An access control method and device, electronic equipment and storage medium

Abstract

This application provides an access control method, apparatus, electronic device, and storage medium. The method includes: receiving a message to be forwarded; if a session entry corresponding to the message to be forwarded exists, processing the message to be forwarded according to the session entry age value and the global session age value to achieve access control of the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU. In this application, after receiving the message to be forwarded, the FPGA determines the processing method of the message to be forwarded according to the session entry age value and the global session age value, which can achieve access control of the message to be forwarded while satisfying high-performance forwarding.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to an access control method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, access control devices implement traffic forwarding and control primarily using a combination of CPU and FPGA, which improves data forwarding performance. The working principle is as follows: the FPGA receives a packet to be forwarded, checks if there is a corresponding session entry for that packet, and if so, forwards it directly; otherwise, it reports to the CPU, which then processes the packet. Therefore, it can be seen that when the FPGA contains a session entry for a packet, and that packet needs to be forwarded, it can be directly forwarded from the FPGA, but this does not achieve access control for the packet being forwarded. Summary of the Invention

[0003] The purpose of this application is to provide an access control method, apparatus, electronic device, and storage medium for implementing access control of packets to be forwarded.

[0004] In a first aspect, embodiments of this application provide an access control method applied to an FPGA, comprising:

[0005] Receive messages to be forwarded;

[0006] If a session table entry exists corresponding to the message to be forwarded, the message to be forwarded is processed according to the session table entry age value and the global session age value to achieve access control of the message to be forwarded; wherein, the session table entry age value and the global session age value are sent by the CPU.

[0007] In this embodiment, after receiving the message to be forwarded, the FPGA determines the processing method of the message to be forwarded based on the session entry age value and the global session age value, which can achieve access control of the message to be forwarded while satisfying high-performance forwarding.

[0008] In any embodiment, processing the packet to be forwarded based on the session entry age value corresponding to the session entry and the global session age value includes:

[0009] If the session entry age value is the same as the global session age value, then the packet to be forwarded will be forwarded from the network interface.

[0010] If the session entry age value is different from the global session age value, the message to be forwarded will be reported to the CPU, which will then process it.

[0011] In this embodiment, if the session entry age value is different from the global session age value, it means that the session entry has become outdated. Even if the FPGA stores the session entry of the message to be forwarded, the CPU still needs to perform access control on the message to be forwarded again, thereby realizing the function of access control on the message to be forwarded.

[0012] In any embodiment, the method further includes:

[0013] If there is no session table entry corresponding to the message to be forwarded, the message to be forwarded is reported to the CPU, which then processes it.

[0014] In this embodiment, if the session entry for the message to be forwarded does not exist in the FPGA, the message to be forwarded is processed by the CPU, which improves data security.

[0015] In any embodiment, the method further includes:

[0016] Receive an update instruction sent by the CPU to update the global session age value. The update instruction is generated by the CPU when it detects a change in the access control policy.

[0017] The stored global session age value will be updated according to the update command.

[0018] In this embodiment, the CPU detects a change in the access control policy and synchronously updates the global session age value in the FPGA, so that the FPGA can perform access control on the packets to be forwarded based on the global session age value and the age values ​​of each session table entry.

[0019] In any embodiment, the method further includes:

[0020] The CPU receives a table entry deletion instruction, wherein the table entry deletion instruction includes a session table entry to be deleted, and the table entry deletion instruction is generated by the CPU after determining that the message corresponding to the session table entry to be deleted is an invalid message;

[0021] Delete the session entry to be deleted according to the entry deletion command.

[0022] In this embodiment, since the access control policy corresponding to each message to be forwarded in the CPU can change, the message may pass through at one moment but not at the next moment. Therefore, after the CPU determines that the message to be forwarded cannot pass through, it sends an instruction to the FPGA to delete the session table entry of the message to be forwarded, so that the message will re-enter the CPU for access control when it re-enters the CPU.

[0023] Secondly, embodiments of this application provide another access control method applied to a CPU, the method comprising:

[0024] Generate a global session age value and a session entry queue; the session entry queue includes session entries.

[0025] Send the global session age value and session entries to the FPGA.

[0026] In this embodiment, the CPU sends a global session age value and a session entry to the FPGA, so that after the FPGA receives the message to be forwarded, it determines the processing method of the message to be forwarded based on the session entry age value and the global session age value. This can achieve access control of the message to be forwarded while satisfying high-performance forwarding.

