Flow table updating method, device, firewall device and storage medium

Abstract

The present disclosure provides a flow table update method, apparatus, firewall device, and storage medium, relating to the field of artificial intelligence technology, specifically cloud computing and load balancing technology. The method is applicable in intelligent cloud scenarios, comprising: obtaining a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field; determining a target access control list that matches the target hardware forwarding session flow table; and updating the message processing action field of the target hardware forwarding session flow table based on the target access control list. The disclosed embodiments can improve the efficiency and accuracy of firewall device data forwarding while ensuring the software performance of the firewall device.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, specifically to cloud computing and load balancing technology, and can be applied in intelligent cloud scenarios. Background Art

[0002] Hardware firewall technology combines various security management and screening software and hardware devices to create a relatively isolated barrier between internal and external computer networks, protecting user data and information. Currently, firewall technology is widely used in cloud computing, especially in the field of artificial intelligence in intelligent cloud scenarios. Summary of the Invention

[0003] The embodiments of the present disclosure provide a flow table updating method, apparatus, firewall device, and storage medium, which can improve the efficiency and accuracy of data forwarding of the firewall device while ensuring the software performance of the firewall device.

[0004] In a first aspect, an embodiment of the present disclosure provides a flow table update method, which is applied to a hardware firewall device, comprising:

[0005] Obtaining a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field;

[0006] Determine a target access control list that matches the target hardware forwarding session flow table;

[0007] The message processing action field of the target hardware forwarding session flow table is updated according to the target access control list.

[0008] In a second aspect, an embodiment of the present disclosure provides a flow table update device configured in a hardware firewall device, including:

[0009] A target hardware forwarding session flow table acquisition module is used to obtain a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field;

[0010] a target access control list determining module, configured to determine a target access control list that matches the target hardware forwarding session flow table;

[0011] The message processing action field updating module is used to update the message processing action field of the target hardware forwarding session flow table according to the target access control list.

[0012] In a third aspect, an embodiment of the present disclosure provides a firewall device, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the flow table updating method provided by the embodiment of the first aspect.

[0016] In a fourth aspect, an embodiment of the present disclosure further provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the flow table update method provided in the embodiment of the first aspect.

[0017] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which implements the flow table update method provided in the embodiment of the first aspect when executed by a processor.

[0018] The embodiment of the present disclosure obtains a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device, and determines a target access control list that matches the target hardware forwarding session flow table, thereby updating the message processing action field of the target hardware forwarding session flow table according to the target access control list, so that the message processing action field of the target hardware forwarding session flow table can match the data forwarding rules of the target access control list. This solves the problems of incomplete flow table content update due to resource limitation and reduced firewall device software performance in existing flow table update methods, and can improve the efficiency and accuracy of firewall device data forwarding while ensuring the software performance of the firewall device.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0021] Figure 1 This is a schematic diagram of the ACL rule matching process in the prior art;

[0022] Figure 2 This is a flow chart of a flow table updating method provided by an embodiment of the present disclosure;

[0023] Figure 3 This is a flow chart of a flow table updating method provided by an embodiment of the present disclosure;

[0024] Figure 4This is a flow chart of a flow table updating method provided by an embodiment of the present disclosure;

[0025] Figure 5 This is a flow chart of updating the action field in the hardware forwarding session flow table based on the ACL table provided by an embodiment of the present disclosure;

[0026] Figure 6 This is a flowchart of matching ACL synchronization action fields provided by an embodiment of the present disclosure;

[0027] Figure 7 This is a structural diagram of a flow table updating device provided by an embodiment of the present disclosure;

[0028] Figure 8 Schematic diagram of the structure of a firewall device used to implement the flow table updating method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0030] From a product perspective, a user's actions from entering to leaving a product constitute a visit. This is called a Session. From a technical perspective, a Session is a special object created by the server to save user status. In the field of firewall technology, a Session can be represented by a five-tuple. The five-tuple is the source IP (Internet Protocol) address, source port, destination IP address, destination port, and transport layer protocol. If the five-tuple of a datagram is the same, it means that the Session ID (Identity Document) corresponding to the datagram is the same, that is, datagrams with the same five-tuple come from the same session connection.

[0031] An ACL (Access Control List) consists of a series of conditional rules—deterministic statements that describe packet matching criteria. These conditional rules can include five-tuple information such as the source address, destination address, and port number of a packet. It is a list of instructions applied to various software and hardware interfaces of network devices. An ACL table (also known as an access control list) can include multiple packet filtering rules, or ACL rules. Devices can filter inbound and outbound data packets based on the matching conditions in the ACL table. Figure 1 This is a schematic diagram of the ACL rule matching process in the prior art. In a specific example, Figure 1 As shown in the figure, the action of each ACL rule supports two value types: allow or deny. If a data packet matches an ACL allow rule or does not match an ACL rule, the data packet is allowed to pass. If a data packet matches an ACL deny rule, the data packet is discarded.

[0032] Hardware firewall devices are typically equipped with a hardware forwarding module, such as the security module in the Tofino (a firewall designed for industrial networks) firewall device. This hardware forwarding module allows for the configuration of ACL rules at the hardware layer to quickly match received data packets and process the data packets based on the matching results, such as forwarding or discarding them. Compared to the CPU (Central Processing Unit) software layer of a hardware firewall device, the hardware forwarding module's data packet processing is more efficient and convenient. Once a data packet matches an ACL rule in the hardware forwarding module, it can be quickly processed without having to be sent to the CPU software layer for ACL rule matching.

[0033] However, the hardware forwarding module configured in a hardware firewall device is limited by memory size and can only store a small number of ACL rules, such as a few kilobytes. In contrast, the CPU software layer of a hardware firewall device may store tens of thousands or more ACL rules. Therefore, the hardware firewall device cannot match a large number of ACL rules in the hardware forwarding module. When a data packet cannot complete an ACL rule match in the hardware forwarding module, it must be sent to the CPU software layer for ACL rule matching. After the data packet matches the ACL rule in the ACL table at the CPU software layer, the corresponding session flow table and the matching ACL rule are offloaded to the hardware forwarding module. Offloading refers to the implementation of a function that was originally implemented in software in hardware. This allows some packet processing (such as fragmentation and reassembly) that was originally performed in the operating system to be performed in hardware, reducing system CPU consumption while improving processing performance.

[0034] In other words, the hardware forwarding module of a hardware firewall device currently maintains a session flow table (referred to as the session table) and a matching ACL table. The CPU software layer also maintains a session flow table and a matching ACL table. The session flow table maintained in the hardware forwarding module is part of the session flow table maintained by the CPU software layer, and the ACL table maintained in the hardware forwarding module is part of the ACL table maintained by the CPU software layer.

[0035] Because data packets that hit the upstream flow table of the hardware forwarding module no longer pass through the software layer, when the rules in the software-layer ACL table change, the hardware forwarding module is unaware of the change. This can cause data packet processing at the hardware layer to be inconsistent with expectations, such as allowing a data packet that was expected to be denied. Therefore, when the CPU software layer of the hardware firewall device detects changes to the ACL table rules, it must synchronize the changed ACL rules with the hardware forwarding module to prevent data packet processing at the hardware layer from being inconsistent with expectations.

[0036] Currently, when the CPU software layer of a hardware firewall device detects changes to the ACL table rules, there are two main solutions for synchronizing the changed ACL rules to the hardware forwarding module:

[0037] (1) The changed ACL table rule is updated to the ACL rule stored in the hardware forwarding module. The hardware forwarding module matches the new ACL rule when forwarding data packets.

[0038] (2) When the CPU software layer detects that the ACL table rule has changed, it deletes all session flow tables and ACL tables on the hardware forwarding module that are associated with the current ACL table, and sends all data packets to the CPU software layer for processing, and then goes through the ACL table matching process of the CPU software layer again.

