query list corresponding to the firewall rule to be adjusted based on the target 10-tuple information; wherein the query list set includes the target query list; If the adjustment operation is a rule deletion operation, the historical rule query list corresponding to the firewall rule to be adjusted is deleted; wherein the historical rule query list belongs to the query list set.

3. The method according to claim 2, characterized in that The generating, based on the target deca-tuple information, a target query list corresponding to the firewall rule to be adjusted includes: If the query list set includes a historical rule query list using the target rule identification information of the firewall rule to be adjusted as a keyword, updating the values ​​in the historical rule query list based on the action rule information to obtain a first rule query list; wherein the target query list includes the first rule query list; If the query list set does not include a historical rule query list with the target rule identification information as a keyword, generating a second rule query list with the target rule identification information as a keyword and the action rule information as a value; wherein the target query list includes the second rule query list; If it is determined that a minimum set exists between the keywords and the target IP information in the target historical IP query list of the query list set, updating the keywords in the target historical IP query list based on the minimum set, and updating the values ​​in the target historical IP query list based on the target rule identification information, to obtain a first IP query list; wherein the target IP information is at least the source IP information or the destination IP information, and the target query list includes the first IP query list; If the target IP information is reference IP information, updating the values ​​in all historical IP query lists in the query list set based on the target rule identification information to obtain a second IP query list; wherein the target query list includes the second IP query list; If it is determined that the target historical IP query list does not exist in the query list set, and the target IP information is not the reference IP information, generating a third IP query list using the target IP information as a keyword and the target rule identification information as a value; wherein the target query list includes the third IP query list; If it is determined that the query list set includes a reference information query list corresponding to the target identification information, the values ​​in the reference information query list are updated based on the target rule identification information to obtain a first target information query list; wherein the target identification information is the source port identification information, the destination port identification information, the protocol identification information, the source interface identification information or the destination interface identification information, and the target query list includes the first target information query list; If it is determined that the query list set does not include the reference information search list, a second target information query list is generated using the target identification information as a keyword and the target rule identification information as a value; wherein the target query list includes the second target information query list.

4. The method according to claim 2 or 3, characterized in that The deleting the historical rule query list corresponding to the firewall rule to be adjusted includes: Deleting a historical query list corresponding to the source port identification information in the firewall rule to be adjusted; Deleting the query lists corresponding to the destination interface identification information, the source IP information, the destination IP information, the source interface identification information, the destination interface identification information, the protocol identification information, and the destination port identification information in the firewall rule to be adjusted; Delete the query list corresponding to the action rule information.

5. The method according to claim 1, wherein After updating the corresponding query list set in the rule processing node based on the adjustment operation and the firewall rule to be adjusted, the method further includes: Based on the adjustment operation and the firewall rule to be adjusted, a session table set is updated.

6. The method according to claim 5, characterized in that The updating of the session table set based on the adjustment operation and the firewall rule to be adjusted includes: If the adjustment operation is a rule adding operation, or if the adjustment operation is a rule modifying operation, and the source interface before modification and the destination interface before modification corresponding to the firewall rule to be adjusted are both IP types, and / or the source interface after modification and the destination interface after modification are both IP types, determining a session set to be traversed; If the set of sessions to be traversed includes a first session table corresponding to a first target rule having a higher priority than the firewall rule to be adjusted, determining source IP information to be matched, destination IP information to be matched, protocol identifier information to be matched, source port information to be matched, and destination port information to be matched, included in the first session table; If the source IP information to be matched, the destination IP information to be matched, the protocol identification information to be matched, the source port information to be matched, and the destination port information to be matched respectively match the source IP information, the destination IP information, the protocol identification information, the source port information, and the destination port information of the firewall rule to be adjusted, determining the action rule information of the firewall rule information to be adjusted; If the action rule information indicates a discard action, deleting the first session table; If the action rule information indicates a permission action, the first session table is updated based on the target rule identification information; wherein the target rule identification information is used to identify the firewall rule to be adjusted.