[0027] In any embodiment, the method further includes:

[0028] Receive the message to be forwarded sent by the FPGA; wherein the message to be forwarded is sent when there is no session entry corresponding to the message to be forwarded in the FPGA, or when there is a session entry but the age value of the session entry is different from the global session age value.

[0029] Establish session entries corresponding to the packets to be forwarded, and match access control policies for the packets to be forwarded;

[0030] If the access control policy allows the packet to be forwarded to pass, the session entry is written into the session entry queue, and the packet to be forwarded is forwarded out through the FPGA's network port.

[0031] In this embodiment, when there is no session entry for the message to be forwarded in the FPGA, or when the age value of the session entry for the message to be forwarded is different from the global session age value, the forwarding message is sent to the CPU, and the CPU controls the forwarding message, thereby improving the security of the terminal device.

[0032] In any embodiment, the method further includes:

[0033] If the access control policy does not allow the packet to be forwarded to pass, the packet to be forwarded will be discarded, and a deletion flag will be added to the session entry queue corresponding to the packet to be forwarded.

[0034] In this embodiment, by adding a deletion flag to the session entry queue, the FPGA can be controlled to delete the corresponding session entry. Subsequent packets will still need to be accessed and controlled by the CPU, thus improving the security of the terminal device.

[0035] In any embodiment, the method further includes:

[0036] If a change is detected in the session entry queue, a corresponding control command is sent to the FPGA so that the FPGA updates the session entry according to the control command.

[0037] This application embodiment improves the security of the terminal device by sending control commands to the FPGA when the session entry queue changes, so that the FPGA updates the session entries according to the control commands.

[0038] In any embodiment, the method further includes:

[0039] If a change in access control policy is detected, the global session age value is updated and synchronized to the FPGA.

[0040] This application embodiment uses a global session age value to enable the FPGA to determine whether a message to be forwarded needs to be reported to the CPU, thereby realizing access control for the message to be forwarded.

[0041] Thirdly, embodiments of this application provide an access control device applied to an FPGA, comprising:

[0042] The message receiving module is used to receive messages to be forwarded;

[0043] The message processing module is used to process the message to be forwarded according to the session entry age value and the global session age value if a session entry corresponding to the message to be forwarded exists, so as to realize access control of the message to be forwarded; wherein, the session entry age value and the global session age value are sent by the CPU.

[0044] Fourthly, embodiments of this application provide an access control device applied to a CPU, comprising:

[0045] The generation module is used to generate a global session age value and a session entry queue; the session entry queue includes session entries.

[0046] The sending module is used to send the global session age value and session entries to the FPGA.

[0047] Fifthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus, wherein,

[0048] The processor and the memory communicate with each other via the bus;

[0049] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect or the second aspect by calling the program instructions.

[0050] Sixthly, embodiments of this application provide a non-transitory computer-readable storage medium, comprising:

[0051] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method of the first aspect or the second aspect.

[0052] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0053] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A schematic diagram of the message access control method provided for the comparison scheme;

[0055] Figure 2 This is a schematic flowchart of an access control method provided in an embodiment of this application;

[0056] Figure 3 This is a schematic diagram of another access control method provided in an embodiment of this application;

[0057] Figure 4 This is a schematic diagram of another access control method provided in an embodiment of this application;

[0058] Figure 5 This is a schematic diagram of another access control method provided in an embodiment of this application;

[0059] Figure 6 This is a schematic diagram of an access control device structure provided in an embodiment of this application;

[0060] Figure 7 This is a schematic diagram of another access control device structure provided in an embodiment of this application;

[0061] Figure 8 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0062] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0063] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0064] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0065] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0066] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0067] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0068] With the rapid development of network communication technology, the operation and maintenance of the Internet has become an increasingly important part of ensuring reliable network information transmission. Currently, ordinary access control devices primarily rely on CPU processing for traffic data forwarding and control; however, this is limited by CPU performance, resulting in low forwarding and control efficiency. Therefore, combining a CPU with an FPGA can significantly improve data forwarding performance. Figure 1 A schematic diagram of the message access control method provided for the comparison scheme is shown below. Figure 1 As shown. The data processing flow is as follows: A1 (message reception), A2 (message sent to CPU), B1 (CPU issues session table entry), B2 (FPGA sends message), C1 (direct forwarding), and F (FPGA queries session table entry). FPGA processing consists of two processes:

[0069] 1) The processing flow when the FPGA does not have a session entry is A1—F—A2—B1—B2. The specific process can be explained as follows: after the FPGA receives the data packet, it checks whether there is a session entry for the data stream. If not, it is sent to the CPU. After the CPU establishes a session, it sends the session entry to the FPGA. Finally, the data packet is forwarded out from the FPGA interface.