[0039] The above existing technical solutions have the following disadvantages:

[0040] For the first type of solution, the hardware forwarding module can only store a limited number of ACL rules, usually only a few thousand, while the CPU software layer may have tens of thousands or more ACL rules. The capacity of the hardware forwarding module cannot meet the update requirements of the ACL table rule.

[0041] For the second solution, deleting all associated session flow tables and ACL tables on the hardware forwarding module will cause all corresponding data packets to be sent to the CPU for processing, which in turn causes the CPU and network card bandwidth to be increased, resulting in problems such as packet loss, traffic jitter, and reduced forwarding performance, which degrades software performance.

[0042] In one example, Figure 2 This is a flow chart of a flow table update method provided by an embodiment of the present disclosure. This embodiment is applicable to the case where the packet processing action field of the target hardware forwarding session flow table is updated according to the target access control list matched by the target hardware forwarding session flow table. This method can be executed by a flow table update device, which can be implemented by software and / or hardware and can generally be integrated into a firewall device. Figure 2 As shown, the method includes the following operations:

[0043] S210: Obtain a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field.

[0044] The hardware forwarding module is a hardware module within a hardware firewall device that implements data packet forwarding at the hardware level, such as Tofino hardware. The target hardware forwarding session flow table can be a session flow table stored in the hardware forwarding module, where the message processing action field needs to be updated. A session flow table is also known as a session table.

[0045] ACL tables are generated by user configuration. A user can configure one or more ACL tables, each of which can contain one or more ACL rules. Each ACL rule can set filtering rules for data packets from a specific data source, such as whether to allow or discard them. The data source can be determined using the quintuple information.

[0046] In the disclosed embodiments, to reduce the storage pressure on the hardware forwarding module in a hardware firewall device and improve its hardware forwarding performance, the hardware forwarding module no longer stores ACL table information. Instead, all ACL table information is stored entirely in the CPU software layer. The hardware forwarding module only stores session flow table information, enabling it to quickly forward data packets based on the stored session flow table information.

[0047] It is understandable that the basic session flow table only includes session-related information, but does not include ACL table-related information. Therefore, in order for the hardware forwarding module to implement the data packet fast-forwarding function based on the stored session flow table information, a packet processing action field can be set for the session flow table, which can be called action. The packet processing action field can record the ACL table matching result of the last session. For example, when the session connection of Session1 sends a data packet for the first time, the hardware firewall device matches the quintuple information of the data packet of Session1 with the corresponding ACL table. Each ACL rule in the ACL table can include quintuple information, that is, the ACL rule corresponding to the quintuple information in the ACL table can be searched based on the quintuple information of the data packet of Session1, so as to determine the packet processing action for the data packet of Session1 based on the matched ACL rule, whether to release or discard it. When data packets from Session 1 arrive at the hardware firewall again, the hardware forwarding module can directly perform the corresponding packet processing action on the data packets from Session 1 based on the value of the packet processing action field in the session flow table of Session 1. For example, if the value of the packet processing action field in the session flow table of Session 1 is "release", subsequent data packets from Session 1 will be released.

[0048] Therefore, to ensure that data packets are processed as expected, it is necessary to ensure that the value of the packet processing action field in the hardware forwarding session flow table stored in the hardware forwarding module matches the corresponding ACL table maintained by the CPU software layer. To this end, the CPU software layer of the hardware firewall device can obtain the session flow table with the packet processing action field that needs to be updated from the hardware forwarding module as the target hardware forwarding session flow table. It then adapts and updates the packet processing action field of the target hardware forwarding session flow table, ensuring that the packet processing action fields of all session flow tables stored in the hardware forwarding module can process data packets as expected.

[0049] S220: Determine a target access control list that matches the target hardware forwarding session flow table.

[0050] Among them, the target access control list, that is, the ACL table matched by the target hardware forwarding session flow table, includes ACL rules that can be used to update the message processing action field of the target hardware forwarding session flow table. The number of ACL rules can be one or more, and the embodiment of the present disclosure does not limit this.

[0051] S230: Update the message processing action field of the target hardware forwarding session flow table according to the target access control list.

[0052] Accordingly, after the CPU software layer determines that the target hardware forwarding session flow table whose message processing action field needs to be updated, it needs to determine the ACL table that matches the target hardware forwarding session flow table from the stored ACL tables, and determine the updated value of the message processing action field in the target hardware forwarding session flow table based on the ACL table that matches the target hardware forwarding session flow table. Then, based on the updated value of the message processing action field in the target hardware forwarding session flow table, the field value of the message processing action field of the target hardware forwarding session flow table is updated.

[0053] It can be seen that the above technical solution utilizes the hardware forwarding module in the hardware firewall device to store a session flow table including a message processing action field, so as to realize the fast forwarding processing of some data messages at the hardware level according to the stored session flow table. This not only utilizes the fast forwarding feature of the hardware forwarding module to improve the efficiency of data forwarding of the firewall device, but also avoids sending some data messages to the CPU software layer for processing, reducing the load pressure of the CPU software layer and further improving the software performance of the firewall device. At the same time, when the CPU software layer perceives that the forwarding rules of the access control list have changed, it can synchronously update the field value of the message processing action field of the session flow table stored in the hardware forwarding module, so that the hardware forwarding module can process the data message according to the expected behavior, thereby improving the accuracy of data forwarding of the firewall device. The above flow table update method can be applied to load balancing cluster network products based on hardware firewall devices, thereby improving the security of the product and the efficiency of data processing.

[0054] The embodiment of the present disclosure obtains a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device, and determines a target access control list that matches the target hardware forwarding session flow table, thereby updating the message processing action field of the target hardware forwarding session flow table according to the target access control list, so that the message processing action field of the target hardware forwarding session flow table can match the data forwarding rules of the target access control list. This solves the problems of incomplete flow table content update due to resource limitation and reduced firewall device software performance in existing flow table update methods, and can improve the efficiency and accuracy of firewall device data forwarding while ensuring the software performance of the firewall device.

[0055] In one example, Figure 3 This is a flowchart of a flow table update method provided by an embodiment of the present disclosure. Based on the technical solutions of the above embodiments, the embodiment of the present disclosure has been optimized and improved, and multiple specific optional implementation methods are provided for obtaining the target hardware forwarding session flow table and updating the message processing action field of the target hardware forwarding session flow table according to the target access control list.

[0056] like Figure 3 A flow table updating method shown includes:

[0057] S310: Obtain a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device.

[0058] The target hardware forwarding session flow table includes a message processing action field.

[0059] In an optional embodiment of the present disclosure, before obtaining the target hardware forwarding session flow table from the hardware forwarding module in the hardware firewall device, the method may further include: obtaining a software forwarding session flow table that matches each session information data of the target user and flow table association data of the software forwarding session flow table; filtering a target software forwarding session flow table from each of the software forwarding session flow tables according to the flow table association data of the software forwarding session flow table; generating a hardware forwarding session flow table to be synchronized according to the target software forwarding session flow table, and synchronizing the hardware forwarding session flow table to be synchronized to the hardware forwarding module.

[0060] Among them, the target user is also able to synchronize its corresponding Session table to the user stored in the hardware forwarding module. The software forwarding session flow table is also the user's Session table stored in the CPU software layer. The flow table associated data can be any Session-related information such as bps (bits per second, i.e. bit rate), pps (Precision Positioning System, the unit of network throughput) and user priority, which can reflect the network behavior performed by the target user through the Session. The target software forwarding session flow table is also selected for the target user, and the information can be synchronized to the partial Session table stored in the hardware forwarding module to realize fast forwarding processing of data packets. The hardware forwarding session flow table to be synchronized is generated according to the target software forwarding session flow table, and needs to be synchronized to the hardware forwarding session flow table stored in the hardware forwarding module.