7. The method according to claim 5, characterized in that The updating of the session table set based on the adjustment operation and the firewall rule to be adjusted further includes: If the adjustment operation is a rule deletion operation, determining a set of sessions to be traversed; If a second session table corresponding to a rule having the same rule identification information as the target rule identification information exists in the to-be-traversed session set, the second session table is deleted; wherein the target rule identification information is used to identify the firewall rule to be adjusted.

8. The method according to claim 6 or 7, characterized in that In a case where the adjustment rule is the add rule operation or the delete rule operation, determining the set of sessions to be traversed includes: If the source IP information type and the destination IP information type in the firewall rule to be adjusted are both IP address types, obtaining a session table corresponding to the source interface identification information in the firewall rule to be adjusted and a session table corresponding to the destination interface identification information in the firewall rule to be adjusted to obtain the session set to be traversed; If at least one of the source IP information type and the destination IP information type in the firewall rule to be adjusted is a virtual machine type, obtain the session table corresponding to the interface identification information of the target virtual machine to obtain the session set to be traversed; wherein, the target virtual machine is specified by the source IP information and / or the destination IP information in the firewall rule to be adjusted.

9. The method according to claim 5, characterized in that The updating of the session table set based on the adjustment operation and the firewall rule to be adjusted further includes: If the adjustment operation is a rule modification operation, and at least one of the pre-modification source interface and the pre-modification destination interface corresponding to the firewall rule to be adjusted is a virtual machine type, or at least one of the modified source interface and the modified destination interface is a virtual machine type, based on the firewall rule to be adjusted, determining a set of to-be-deleted sessions to be deleted and a set of to-be-added sessions to be added; wherein the session table set includes the set of to-be-deleted sessions and the set of to-be-added sessions; If the set of sessions to be deleted is not empty, updating the adjustment operation to a delete rule operation; Determining that the to-be-traversed session set is the to-be-deleted session set; Based on the deletion rule operation and the set of sessions to be traversed, updating the set of session tables; If the set of sessions to be added is not empty, updating the adjustment operation to an add rule operation; Determining that the to-be-traversed session set is the to-be-added session set; Based on the adding rule operation and the set of sessions to be added, the session table set is updated.

10. The method according to claim 1, characterized in that The method further comprises: If a target data packet is detected, determining that the data transmission and reception direction of the target data packet is a target direction; Parsing the target data packet to determine first target tuple information of the target data packet; Searching for a target session that matches the first target tuple information to obtain a query result; If the query result indicates that the target session exists, updating the target session table corresponding to the target session; If the query result indicates that the target session does not exist, obtaining a target session table corresponding to the target session based on the target direction and the first target tuple information; Based on the target session, a processing operation is performed on the target data packet.

11. The method according to claim 10, characterized in that If the query result indicates that the target session does not exist, obtaining a target session table corresponding to the target session based on the target direction and the first target tuple information includes: Determine a first reference session table corresponding to the reference interface identification information in the first target tuple information; Determine information other than the reference interface identification information in the first target tuple information to obtain second target tuple information; Matching the second target tuple information with the first reference session table to obtain a first matching result; If the first matching result is a successful match, updating the aging time of the first reference session table to obtain the target session table; If the first matching result is unsuccessful, converting the IP direction parameter and the port direction parameter in the first reference session table to obtain a second reference session table; Matching the second target tuple information with the second reference session table to obtain a second matching result; A target session table corresponding to the target session is obtained based on the second matching result and the target direction.

12. The method according to claim 11, characterized in that The obtaining, based on the second matching result and the target direction, a target session table corresponding to the target session includes: If the second matching result is a successful match, updating the search time of the first reference session table to obtain the target session table; Updating the data sending and receiving direction of the first reference session table to a reference direction opposite to the target direction; If the second matching result is a matching failure, the target session is newly created based on the first target tuple information to obtain the target session table.

13. A rule processing device, characterized in that: The rule processing device is used to run a rule processing node, and the device includes: a memory, a processor, and a communication bus; wherein: The memory is used to store executable instructions; The communication bus is used to realize the communication connection between the processor and the memory; The processor is configured to execute the rule processing program stored in the memory to implement the steps of the rule processing method according to any one of claims 1 to 12.

14. A storage medium, characterized in that The storage medium stores a rule processing program, which implements the steps of the rule processing method according to any one of claims 1 to 12 when executed by a processor.

Images