[0070] 2) The processing flow of the FPGA with a session entry for this data stream is: A1—F—C1—B2. The specific process can be explained as follows: after the FPGA receives the data packet, it checks whether there is a session entry for this data stream. If there is a session entry for this data stream, the data packet is forwarded directly from the FPGA interface.

[0071] Therefore, the working process of this technical solution is as follows: After receiving the data packet, the FPGA checks whether there is a session entry for the data stream. If there is a session entry for the data stream, the data packet is forwarded directly from the FPGA interface; if not, the data packet is sent to the CPU. The CPU processes the data packet, establishes a session entry, sends the session entry for the data stream to the FPGA, and then forwards it from the FPGA interface.

[0072] This technical solution cannot achieve data flow access control for devices and equipment that require access control functions. Specifically, when the FPGA receives a data packet, if a session entry for that data flow exists, the FPGA will directly forward the data packet without controlling the passage or blocking of the data flow.

[0073] To address the aforementioned technical problems, this application provides an access control method that combines a CPU and an FPGA. The FPGA maintains a global session age value and the corresponding session entry age value. Access control for packets to be forwarded is implemented based on these global and session entry age values. Therefore, by combining the CPU with the high-performance data forwarding capabilities achieved through FPGA, data access control can be realized.

[0074] Figure 2 This is a schematic flowchart of an access control method provided in an embodiment of this application, such as... Figure 2 As shown, this method is applied to an FPGA. It can be understood that the FPGA can be a functional component of an access control device, which can be a firewall device or other network device with access control functionality. The access control device can be used to forward messages between two electronic devices, where both electronic devices can be terminals, a terminal and a server respectively, or both servers; this application embodiment does not specifically limit this. The access control method includes:

[0075] Step 201: Receive the message to be forwarded;

[0076] Step 202: If a session entry corresponding to the message to be forwarded exists, the message to be forwarded is processed according to the session entry age value and the global session age value to achieve access control over the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU.

[0077] In step 201, the FPGA receives a message to be forwarded from an electronic device (terminal or server).

[0078] In step 202, the FPGA stores session entries issued by the CPU, the session entry age values ​​corresponding to each session entry, and the global session age value. The session entries are used by the FPGA for fast packet forwarding and lookup. The session entry age value identifies the current session entry's survival value and can be represented using numbers, letters, or combinations of numbers. The global session age value serves a similar purpose, managing the survival value of all session entries. For example, when the CPU initializes and generates session entries, its session entry age value and global session age value can be 0. If the access control policy is modified, the global session age value is updated to 1. Each modification to the access control policy increments the global session age value by 1. Access control policy modifications include adding, deleting, and modifying the specific content of the access control policy. When the CPU synchronizes session entries with the FPGA, the age value of the synchronized session entry is the same as the current global session age value. It is understood that the specific values ​​of the global session age value and the session entry age value mentioned above are just examples. In practical applications, other values ​​may be used, and this application does not specifically limit them.

[0079] After receiving a message to be forwarded, the FPGA checks whether a session entry corresponding to the message is stored. If it exists, it obtains the session entry age value and the global session age value of the corresponding session entry. Based on the session entry age value and the global session age value, it determines whether the message to be forwarded needs to be sent to the CPU, and the CPU processes the message to be forwarded.

[0080] In this embodiment, after receiving the message to be forwarded, the FPGA determines the processing method of the message to be forwarded based on the session entry age value and the global session age value, which can achieve access control of the message to be forwarded while satisfying high-performance forwarding.

[0081] Based on the above embodiments, the process of processing the packet to be forwarded according to the session table entry age value and the global session age value corresponding to the session table entry includes:

[0082] If the age value of the session entry is the same as the global session age value, then the packet to be forwarded will be forwarded from the network interface.

[0083] If the age value of the session entry is different from the global session age value, the message to be forwarded is reported to the CPU, which then processes the message.