[0061] It is understandable that due to the limited hardware storage capacity of the hardware forwarding module, it is impossible for the hardware forwarding module to store all the session tables of the CPU software layer. Therefore, in order to save the hardware flow table resources of the hardware firewall device, the hardware firewall device needs to select some session tables from all the session tables and synchronize them to the hardware forwarding module. Optionally, the hardware firewall device can follow certain rules to select the session tables that need to be synchronized to the hardware forwarding module from all the session tables. First, the CPU software layer can filter the target user from all the users. For example, the target user can be filtered from all the users based on relevant information such as user level or priority. It is understandable that one or more session tables can be generated for one user. Therefore, after the CPU software layer determines the target user, if the number of session tables corresponding to the target user is too large, the session tables corresponding to the target user can be further filtered.

[0062] Optionally, the CPU software layer can obtain the software forwarding session flow table that matches each session information data of the target user, that is, obtain all the Session tables corresponding to the target user, and obtain the flow table association data of all the Session tables corresponding to the target user. Furthermore, the CPU can filter out the Session tables that occupy a large traffic bandwidth, have a high access frequency, or are of high importance from all the Session tables based on the flow table association data as the target software forwarding session flow table, that is, the target Session table. After obtaining the target Session table, the hardware forwarding session flow table to be synchronized can be generated based on the target Session table. Optionally, the Session table stored in the CPU software layer can set the message processing action field or not set the message processing action field, and the embodiments of the present disclosure do not limit this.

[0063] For example, assuming the target session table does not include a message processing action field, the target session table is configured to add a message processing action field and assign a value to the added message processing action field based on the matching ACL table to obtain a hardware forwarding session flow table to be synchronized. Alternatively, if the target session table includes a message processing action field, the sorting order of each target session table can be determined to obtain the hardware forwarding session flow table to be synchronized after sorting each target session table. After the hardware forwarding session flow table to be synchronized is generated, the CPU software layer can synchronize the hardware forwarding session flow table to be synchronized to the hardware forwarding module for storage, so that the hardware forwarding module can use it to forward data packets.

[0064] The above technical solution, by screening the target software forwarding session flow table of the target user to generate the hardware forwarding session flow table to be synchronized, and synchronizing the hardware forwarding session flow table to be synchronized to the hardware forwarding module, can maximize the hardware forwarding performance of the hardware forwarding module, improve the hardware forwarding capability of the hardware forwarding module, and thereby improve the data processing capability of the hardware firewall device.

[0065] In an optional embodiment of the present disclosure, obtaining the target hardware forwarding session flow table from the hardware forwarding module in the hardware firewall device may include: determining a preset flow table detection period configured for the hardware forwarding session flow table; determining a target flow table detection period based on the preset flow table detection period; and when it is determined that the target flow table detection period has been reached, obtaining all hardware forwarding session flow tables from the hardware forwarding module as the target hardware forwarding session flow table.

[0066] The preset flow table detection period may be a period set for obtaining the target hardware forwarding session flow table, and may be set based on actual needs, for example, 1 second or 2 seconds. The present disclosure does not limit the specific value of the preset flow table detection period. The target flow table detection period may be the actual period used to obtain the target hardware forwarding session flow table, and may be determined based on the preset flow table detection period.

[0067] In an embodiment of the present disclosure, a variety of optional implementation methods for obtaining a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device are provided. One of the optional implementation methods is: the CPU software layer determines the target flow table detection period for obtaining the target hardware forwarding session flow table based on the preset flow table detection period configured for the hardware forwarding session flow table. For example, when the preset flow table detection period is 2s, the CPU software layer can randomly select a time value from the time range of 0-2s as the target flow table detection period. It is understandable that the target flow table detection period for obtaining the target hardware forwarding session flow table each time can be the same or different, and the embodiment of the present disclosure does not limit this. When the target flow table detection period is reached, the CPU software layer can obtain all the hardware forwarding session flow tables stored in the hardware forwarding module as the target hardware forwarding session flow table. It is understandable that among the target hardware forwarding session flow tables obtained in this way, some target hardware forwarding session flow tables do not need to update the message processing action field.

[0068] In the above implementation method of obtaining the target hardware forwarding session flow table, the CPU software layer does not need to judge the ACL table and can quickly obtain the target hardware forwarding session flow table when the target flow table detection cycle is reached, thereby improving the efficiency of obtaining the target hardware forwarding session flow table.

[0069] In an optional embodiment of the present disclosure, obtaining the target hardware forwarding session flow table from the hardware forwarding module in the hardware firewall device may include: determining the access control list to be synchronized and updated based on the list update content of the access control list; determining the hardware forwarding session flow table that matches the access control list to be synchronized and updated in the hardware forwarding module as the target hardware forwarding session flow table; and directionally obtaining the target hardware forwarding session flow table from the hardware forwarding module.

[0070] The updated content of the list is the updated content of the ACL rule in the ACL table. The access control list to be updated synchronously may be an ACL table that can cause the field value of the packet processing action field of the hardware forwarding session flow table in the hardware forwarding module to be updated.

[0071] In an embodiment of the present disclosure, another optional implementation method for obtaining a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device is as follows: the CPU software layer monitors each ACL table in real time. When a change is detected in the content of a particular ACL table, the CPU software layer can determine, based on the updated content of the ACL table, whether the changed content can cause an update operation on the message processing action field of the hardware forwarding session flow table in the hardware forwarding module. If it is determined that the updated content of the ACL table can cause an update operation on the message processing action field of the hardware forwarding session flow table in the hardware forwarding module, the ACL table can be determined as an access control list to be synchronized and updated, and the hardware forwarding session flow table that matches the access control list to be synchronized and updated in the hardware forwarding module can be determined as the target hardware forwarding session flow table. The hardware forwarding session flow table that matches the access control list to be synchronized and updated in the hardware forwarding module can be understood as the access control list to be synchronized and updated and the matching hardware forwarding session flow table contain the same five-tuple information. Accordingly, after determining the target hardware forwarding session flow table, the CPU software layer can obtain the target hardware forwarding session flow table from the hardware forwarding module in a targeted manner, without having to obtain all hardware forwarding session flow tables.

[0072] In the above implementation of obtaining the target hardware forwarding session flow table, the CPU software layer can directionally obtain the hardware forwarding session flow table whose message processing action field needs to be updated as the target hardware forwarding session flow table, thereby improving the accuracy of obtaining the target hardware forwarding session flow table.

[0073] In an optional embodiment of the present disclosure, determining the access control list to be synchronized and updated based on the list update content of the access control list may include: obtaining the flow table check and value parameters of each of the access control lists; when it is determined that the flow table check and value parameters have changed, obtaining the forwarding change content of the changed access control list in which the flow table check and value parameters have changed; and determining the access control list to be synchronized and updated based on the forwarding change content of the changed access control list.

[0074] The flow table checksum value parameter may be a parameter used to verify whether the content of the ACL table has changed. Optionally, the ACL table checksum, that is, the checksum of the ACL table, may be used as the flow table checksum value parameter. When the ACL table checksum is different from the previous ACL table checksum value, it indicates that the content of the ACL table has changed. When the ACL table checksum is the same as the previous ACL table checksum value, it indicates that the content of the ACL table has not changed. The changed access control list may be the ACL table in which the ACL rule has changed. The forwarded change content may be the specific changed content of the ACL rule.

[0075] Optionally, when determining the access control lists to be synchronized based on the updated content of the access control lists, the CPU software layer can obtain the flow table checksum value parameters of each access control list to filter out the ACL tables whose flow table checksum value parameters have changed as the changed access control lists. It is understandable that although the list content of the changed access control list has changed, some changes do not require updating the message processing action field included in the corresponding target hardware forwarding session flow table. Therefore, the CPU software layer needs to further process the changed access control list, namely, obtain the forwarding change content of the changed access control list, judge the forwarding change content, and determine the changed access control list whose forwarding change content can cause an update operation of the message processing action field included in the corresponding target hardware forwarding session flow table as the access control list to be synchronized.

[0076] The above technical solution determines the access control list to be synchronized and updated by changing the forwarding change content of the access control list, which can further improve the accuracy of obtaining the target hardware forwarding session flow table.

[0077] S320: Determine a target access control list that matches the target hardware forwarding session flow table.

[0078] Optionally, in an implementation where the CPU software layer obtains all hardware forwarding session flow tables as the target hardware forwarding session flow table through a target flow table detection period, the CPU software layer may determine a target access control list that matches the target hardware forwarding session flow table based on the five-tuple information included in the hardware forwarding session flow table and the access control list. Specifically, the access control list having the same five-tuple information as the five-tuple information of the target hardware forwarding session flow table is determined as the target access control list that matches the target hardware forwarding session flow table.

[0079] Optionally, in an implementation method in which the CPU software layer accurately determines the access control list to be synchronized and updated, and obtains the target hardware forwarding session flow table based on the access control list to be synchronized and updated, the CPU software layer can use the access control list to be synchronized and updated as the target access control list of the target hardware forwarding session flow table that matches the access control list to be synchronized and updated.

[0080] S330: Obtain the forwarding change content of the target access control list.

[0081] S340: Update the message processing action field of the target hardware forwarding session flow table according to the forwarding change content of the target access control list.

[0082] Optionally, in an implementation method in which the CPU software layer obtains all hardware forwarding session flow tables as the target hardware forwarding session flow table through a target flow table detection cycle, before obtaining the forwarding change content of the target access control list, the following operations may also be included: obtaining the flow table checksum value parameters of the target access control list; and when it is determined that the flow table checksum value parameters have changed, obtaining the forwarding change content of the target access control list.

[0083] That is, in the implementation method in which the CPU software layer obtains all hardware forwarding session flow tables as the target hardware forwarding session flow table through the target flow table detection cycle, the CPU software layer first needs to obtain the flow table checksum value parameters of the target access control list to confirm whether the content of the target access control list has changed based on the change of the flow table checksum value parameters of the target access control list. If it is determined that the flow table checksum value parameters have changed, it indicates that the target hardware forwarding session flow table that matches the target access control list may need to update the message processing action field. Therefore, the CPU software layer can obtain the forwarding change content of the target access control list whose flow table checksum value parameters have changed, and update the message processing action field of the target hardware forwarding session flow table based on the forwarding change content of the target access control list whose flow table checksum value parameters have changed. The advantage of this setting is that it can avoid the update operation of the message processing action field of all hardware forwarding session flow tables one by one, thereby improving the accuracy and update efficiency of the hardware forwarding session flow table update.

[0084] Optionally, in an implementation method of accurately determining the access control list to be synchronized and updated through the CPU software layer to obtain the target hardware forwarding session flow table based on the access control list to be synchronized and updated, since the CPU software layer has already performed a screening operation on the access control list to be synchronized and updated that matches the target hardware forwarding session flow table (that is, the target access control list that the target hardware forwarding session flow table matches) when directionally obtaining the target hardware forwarding session flow table, there is no need to determine the flow table checksum value parameter of the target access control list, and the forwarding change content of the target access control list can be directly obtained, and the message processing action field of the target hardware forwarding session flow table can be updated based on the forwarding change content of the target access control list. The advantage of this setting is that based on the target hardware forwarding session flow table obtained based on the access control list to be synchronized and updated, the target access control list that matches the target hardware forwarding session flow table can be quickly determined, and the determined target access control list must include the forwarding change content, thereby improving the accuracy of the update of the message processing action field of the target hardware forwarding session flow table.

[0085] The above technical solution obtains the target hardware forwarding session flow table from the hardware forwarding module in the hardware firewall device through a variety of optional implementation methods, and determines the target access control list that matches the target hardware forwarding session flow table based on the different methods of obtaining the target hardware forwarding session flow table, and then updates the message processing action field of the target hardware forwarding session flow table according to the target access control list, enriching the diversified implementation methods of flow table updates and improving the feasibility of flow table updates.

[0086] In one example, Figure 4 This is a flowchart of a flow table update method provided by an embodiment of the present disclosure. Based on the technical solutions of the above embodiments, the embodiment of the present disclosure has been optimized and improved, and a variety of specific optional implementation methods are given for updating the message processing action field of the target hardware forwarding session flow table according to the forwarding change content of the target access control list.

[0087] like Figure 4 A flow table updating method shown includes:

[0088] S410: Obtain a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device.

[0089] The target hardware forwarding session flow table includes a message processing action field.

[0090] S420: Determine a target access control list that matches the target hardware forwarding session flow table.

[0091] S430: Obtain the forwarding change content of the target access control list.

[0092] S440: Determine the content of the target access control list before forwarding change.

[0093] The forwarding list content before the change may be the list content of the target access control list before the content, ie, the ACL rule, is changed.

[0094] S450: Update the message processing action field of the target hardware forwarding session flow table according to the pre-forwarding change list content and the forwarding change content of the target access control list.

[0095] It is understandable that when the state of the target access control list before the change is different, and the specific forwarding change content is different, the impact on the update operation of the packet processing action field of the target hardware forwarding session flow table will also be different. Therefore, after obtaining the forwarding change content of the target access control list, it is also necessary to simultaneously determine the list content of the target access control list before the forwarding change, perform a comprehensive analysis of the list content before the forwarding change and the forwarding change content of the target access control list, and update the packet processing action field of the target hardware forwarding session flow table based on the results of the comprehensive analysis.

[0096] The above technical solution can avoid invalid update operations by updating the message processing action field of the target hardware forwarding session flow table according to the list content before forwarding change and the forwarding change content of the target access control list, that is, avoid the problem of updating the message processing action field when there is no need to update the message processing action field, thereby improving the efficiency of the flow table update.

[0097] In the disclosed embodiment, each session table entry uses fields to record the last matched ACL table checksum and deny / allow action. The deny / allow action specifies the specific packet processing action, such as pass or drop, for packets that match the corresponding ACL rule in the ACL table. The ACL table checksum and deny / allow action recorded in the session table can be used to detect changes to the matching ACL table.

[0098] In an optional embodiment of the present disclosure, updating the message processing action field of the target hardware forwarding session flow table according to the forwarding list content before change and the forwarding change content of the target access control list may include: when it is determined that the forwarding list content before change of the target access control list is all configuration data for allowing data packets to be released, and the forwarding change content is newly added configuration data for discarding data packets, matching the target hardware forwarding session flow table with the target access control list; and updating the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list.

[0099] The data packet configuration data may be an ACL rule. Correspondingly, the data packet release configuration data may be an ACL rule with an action of allow, that is, an ACL rule that releases the matching data packets. The data packet discard configuration data may be an ACL rule with an action of deny, that is, an ACL rule that discards the matching data packets.

[0100] Specifically, when the CPU software layer determines that the contents of the target access control list before the forwarding change are all configuration data for allowing the release of data packets, that is, all ACL rules included in the target access control list before the content is changed are all rules with the action of allow. At the same time, it is determined that the forwarding change content is the addition of configuration data for discarding data packets, that is, the content of the target access control list that has been changed specifically includes the addition of one or more rules with the action of deny, indicating that it is necessary to add or modify the message processing action field with the field value of deny. At this time, the CPU software layer can match the target hardware forwarding session flow table with the target access control list to update the message processing action field of the target hardware forwarding session flow table based on the matching result.