[0084] In the specific implementation process, if there is a session table entry in the FPGA corresponding to a message to be forwarded, and the age value of the session table entry is the same as the global session age value, it means that the session table entry is valid, and the FPGA can forward the message to be forwarded through the corresponding port.

[0085] If the session age value corresponding to a session entry differs from the global session age value, it indicates that the session entry stored in the FPGA has expired. To ensure the security of the electronic device, the FPGA sends the message to be forwarded to the CPU, which then processes the received message. Understandably, after receiving the message, the CPU parses it, generates a corresponding session entry, matches a security access policy to that entry, and determines whether the message can be forwarded based on the policy. If the message is allowed to pass, the CPU forwards it; otherwise, it discards the message.

[0086] In this embodiment, if the session entry age value is different from the global session age value, it means that the session entry has become outdated. Even if the FPGA stores the session entry of the message to be forwarded, the CPU still needs to perform access control on the message to be forwarded again, thereby realizing the function of access control on the message to be forwarded.

[0087] Based on the above embodiments, the method further includes:

[0088] If there is no session table entry corresponding to the message to be forwarded, the message to be forwarded is reported to the CPU, which then processes it.

[0089] In the specific implementation process, after the FPGA receives a message to be forwarded, if the FPGA does not have a corresponding session table entry for the message, it indicates that access control of the message to be forwarded is required. The FPGA then sends the message to the CPU for processing. It is understood that the method for the CPU to perform access control processing on the message to be forwarded can be found in the above embodiments, and will not be repeated here.

[0090] Figure 3 This is a schematic diagram of another access control method provided in an embodiment of this application, such as... Figure 3 As shown, the method includes:

[0091] Step 301: Receive the message to be forwarded;

[0092] Step 302: Determine whether a session entry corresponding to the message to be forwarded is stored; After receiving the message to be forwarded, the FPGA determines whether a session entry corresponding to the message to be forwarded is stored. If so, proceed to step 303; otherwise, proceed to step 305.

[0093] Step 303: Determine whether the session entry age value is equal to the global session age value; if the session entry age value is the same as the global session age value, proceed to step 304; otherwise, proceed to step 305.

[0094] Step 304: Forward the message to be forwarded;

[0095] Step 305: Send a forwarding message to the CPU.

[0096] In this embodiment, if the session entry for the message to be forwarded does not exist in the FPGA, the message to be forwarded is processed by the CPU, which improves data security.

[0097] Based on the above embodiments, the method further includes:

[0098] Receive an update instruction sent by the CPU to update the global session age value. The update instruction is generated by the CPU when it detects a change in the access control policy.

[0099] The stored global session age value will be updated according to the update command.

[0100] In the specific implementation process, the access control policies corresponding to each session entry in the CPU can be changed according to the actual situation. The CPU can monitor the access control policies of each session entry. When the access control policy of a session entry changes, the global session age value is updated, and an update instruction is sent to the FPGA. This allows the FPGA to update its stored global session age value upon receiving the update instruction. Therefore, the FPGA can determine whether its stored session entries have been modified through the global session age value and the session entry age value. Once it is determined that a session entry has been modified, it sends the message to be forwarded to the CPU upon receiving the message to be forwarded, and the CPU performs access control on it.

[0101] In this embodiment, the CPU detects a change in the access control policy and synchronously updates the global session age value in the FPGA, so that the FPGA can perform access control on the packets to be forwarded based on the global session age value and the age values ​​of each session table entry.

[0102] Based on the above embodiments, the method further includes:

[0103] Receive a table entry deletion instruction sent by the CPU, wherein the table entry deletion instruction includes the session table entry to be deleted, and the table entry deletion instruction is generated by the CPU after determining that the message corresponding to the session table entry to be deleted is an invalid message;

[0104] Delete the session entry to be deleted according to the entry deletion command.

[0105] In the specific implementation process, when the FPGA stores session entries corresponding to packets to be forwarded, but the age value of these session entries differs from the global session age value, after receiving the packet to be forwarded from the FPGA, if the CPU determines the packet to be forwarded to be invalid according to the access control policy, it adds a deletion flag to the session entry queue and sends a deletion instruction to the FPGA. Upon receiving the deletion instruction, the FPGA deletes the corresponding session entry stored in its memory according to the deletion instruction.

[0106] In this embodiment, since the access control policy corresponding to each message to be forwarded in the CPU can change, the message may pass through at one moment but not at the next moment. Therefore, after the CPU determines that the message to be forwarded cannot pass through, it sends an instruction to the FPGA to delete the session table entry of the message to be forwarded, so that the message will re-enter the CPU for access control when it re-enters the CPU.

[0107] Figure 4 This is a schematic diagram of another access control method provided in an embodiment of this application, such as... Figure 4 As shown, this method is applied to the CPU, which is understood to be a functional component of the access control device. The access control device can be a firewall or other network device with access control functionality. The access control device can be used to forward messages between two electronic devices, where both electronic devices can be terminals, one a terminal and the other a server, or both servers; this application does not specifically limit this. The access control method includes:

[0108] Step 401: Generate a global session age value and a session entry queue; wherein the session entry queue includes session entries;

[0109] Step 402: Send the global session age value and the session entry to the FPGA.

[0110] In the specific implementation process, during initialization, a global session age value can be generated in the CPU. It is understood that the initial value of the global session age value can be 0, or it can be other representations, such as v1.0, etc. This embodiment does not specifically limit this. After generating the global session age value, it is sent to the FPGA.

[0111] Additionally, a session entry queue is generated in the CPU, storing the session entries created by the CPU. When the CPU creates a session entry for a packet to be forwarded, it also sends the session entry to the FPGA. Understandably, if both the session entry and the global session age value are generated during initialization, the CPU can send both the global session age value and the session entry to the FPGA together. If the session entry queue contains a session entry for a newly created packet, the CPU can send an instruction to the FPGA to update the global session age value, and also send the session entry to the FPGA. The session entry age value corresponding to the session entry sent to the FPGA is the same as the updated global session age value.

[0112] In this embodiment, the CPU sends a global session age value and a session entry to the FPGA, so that after the FPGA receives the message to be forwarded, it determines the processing method of the message to be forwarded based on the session entry age value and the global session age value. This can achieve access control of the message to be forwarded while satisfying high-performance forwarding.

[0113] Based on the above embodiments, the method further includes:

[0114] Receive the message to be forwarded sent by the FPGA; wherein the message to be forwarded is sent when there is no session entry corresponding to the message to be forwarded in the FPGA, or when there is a session entry but the age value of the session entry is different from the global session age value.

[0115] Establish session entries corresponding to the packets to be forwarded, and match access control policies for the packets to be forwarded;

[0116] If the access control policy allows the packet to be forwarded to pass, the session entry is written into the session entry queue, and the FPGA is controlled to forward the packet.

[0117] In the specific implementation process, as can be seen from the above embodiments, there are two situations in which the FPGA sends a message to be forwarded to the CPU. The first is that there is no session entry in the FPGA corresponding to the message to be forwarded; the second is that the FPGA stores a session entry corresponding to the message to be forwarded, but the age value of the session entry is different from the global age value.

[0118] Therefore, in the first scenario, after receiving the packet to be forwarded from the FPGA, the CPU establishes a session entry corresponding to the packet and matches it with an access control policy. This access control policy is pre-configured. If the packet meets the requirements of the access control policy, it is determined to be a valid packet, and the CPU forwards it through the FPGA's network port. Furthermore, the CPU writes the established session entry into the session entry queue.

[0119] In the second scenario, after receiving the message to be forwarded from the FPGA, the CPU does not need to re-establish the session entry for that message since a session entry for that message has already been created. The CPU matches the message to be forwarded with the access control policy. If the match is successful, it means that the message to be forwarded is allowed to pass. The CPU forwards the message and sends an instruction to the FPGA to update the session entry age value corresponding to the message to be forwarded. After receiving the instruction, the FPGA updates the corresponding session entry age value to be equal to the current global session age value.

[0120] Understandably, the CPU also monitors in real time whether the session entry queue has changed. If it has changed, it sends a control instruction to the FPGA to add a new session entry to the session entry queue and the corresponding session entry age value. The session entry age value is the same as the current global session age value.

[0121] In this embodiment, when there is no session entry for the message to be forwarded in the FPGA, or when the age value of the session entry for the message to be forwarded is different from the global session age value, the forwarding message is sent to the CPU, and the CPU controls the forwarding message, thereby improving the security of the terminal device.