[0101] The above technical solution, by using the list contents before the change as all the configuration data for allowing the release of data packets, and the forwarding change content as the change form of the newly added discarded data packet configuration data, as the basis for updating the message processing action field of the target hardware forwarding session flow table, can accurately determine the specific scenario for updating the message processing action field of the target hardware forwarding session flow table, thereby improving the efficiency of the flow table update.

[0102] In an optional embodiment of the present disclosure, updating the message processing action field of the target hardware forwarding session flow table according to the forwarding list content before change and the forwarding change content of the target access control list may include: when it is determined that the forwarding list content before change includes discarded data message configuration data and the forwarding change content is changed data message configuration data, matching the target hardware forwarding session flow table with the target access control list; and updating the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list.

[0103] The changed data packet configuration data may be an ACL rule with a changed action, for example, the action of an ACL rule with an original action of allow may be changed to deny, or the action of an ACL rule with an original action of deny may be changed to allow.

[0104] Specifically, when the CPU software layer determines that the forwarding content of the target access control list before the change includes one or more discarded data packet configuration data, that is, the target access control list before the change includes one or more rules with the action of deny. At the same time, it is determined that the forwarding change content is the change of data packet configuration data, that is, the change in the target access control list specifically includes a change in the action of one or more ACL rules, indicating that it is necessary to update the packet processing action field of the target hardware forwarding session flow table that matches the ACL rule with the changed action. At this time, the CPU software layer can match the target hardware forwarding session flow table with the target access control list to update the packet processing action field of the target hardware forwarding session flow table based on the matching result.

[0105] The above technical solution, by using the list content before the change including the discarded data packet configuration data, and the forwarding change content being the change form of the changed data packet configuration data, as the basis for changing the message processing action field of the target hardware forwarding session flow table, can accurately determine the specific scenario of updating the message processing action field of the target hardware forwarding session flow table, thereby improving the efficiency of the flow table update.

[0106] In an optional embodiment of the present disclosure, the above method may further include: prohibiting the updating of the message processing action field of the target hardware forwarding session flow table when it is determined that the list contents of the target access control list before the forwarding change are all the configuration data for allowing the release of data packets, and the forwarding change content is the newly added configuration data for allowing the release of data packets; or prohibiting the updating of the message processing action field of the target hardware forwarding session flow table when it is determined that the list contents of the target access control list before the forwarding change are all the configuration data for allowing the release of data packets, and the forwarding change content is the deletion of data packet configuration data.

[0107] In some scenarios, even if the contents of the target access control list change, the packet processing action field of the target hardware forwarding session flow table that matches the target access control list will not be updated, and this will not affect the target hardware forwarding session flow table's ability to process data packets as expected. In this case, even if the contents of the target access control list change, as long as it does not affect the matching target hardware forwarding session flow table's ability to process data packets as expected, there is no need to update the packet processing action field of the matching target hardware forwarding session flow table. This prevents the hardware firewall device from making invalid updates to the configuration data stored in the hardware forwarding module, thereby improving the overall performance of the hardware firewall device, including software performance and hardware forwarding performance, and further improving the data forwarding efficiency of the hardware firewall device.

[0108] Optionally, when the CPU software layer determines that the contents of the target access control list before the forwarding change are all configuration data for allowing the release of data packets, that is, all ACL rules included in the target access control list before the content is changed are rules with the action of allow. At the same time, it is determined that the forwarding change content is newly added configuration data for allowing the release of data packets, that is, the content of the target access control list that has been changed specifically includes one or more newly added rules with the action of allow, indicating that the newly added ACL rule allows the forwarding of data packets sent by a certain session connection. Because the hardware forwarding module defaults to allowing forwarding of missed packets, in the scenario where the content of the target access control list is changed, there is no need to update the packet processing action field. Even if the packet processing action field is not updated, when a data packet matching the newly added ACL rule arrives at the hardware firewall device, the hardware forwarding module can default the packet processing action corresponding to the data packet to allow, thereby ensuring that the data packet matching the newly added ACL rule is processed as expected.

[0109] Optionally, when the CPU software layer determines that the contents of the target access control list before the forwarding change are all configuration data for allowing the release of data packets, that is, all ACL rules included in the target access control list before the content is changed are all rules with the action of allow. At the same time, it is determined that the forwarding change content is to delete the data packet configuration data, that is, the content of the target access control list that has changed is specifically to delete one or more rules with the action of allow, that is, there is no restriction on the data packets matched by the deleted ACL rule. Since the hardware forwarding module allows forwarding of missed packets by default, there is no need to update the packet processing action field in the scenario where the content of the target access control list is changed. Even if the packet processing action field is not updated, when a data packet matched by the deleted ACL rule arrives at the hardware firewall device, the hardware forwarding module can default the packet processing action corresponding to the data packet to allow, thereby ensuring that the data packet matched by the newly added ACL rule is processed as expected.

[0110] In an optional embodiment of the present disclosure, updating the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list may include: when it is determined that the target hardware forwarding session flow table matches one hit data message configuration data of the target access control list, updating the message processing action field of the target hardware forwarding session flow table according to the hit data message configuration data; when it is determined that the target hardware forwarding session flow table matches multiple hit data message configuration data of the target access control list, determining the target data message configuration data according to the priority of the hit data message configuration data, and updating the message processing action field of the target hardware forwarding session flow table according to the target data message configuration data.

[0111] The matching data packet configuration data is the ACL rule matched by the target hardware forwarding session flow table. It is understood that a target hardware forwarding session flow table can match one or more ACL rules. For example, when a user sets multiple different ACL rules for a quintuple in one ACL table, or sets multiple different ACL rules for a quintuple in different ACL tables, if the target hardware forwarding session flow table includes the quintuple information, the target hardware forwarding session flow table can match the multiple different ACL rules set by the user for the quintuple in the ACL table. Different ACL rules corresponding to the same quintuple information can be configured with different priorities.

[0112] Specifically, when the CPU software layer updates the message processing action field of the target hardware forwarding session flow table based on the matching result between the target hardware forwarding session flow table and the target access control list, it first needs to determine the number of hit data message configuration data, that is, the number of ACL rules, matched by the target hardware forwarding session flow table. If the target hardware forwarding session flow table only matches one hit data message configuration data of the target access control list, the message processing action field of the target hardware forwarding session flow table can be directly updated based on the hit data message configuration data. If the target hardware forwarding session flow table matches multiple hit data message configuration data of the target access control list, it is necessary to determine the priority of each hit data message configuration data and filter out the hit data message configuration data with the highest priority as the target data message configuration data, so as to update the message processing action field of the target hardware forwarding session flow table based on the target data message configuration data.

[0113] The above technical solution sets a priority for each data packet configuration data, so that when the target hardware forwarding session flow table matches multiple hit data packet configuration data of the target access control list, the data packet configuration data of the message processing action field of the target hardware forwarding session flow table is determined to be updated according to the priority of the hit data packet configuration data, thereby realizing personalized flow table update operations and improving the richness of flow table update functions.

[0114] In an optional embodiment of the present disclosure, the above method may further include: upon receiving a data packet matching the newly added session information data, generating a software forwarding session flow table for the newly added session information data; upon determining that the software forwarding session flow table meets the hardware synchronization condition, obtaining an access control list matching the newly added session information data; generating a hardware forwarding session flow table matching the newly added session information data based on the software forwarding session flow table and the access control list matching the newly added session information data; and synchronizing the hardware forwarding session flow table matching the newly added session information data to the hardware forwarding module.

[0115] The newly added session information data is also the newly added Session. The hardware synchronization condition may be a condition for determining whether the Session table can be synchronized to the hardware forwarding module.