[0122] Based on the above embodiments, the method further includes:

[0123] If the access control policy does not allow the packet to be forwarded to pass, the packet to be forwarded will be discarded, and a deletion flag will be added to the session entry queue corresponding to the packet to be forwarded.

[0124] In the specific implementation process, as can be seen from the above embodiments, there are two situations in which the FPGA sends a message to be forwarded to the CPU. The first is that there is no session entry in the FPGA corresponding to the message to be forwarded; the second is that the FPGA stores a session entry corresponding to the message to be forwarded, but the age value of the session entry is different from the global age value.

[0125] In the second scenario, after receiving the message to be forwarded from the FPGA, the CPU matches the message with a pre-matched access control policy. If the message does not meet the requirements of the access control policy, it is determined to be an illegal message, and the CPU discards it. Furthermore, the CPU can add a deletion flag to the session entry corresponding to the message to be forwarded in the session entry queue.

[0126] Understandably, the CPU also monitors the session entry queue in real time for changes. If a change occurs, it retrieves the session entry containing the deletion flag from the queue and generates a corresponding control instruction. This control instruction includes the session entry to be deleted. The generated control instruction is sent to the FPGA, which then deletes the corresponding session entry it stores based on the control instruction.

[0127] In this embodiment, by adding a deletion flag to the session entry queue, the FPGA can be controlled to delete the corresponding session entry. Subsequent packets will still need to be accessed and controlled by the CPU, thus improving the security of the terminal device.

[0128] Based on the above embodiments, the method further includes:

[0129] If a change in access control policy is detected, the global session age value is updated and synchronized to the FPGA.

[0130] In the specific implementation process, if the CPU detects a change in the access control policy, it means that the session entries stored in the FPGA have become invalid. In order to indicate that the session entries stored in the FPGA have become invalid, the global session age value can be updated by sending an update to the FPGA, so that the global session age value in the FPGA is different from the session entry age value corresponding to the session entry.

[0131] This application embodiment uses a global session age value to enable the FPGA to determine whether a message to be forwarded needs to be reported to the CPU, thereby realizing access control for the message to be forwarded.

[0132] Figure 5 This is a schematic diagram of another access control method provided in the embodiments of this application, such as... Figure 5 As shown, this includes forwarding strategies for various scenarios, as detailed below:

[0133] Scene 1:

[0134] Step A1: The FPGA receives the message to be forwarded;

[0135] Step F: Check if there is a session table entry corresponding to the message to be forwarded. If it exists, the session table entry age value corresponding to this session table entry is the same as the global session age value.

[0136] Step C1: Determine whether to forward the message to be forwarded;

[0137] Step B2: Forward the message to be forwarded from the port.

[0138] Scene 2:

[0139] Step A1: The FPGA receives the message to be forwarded;

[0140] Step F: The query revealed that there is no session table entry corresponding to the message to be forwarded;

[0141] Step A2: The FPGA sends the message to be forwarded to the CPU. The CPU establishes a session table entry and determines whether the message to be forwarded is a valid message according to the access control policy.

[0142] Step B1: The CPU sends the newly established session entry and session entry age to the FPGA;

[0143] Step B2: The FPGA forwards the message.

[0144] Scene 3:

[0145] Step D1: After the CPU detects a change in the access control policy, it updates the global session age value and sends the updated global session age value to the FPGA.

[0146] Figure 6 This is a schematic diagram of an access control device structure provided in an embodiment of this application. The device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 2 The method implementation corresponds to this and can be executed. Figure 2 The various steps involved in the method embodiment, and the specific functions of the device, can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes: a message receiving module 601 and a message processing module 602, wherein:

[0147] The message receiving module 601 is used to receive messages to be forwarded;

[0148] The message processing module 602 is used to process the message to be forwarded according to the session entry age value and the global session age value if a session entry corresponding to the message to be forwarded exists, so as to realize access control of the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU.

[0149] Based on the above embodiments, the message processing module 602 is specifically used for:

[0150] If the age value of the session entry is the same as the global session age value, then the packet to be forwarded will be forwarded from the network interface.

[0151] If the age value of the session entry is different from the global session age value, the message to be forwarded is reported to the CPU, which then processes the message.

[0152] Based on the above embodiments, the device further includes a message reporting module, used for:

[0153] If there is no session table entry corresponding to the message to be forwarded, the message to be forwarded is reported to the CPU, which then processes it.

[0154] Based on the above embodiments, the device further includes a global session age value update module, used for:

[0155] Receive an update instruction sent by the CPU to update the global session age value, wherein the update instruction is generated by the CPU when it detects a change in the access control policy;

[0156] The stored global session age value will be updated according to the update instruction.

[0157] Based on the above embodiments, the device further includes an entry deletion module, used for:

[0158] The CPU receives a table entry deletion instruction, wherein the table entry deletion instruction includes a session table entry to be deleted, and the table entry deletion instruction is generated by the CPU after determining that the message corresponding to the session table entry to be deleted is an invalid message;

[0159] The session entry to be deleted is deleted according to the entry deletion instruction.

[0160] Figure 7 This is a schematic diagram of another access control device structure provided in an embodiment of this application. This device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 4 The method implementation corresponds to this and can be executed. Figure 4 The various steps involved in the method embodiment, and the specific functions of the device, can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes: a generation module 701 and a sending module 702, wherein:

[0161] The generation module 701 is used to generate a global session age value and a session entry queue; wherein, the session entry queue includes session entries;

[0162] The sending module 702 is used to send the global session age value and the session entry to the FPGA.

[0163] Based on the above embodiments, the device further includes a first access control module, used for:

[0164] Receive a message to be forwarded sent by the FPGA; wherein the message to be forwarded is sent when there is no session entry corresponding to the message to be forwarded in the FPGA, or when there is a session entry but the age value of the session entry is different from the global session age value.

[0165] Establish a session table entry corresponding to the message to be forwarded, and match an access control policy for the message to be forwarded;

[0166] If the access control policy allows the packet to be forwarded to pass, the session entry is written into the session entry queue, and the packet to be forwarded is forwarded through the network port of the FPGA.

[0167] Based on the above embodiments, the device further includes a second access control module, used for:

[0168] If the access control policy does not allow the packet to be forwarded to pass, the packet to be forwarded will be discarded, and a deletion flag will be added to the session entry queue corresponding to the packet to be forwarded.

[0169] Based on the above embodiments, the device further includes a first monitoring module, used for:

[0170] If a change is detected in the session entry queue, a corresponding control command is sent to the FPGA so that the FPGA updates the session entry according to the control command.

[0171] Based on the above embodiments, the device further includes a second monitoring module, used for:

[0172] If a change in access control policy is detected, the global session age value is updated, and the updated global session age value is synchronized to the FPGA.

[0173] Figure 8 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 8 As shown, the electronic device includes: a processor 801, a memory 802, and a bus 803; wherein,

[0174] The processor 801 and the memory 802 communicate with each other through the bus 803;

[0175] The processor 801 is used to call program instructions in the memory 802 to execute the methods provided in the above-described method embodiments, such as: receiving a message to be forwarded; if a session entry corresponding to the message to be forwarded exists, processing the message to be forwarded according to the session entry age value and the global session age value to achieve access control over the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU.

[0176] Generate a global session age value and a session entry queue; wherein the session entry queue includes session entries; send the global session age value and the session entries to the FPGA.

[0177] The processor 801 can be an integrated circuit chip with signal processing capabilities. The processor 801 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0178] The memory 802 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0179] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when these instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as: receiving a message to be forwarded; if a session entry corresponding to the message to be forwarded exists, processing the message to be forwarded according to the session entry age value and the global session age value to achieve access control over the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU. Or

[0180] Generate a global session age value and a session entry queue; wherein the session entry queue includes session entries; send the global session age value and the session entries to the FPGA.

[0181] This embodiment provides a non-transitory computer-readable storage medium storing computer instructions. These computer instructions cause the computer to execute the methods provided in the above-described method embodiments, including, for example, receiving a message to be forwarded; if a session entry corresponding to the message to be forwarded exists, processing the message to be forwarded according to the session entry age value and the global session age value to achieve access control over the message to be forwarded; wherein the session entry age value and the global session age value are sent by the CPU.

[0182] or

[0183] Generate a global session age value and a session entry queue; wherein the session entry queue includes session entries; send the global session age value and the session entries to the FPGA.