[0116] In the embodiment of the present disclosure, when a user creates a new session or a new user establishes a session, the user can initiate a data message based on the new session. Accordingly, when the hardware firewall device receives a data message that matches the new session, it can first generate a software forwarding session flow table that matches the new session and store it in the CPU software layer. At this time, the CPU software layer can query the matching access control list based on the new software forwarding session flow table to process the data message that matches the new session according to the matched access control list. Thereafter, if the hardware software layer determines that the new software forwarding session flow table meets the hardware synchronization conditions, for example, the new software forwarding session flow table belongs to the session flow table of the target user, and the priority of the new software forwarding session flow table or the user access traffic is higher, then the new software forwarding session flow table can be filtered as the target software forwarding session flow table. Furthermore, a hardware forwarding session flow table matching the newly added session information data is generated for the newly added software forwarding session flow table according to its matching access control list, and the hardware forwarding session flow table matching the newly added session information data is synchronized to the hardware forwarding module, so that the hardware forwarding module uses the synchronized hardware forwarding session flow table to quickly process the data packets matching the newly added session at the hardware level, thereby improving the efficiency and accuracy of data forwarding of the firewall device, while ensuring the software performance of the firewall device.

[0117] The above technical solution updates the message processing action field of the target hardware forwarding session flow table according to the pre-forwarding change list content and the forwarding change content of the target access control list, generates a matching hardware forwarding session flow table for the software forwarding session flow table of the newly added session information data that meets the hardware synchronization conditions, and promptly synchronizes the hardware forwarding session flow table matching the newly added session information data to the hardware forwarding module, thereby improving the efficiency and accuracy of data forwarding of the firewall device while ensuring the software performance of the firewall device.

[0118] In an example, the flow table update method provided by the embodiment of the present disclosure is specifically described by taking a tofino hardware firewall device as the hardware firewall device for flow table update and periodically obtaining the target hardware forwarding session flow table through the CPU software layer as an example.

[0119] Figure 5 This is a flow chart of updating the action field in the hardware forwarding session flow table based on the ACL table provided by the embodiment of the present disclosure. Figure 6 This is a flow chart of matching ACL synchronization action fields provided by the embodiment of the present disclosure. In a specific example, Figure 5 and Figure 6 As shown, the CPU software layer (i.e. Figure 5The LB service shown can be used to provide load balancing services) After the software forwarding session flow table, i.e., the Session table, matches the ACL, the offloaded corresponding Session table is sent to the tofino flow table. Normally, the action value of the Session table that is offloaded to the tofino flow table for the first time is allow, so as to give full play to the hardware forwarding performance of tofino while saving tofino flow table resources. Furthermore, the CPU software layer periodically obtains the offloaded Session table to check whether the matching ACL table has changed. Since the ACL table records the checksum of the table content, the number of allow rules, and the number of deny rules. Therefore, when the following changes occur, the offloaded Session table stored in tofino needs to match the ACL table at the CPU software layer to update the action field in the offloaded Session table.

[0120] First, the CPU software layer checks whether the ACL table checksum in the offload's session table has changed. If the ACL table checksum has not changed, the offload's session table does not need to match the ACL table to update the action field. If the ACL table checksum has changed, the offload's session table may need to match the ACL table to update the action field. Therefore, the CPU software layer determines whether to match the ACL table to update the action field based on the specific changes to the ACL table.

[0121] Specifically, if it is determined that the ACL table checksum has changed, the CPU software layer determines the state of the matching ACL table before the change. If it is determined that the state of the matching ACL table before the change is all allowrule, and the content of the change is the addition of an allow rule, the CPU software layer does not need to match the ACL table in the offload's Session table to update the action field. If it is determined that the state of the matching ACL table before the change is all allowrule, and the content of the change is the deletion of a rule, the CPU software layer does not need to match the ACLtable in the offload's Session table to update the action field. If it is determined that the state of the matching ACL table before the change is all allow rule, and the content of the change is the addition of a deny rule, the CPU software layer needs to match the ACLtable in the offload's Session table to update the action field. If it is determined that the state of the matching ACL table before the change includes a deny rule, and the content of the change is a change (such as adding, modifying, or deleting) a rule, the CPU software layer needs to match the ACL table in the offload's Session table to update the action field.

[0122] The above flow table update method can effectively solve the problem of insufficient hardware ACL capacity in hardware firewall devices, thereby improving the efficiency and accuracy of data forwarding of firewall devices while ensuring the software performance of firewall devices.

[0123] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of user personal information (such as user flow table association data, etc.) are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0124] It should be noted that any arrangement and combination of the technical features in the above embodiments also falls within the protection scope of this disclosure.

[0125] In one example, Figure 7 This is a structural diagram of a flow table updating device provided by an embodiment of the present disclosure. The embodiment of the present disclosure can be applied to the situation where the message processing action field of the target hardware forwarding session flow table is updated according to the target access control list matched by the target hardware forwarding session flow table. The device is implemented by software and / or hardware and is specifically configured in a firewall device.

[0126] like Figure 7The flow table updating device 700 shown includes: a target hardware forwarding session flow table acquisition module 710, a target access control list determination module 720 and a message processing action field update module 730.

[0127] The target hardware forwarding session flow table acquisition module 710 is configured to acquire a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field;

[0128] A target access control list determination module 720 is configured to determine a target access control list that matches the target hardware forwarding session flow table;

[0129] The message processing action field updating module 730 is configured to update the message processing action field of the target hardware forwarding session flow table according to the target access control list.

[0130] The embodiment of the present disclosure obtains a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device, and determines a target access control list that matches the target hardware forwarding session flow table, thereby updating the message processing action field of the target hardware forwarding session flow table according to the target access control list, so that the message processing action field of the target hardware forwarding session flow table can match the data forwarding rules of the target access control list. This solves the problems of incomplete flow table content update due to resource limitation and reduced firewall device software performance in existing flow table update methods, and can improve the efficiency and accuracy of firewall device data forwarding while ensuring the software performance of the firewall device.

[0131] Optionally, the target hardware forwarding session flow table acquisition module 710 is specifically used to: determine a preset flow table detection period configured for the hardware forwarding session flow table; determine a target flow table detection period based on the preset flow table detection period; and when it is determined that the target flow table detection period has been reached, obtain all hardware forwarding session flow tables from the hardware forwarding module as the target hardware forwarding session flow table.

[0132] Optionally, the message processing action field update module 730 is specifically used to: obtain the flow table check and value parameters of the target access control list; when it is determined that the flow table check and value parameters have changed, obtain the forwarding change content of the target access control list; and update the message processing action field of the target hardware forwarding session flow table according to the forwarding change content of the target access control list.

[0133] Optionally, the target hardware forwarding session flow table acquisition module 710 is specifically used to: determine the access control list to be synchronized and updated based on the list update content of the access control list; determine the hardware forwarding session flow table that matches the access control list to be synchronized and updated in the hardware forwarding module as the target hardware forwarding session flow table; and directionally obtain the target hardware forwarding session flow table from the hardware forwarding module.

[0134] Optionally, the target hardware forwarding session flow table acquisition module 710 is specifically used to: obtain the flow table check and value parameters of each of the access control lists; when it is determined that the flow table check and value parameters have changed, obtain the forwarding change content of the changed access control list whose flow table check and value parameters have changed; and determine the access control list to be synchronized and updated based on the forwarding change content of the changed access control list.

[0135] Optionally, the message processing action field updating module 730 is specifically configured to: obtain the forwarding change content of the target access control list; and update the message processing action field of the target hardware forwarding session flow table according to the forwarding change content of the target access control list.

[0136] Optionally, the message processing action field update module 730 is specifically used to: determine the forwarding list content before change of the target access control list; and update the message processing action field of the target hardware forwarding session flow table according to the forwarding list content before change and the forwarding change content of the target access control list.