[0184] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0185] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0186] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0187] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0188] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An access control method characterized by, Applications in Field Programmable Gate Arrays (FPGAs) include: Receive messages to be forwarded; If a session entry corresponding to the packet to be forwarded exists, the packet to be forwarded is processed according to the session entry age value and the global session age value to achieve access control over the packet to be forwarded; wherein, the session entry age value and the global session age value are sent by the CPU; the session entry age value is used to identify the survival value of the current session entry; the global session age value is used to coordinate the survival values ​​of all session entries. The process of processing the message to be forwarded based on the session entry age value and the global session age value corresponding to the session entry includes: If the age value of the session entry is the same as the global session age value, then the packet to be forwarded will be forwarded from the network interface. If the age value of the session entry is different from the global session age value, the message to be forwarded is reported to the CPU, which then processes the message.

2. The method of claim 1, wherein, The method further includes: If there is no session table entry corresponding to the message to be forwarded, the message to be forwarded is reported to the CPU, which then processes it.

3. The method according to claim 1, characterized in that, The method further includes: Receive the update instruction sent by the CPU to update the global session age value; The stored global session age value will be updated according to the update instruction.

4. The method according to claim 1, characterized in that, The method further includes: The CPU receives a table entry deletion instruction, wherein the table entry deletion instruction includes a session table entry to be deleted, and the table entry deletion instruction is generated by the CPU after determining that the message corresponding to the session table entry to be deleted is an invalid message; The session entry to be deleted is deleted according to the entry deletion instruction.

5. An access control method, characterized in that, Applied to a CPU, the method includes: Generate a global session age value and a session entry queue; wherein, the session entry queue includes session entries; Send the global session age value and the session entry to the FPGA; The method further includes: Receive a message to be forwarded sent by the FPGA; wherein the message to be forwarded is sent when there is no session entry corresponding to the message to be forwarded in the FPGA, or when there is a session entry but the age value of the session entry is different from the global session age value. Establish a session table entry corresponding to the message to be forwarded, and match an access control policy for the message to be forwarded; If the access control policy allows the packet to be forwarded to pass, the session entry is written into the session entry queue, and the packet to be forwarded is forwarded out through the network interface of the FPGA; the session entry includes a session entry age value; the session entry age value is used to identify the survival value of the current session entry; the global session age value is used to coordinate the survival values ​​of all session entries.

6. The method according to claim 5, characterized in that, The method further includes: If the access control policy does not allow the packet to be forwarded to pass, the packet to be forwarded will be discarded, and a deletion flag will be added to the session entry queue corresponding to the packet to be forwarded.

7. The method according to claim 6, characterized in that, The method further includes: If a change is detected in the session entry queue, a corresponding control command is sent to the FPGA so that the FPGA updates the session entry according to the control command.

8. The method according to any one of claims 5-7, characterized in that, The method further includes: If a change in access control policy is detected, the global session age value is updated, and the updated global session age value is synchronized to the FPGA.

9. An access control device, characterized in that, Applied to FPGAs, including: The message receiving module is used to receive messages to be forwarded; The message processing module is used to process the message to be forwarded according to the session entry age value and the global session age value if a session entry corresponding to the message to be forwarded exists, so as to realize access control over the message to be forwarded; wherein, the session entry age value and the global session age value are sent by the CPU; the session entry age value is used to identify the survival value of the current session entry; the global session age value is used to coordinate the survival values ​​of all session entries. The message processing module is specifically used for: If the age value of the session entry is the same as the global session age value, then the packet to be forwarded will be forwarded from the network interface. If the age value of the session entry is different from the global session age value, the message to be forwarded is reported to the CPU, which then processes the message.

10. An access control device, characterized in that, Applied to CPUs, including: A generation module is used to generate a global session age value and a session entry queue; wherein, the session entry queue includes session entries; The sending module is used to send the global session age value and the session entry to the FPGA; The device is also used for: Receive a message to be forwarded sent by the FPGA; wherein the message to be forwarded is sent when there is no session entry corresponding to the message to be forwarded in the FPGA, or when there is a session entry but the age value of the session entry is different from the global session age value. Establish a session table entry corresponding to the message to be forwarded, and match an access control policy for the message to be forwarded; If the access control policy allows the packet to be forwarded to pass, the session entry is written into the session entry queue, and the packet to be forwarded is forwarded through the network port of the FPGA; the session entry includes a session entry age value.

11. An electronic device, characterized in that, include: Processor, memory, and bus, among which, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the method as described in any one of claims 1-8 by calling the program instructions.

12. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-8.

Images