[0137] Optionally, the message processing action field update module 730 is specifically used to: when it is determined that the list contents of the target access control list before the forwarding change are all configuration data for allowing data packets to be released, and the forwarding change content is newly added configuration data for discarding data packets, match the target hardware forwarding session flow table with the target access control list; and update the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list.

[0138] Optionally, the message processing action field update module 730 is specifically used to: when it is determined that the forwarding change list content of the target access control list includes discarding data message configuration data, and the forwarding change content is changing data message configuration data, match the target hardware forwarding session flow table with the target access control list; and update the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list.

[0139] Optionally, the message processing action field update module 730 is also used to: prohibit updating the message processing action field of the target hardware forwarding session flow table when it is determined that the list contents of the target access control list before the forwarding change are all configuration data for data packets that are allowed to be released, and the forwarding change content is newly added configuration data for data packets that are allowed to be released; or prohibit updating the message processing action field of the target hardware forwarding session flow table when it is determined that the list contents of the target access control list before the forwarding change are all configuration data for data packets that are allowed to be released, and the forwarding change content is deletion configuration data.

[0140] Optionally, the message processing action field update module 730 is specifically used to: when it is determined that the target hardware forwarding session flow table matches a hit data message configuration data of the target access control list, update the message processing action field of the target hardware forwarding session flow table according to the hit data message configuration data; when it is determined that the target hardware forwarding session flow table matches multiple hit data message configuration data of the target access control list, determine the target data message configuration data according to the priority of the hit data message configuration data, and update the message processing action field of the target hardware forwarding session flow table according to the target data message configuration data.

[0141] Optionally, the flow table updating device also includes a first hardware forwarding session flow table synchronization module, which is used to: obtain the software forwarding session flow table that matches each session information data of the target user and the flow table association data of the software forwarding session flow table; filter the target software forwarding session flow table from each of the software forwarding session flow tables according to the flow table association data of the software forwarding session flow table; generate a hardware forwarding session flow table to be synchronized according to the target software forwarding session flow table, and synchronize the hardware forwarding session flow table to be synchronized to the hardware forwarding module.

[0142] Optionally, the flow table update device also includes a second hardware forwarding session flow table synchronization module, which is used to: generate a software forwarding session flow table for the new session information data when a data packet matching the new session information data is received; obtain an access control list matching the new session information data when it is determined that the software forwarding session flow table meets the hardware synchronization conditions; generate a hardware forwarding session flow table matching the new session information data based on the software forwarding session flow table and the access control list matching the new session information data; and synchronize the hardware forwarding session flow table matching the new session information data to the hardware forwarding module.

[0143] The above-mentioned flow table update device can execute the flow table update method provided by any embodiment of the present disclosure, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the flow table update method provided by any embodiment of the present disclosure.

[0144] Since the flow table updating device described above is a device that can execute the flow table updating method in the embodiments of the present disclosure, and based on the flow table updating method described in the embodiments of the present disclosure, those skilled in the art will be able to understand the specific implementation and various variations of the flow table updating device in the embodiments of the present disclosure. Therefore, how the flow table updating device implements the flow table updating method in the embodiments of the present disclosure will not be described in detail here. As long as those skilled in the art can implement the device used in the flow table updating method in the embodiments of the present disclosure, it falls within the scope of protection of the present disclosure.

[0145] In one example, the present disclosure also provides a firewall device, a readable storage medium, and a computer program product.

[0146] Figure 8 A schematic block diagram of an example firewall device 800 that can be used to implement an embodiment of the present disclosure is shown. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit implementations of the present disclosure described and / or claimed herein.

[0147] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. Various programs and data required for the operation of the device 800 can also be stored in the RAM 803. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0148] Various components in device 800 are connected to I / O interface 805, including an input unit 806, such as a keyboard, mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0149] The computing unit 801 can be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the flow table update method. For example, in some embodiments, the flow table update method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the flow table update method described above can be performed. Alternatively, in other embodiments, the computing unit 801 can be configured to perform the flow table update method by any other appropriate means (e.g., by means of firmware).

[0150] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0151] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0152] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0153] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0154] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0155] A computer system may include a client and a server. The client and server are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services. The server may also be a server in a distributed system or a server integrated with blockchain.

[0156] In addition to the above components, the device 800 may further include a hardware forwarding module (not shown in the figure) in communication with at least one central processing unit, and the hardware forwarding module is configured to process data packets that hit the hardware forwarding session flow table.

[0157] The embodiment of the present disclosure obtains a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device, and determines a target access control list that matches the target hardware forwarding session flow table, thereby updating the message processing action field of the target hardware forwarding session flow table according to the target access control list, so that the message processing action field of the target hardware forwarding session flow table can match the data forwarding rules of the target access control list. This solves the problems of incomplete flow table content update due to resource limitation and reduced firewall device software performance in existing flow table update methods, and can improve the efficiency and accuracy of firewall device data forwarding while ensuring the software performance of the firewall device.

[0158] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0159] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A flow table updating method, applied to a hardware firewall device, comprising: Obtaining a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field; Determine a target access control list that matches the target hardware forwarding session flow table; Update the message processing action field of the target hardware forwarding session flow table according to the target access control list; Before obtaining the target hardware forwarding session flow table from the hardware forwarding module in the hardware firewall device, the following steps are also included: Filter target users from all users based on user level or priority; Obtaining a software forwarding session flow table that matches each session information data of a target user and flow table association data of the software forwarding session flow table; wherein the flow table association data includes bps, pps, and user priority; filtering a target software forwarding session flow table from each of the software forwarding session flow tables according to the flow table association data of the software forwarding session flow table; A hardware forwarding session flow table to be synchronized is generated according to the target software forwarding session flow table, and the hardware forwarding session flow table to be synchronized is synchronized to the hardware forwarding module.

2. The method according to claim 1, wherein The step of obtaining a target hardware forwarding session flow table from a hardware forwarding module in the hardware firewall device includes: Determining a preset flow table detection period configured for the hardware forwarding session flow table; Determining a target flow table detection period according to the preset flow table detection period; When it is determined that the target flow table detection period has arrived, all hardware forwarding session flow tables are acquired from the hardware forwarding module as the target hardware forwarding session flow table.

3. The method according to claim 2, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the target access control list includes: Obtaining a flow table checksum value parameter of the target access control list; When it is determined that the flow table checksum value parameter has changed, obtaining the forwarding change content of the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to the forwarding change content of the target access control list.

4. The method according to claim 1, wherein The step of obtaining a target hardware forwarding session flow table from a hardware forwarding module in the hardware firewall device includes: Determine the access control list to be updated synchronously according to the list update content of the access control list; Determine the hardware forwarding session flow table matched by the access control list to be synchronized and updated in the hardware forwarding module as the target hardware forwarding session flow table; Directly obtain the target hardware forwarding session flow table from the hardware forwarding module.

5. The method according to claim 4, wherein The step of determining the access control list to be synchronously updated according to the list update content of the access control list includes: Obtaining flow table checksum value parameters of each access control list; When it is determined that the flow table checksum value parameter has changed, obtaining the forwarding change content of the changed access control list of the flow table checksum value parameter that has changed; The access control list to be synchronously updated is determined according to the forwarding change content of the changed access control list.

6. The method according to claim 4, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the target access control list includes: Obtaining forwarding change content of the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to the forwarding change content of the target access control list.

7. The method according to claim 3 or 6, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the forwarding change content of the target access control list includes: Determine the content of the target access control list before forwarding change; The message processing action field of the target hardware forwarding session flow table is updated according to the pre-forwarding change list content and the forwarding change content of the target access control list.

8. The method according to claim 7, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the forwarding pre-change list content and the forwarding change content of the target access control list includes: When it is determined that all the contents of the target access control list before the forwarding change are configuration data for allowing data packets to be released, and the forwarding change content is configuration data for newly adding configuration data for discarding data packets, matching the target hardware forwarding session flow table with the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to a matching result between the target hardware forwarding session flow table and the target access control list.

9. The method according to claim 7, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the forwarding pre-change list content and the forwarding change content of the target access control list includes: When it is determined that the forwarding pre-change list content of the target access control list includes discarded data packet configuration data, and the forwarding change content is changed data packet configuration data, matching the target hardware forwarding session flow table with the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to a matching result between the target hardware forwarding session flow table and the target access control list.

10. The method according to claim 8 or 9, further comprising: If it is determined that all the contents of the target access control list before the forwarding change are configuration data for allowing data packets to be released, and the forwarding change content is newly added configuration data for allowing data packets to be released, prohibiting updating the message processing action field of the target hardware forwarding session flow table; or When it is determined that the contents of the target access control list before forwarding change are all data message configuration data for allowing data to be released, and the forwarding change content is deletion of data message configuration data, updating the message processing action field of the target hardware forwarding session flow table is prohibited.

11. The method according to claim 8 or 9, wherein: The updating of the message processing action field of the target hardware forwarding session flow table according to the matching result between the target hardware forwarding session flow table and the target access control list includes: When it is determined that the target hardware forwarding session flow table matches a hit data packet configuration data of the target access control list, updating the message processing action field of the target hardware forwarding session flow table according to the hit data packet configuration data; When it is determined that the target hardware forwarding session flow table matches multiple hit data packet configuration data of the target access control list, the target data packet configuration data is determined according to the priority of the hit data packet configuration data, and the message processing action field of the target hardware forwarding session flow table is updated according to the target data packet configuration data.

12. The method according to claim 1, further comprising: When receiving a data packet matching the newly added session information data, generating a software forwarding session flow table for the newly added session information data; When it is determined that the software forwarding session flow table meets the hardware synchronization condition, obtaining an access control list that matches the newly added session information data; Generate a hardware forwarding session flow table matching the newly added session information data according to the software forwarding session flow table and the access control list matching the newly added session information data; Synchronize the hardware forwarding session flow table that matches the newly added session information data to the hardware forwarding module.

13. A flow table updating device, configured in a hardware firewall device, comprising: A target hardware forwarding session flow table acquisition module is used to obtain a target hardware forwarding session flow table from a hardware forwarding module in a hardware firewall device; wherein the target hardware forwarding session flow table includes a message processing action field; a target access control list determining module, configured to determine a target access control list that matches the target hardware forwarding session flow table; A message processing action field updating module, configured to update the message processing action field of the target hardware forwarding session flow table according to the target access control list; The first hardware forwarding session flow table synchronization module is used to: filter the target user from all users according to the user level or priority; Obtaining a software forwarding session flow table that matches each session information data of a target user and flow table association data of the software forwarding session flow table; wherein the flow table association data includes bps, pps, and user priority; filtering a target software forwarding session flow table from each of the software forwarding session flow tables according to the flow table association data of the software forwarding session flow table; A hardware forwarding session flow table to be synchronized is generated according to the target software forwarding session flow table, and the hardware forwarding session flow table to be synchronized is synchronized to the hardware forwarding module.

14. The device according to claim 13, wherein The target hardware forwarding session flow table acquisition module is specifically used to: Determining a preset flow table detection period configured for the hardware forwarding session flow table; Determining a target flow table detection period according to the preset flow table detection period; When it is determined that the target flow table detection period has arrived, all hardware forwarding session flow tables are acquired from the hardware forwarding module as the target hardware forwarding session flow table.

15. The device according to claim 14, wherein The message processing action field updating module is specifically used for: Obtaining a flow table checksum value parameter of the target access control list; When it is determined that the flow table checksum value parameter has changed, obtaining the forwarding change content of the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to the forwarding change content of the target access control list.

16. The device according to claim 13, wherein The target hardware forwarding session flow table acquisition module is specifically used to: Determine the access control list to be updated synchronously according to the list update content of the access control list; Determine the hardware forwarding session flow table matched by the access control list to be synchronized and updated in the hardware forwarding module as the target hardware forwarding session flow table; Directly obtain the target hardware forwarding session flow table from the hardware forwarding module.

17. The device according to claim 16, wherein The target hardware forwarding session flow table acquisition module is specifically used to: Obtaining flow table checksum value parameters of each access control list; When it is determined that the flow table checksum value parameter has changed, obtaining the forwarding change content of the changed access control list of the flow table checksum value parameter that has changed; The access control list to be synchronously updated is determined according to the forwarding change content of the changed access control list.

18. The device according to claim 16, wherein The message processing action field updating module is specifically used for: Obtaining forwarding change content of the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to the forwarding change content of the target access control list.

19. The device according to claim 15 or 18, wherein The message processing action field updating module is specifically used for: Determine the content of the target access control list before forwarding change; The message processing action field of the target hardware forwarding session flow table is updated according to the pre-forwarding change list content and the forwarding change content of the target access control list.

20. The device according to claim 19, wherein The message processing action field updating module is specifically used for: When it is determined that all the contents of the target access control list before the forwarding change are configuration data for allowing data packets to be released, and the forwarding change content is configuration data for newly adding configuration data for discarding data packets, matching the target hardware forwarding session flow table with the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to a matching result between the target hardware forwarding session flow table and the target access control list.

21. The apparatus according to claim 19, wherein The message processing action field updating module is specifically used for: When it is determined that the forwarding pre-change list content of the target access control list includes discarded data packet configuration data, and the forwarding change content is changed data packet configuration data, matching the target hardware forwarding session flow table with the target access control list; The message processing action field of the target hardware forwarding session flow table is updated according to a matching result between the target hardware forwarding session flow table and the target access control list.

22. The apparatus according to claim 20 or 21, wherein the message processing action field updating module is further configured to: If it is determined that the contents of the target access control list before the forwarding change are all configuration data for allowing data packets to be released, and the forwarding change content is newly added configuration data for allowing data packets to be released, prohibiting updating the message processing action field of the target hardware forwarding session flow table; or When it is determined that the contents of the target access control list before forwarding change are all data message configuration data for allowing data to be released, and the forwarding change content is deletion of data message configuration data, updating the message processing action field of the target hardware forwarding session flow table is prohibited.

23. The device according to claim 20 or 21, wherein The message processing action field updating module is specifically used for: When it is determined that the target hardware forwarding session flow table matches a hit data packet configuration data of the target access control list, updating the message processing action field of the target hardware forwarding session flow table according to the hit data packet configuration data; When it is determined that the target hardware forwarding session flow table matches multiple hit data packet configuration data of the target access control list, the target data packet configuration data is determined according to the priority of the hit data packet configuration data, and the message processing action field of the target hardware forwarding session flow table is updated according to the target data packet configuration data.

24. The apparatus according to claim 13, further comprising a second hardware forwarding session flow table synchronization module, configured to: When receiving a data packet matching the newly added session information data, generating a software forwarding session flow table for the newly added session information data; When it is determined that the software forwarding session flow table meets the hardware synchronization condition, obtaining an access control list that matches the newly added session information data; Generate a hardware forwarding session flow table matching the newly added session information data according to the software forwarding session flow table and the access control list matching the newly added session information data; Synchronize the hardware forwarding session flow table that matches the newly added session information data to the hardware forwarding module.

25. A firewall device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the flow table updating method according to any one of claims 1 to 12.

26. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the flow table updating method according to any one of claims 1 to 12.

27. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the flow table updating method according to any one of claims 1 to 12 is implemented.

Images