Message forwarding method and system, electronic device and storage medium
By redirecting forward and reverse packets within a network security device cluster, the problem of inconsistent packet routing in cluster deployment is resolved, enabling normal communication and efficient threat detection while reducing device performance consumption.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-12-26
- Publication Date
- 2026-07-21
AI Technical Summary
In a network security device cluster deployment mode, forward and reverse packets may be routed to different devices, leading to communication anomalies and low threat detection rates, which existing session synchronization and state detection methods cannot effectively solve.
By implementing a message redirection mechanism in network security devices, forward and reverse messages of the same session are redirected to the same device for processing. Specific private header encapsulation technology is used to ensure message identification and processing, avoiding reliance on session synchronization.
This ensured normal communication, improved the threat detection rate of the security engine, reduced device performance consumption, and ensured the normal operation of stream reassembly, application identification, and decoding.
Smart Images
Figure CN116055133B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communications, and more specifically, to a message forwarding method, system, electronic device, and storage medium. Background Technology
[0002] Stateful inspection mechanisms are common security mechanisms in current network security devices. A session is the smallest unit for processing business in a stateful inspection device. Integrity verification during communication and the processing flow of application-layer security systems (SEs) such as IPS, antivirus software, and WAFs all rely on sessions. When network security devices are deployed in a cluster mode in a network environment, they are typically interconnected with upstream and downstream devices using interface aggregation (bond). During packet forwarding, downstream devices use load balancing algorithms configured on the bond interface to distribute traffic. Different algorithms yield different distribution results, creating the possibility of forward and reverse packets being routed to different devices. Therefore, it is essential to ensure their normal communication.
[0003] Currently, network security devices typically use session-based state machine detection mechanisms. If forward and reverse packets are misdirected during communication, session synchronization and state machine-disabled detection methods are usually employed to ensure normal packet forwarding and maintain communication. However, these methods still suffer from problems such as packet failure to forward, disruption of normal communication, and low application-layer threat detection rates. (Invention Content)
[0004] The purpose of this application is to provide a message forwarding method, system, electronic device, and storage medium that, in a cluster deployment mode, redirects forward and reverse messages of the same session to the same device for processing, ensuring normal communication while improving the threat detection rate of the security engine.
[0005] In a first aspect, embodiments of this application provide a message forwarding method, which is applied to a network security device. The method includes: a local network security device receiving and parsing an initial message to obtain a message to be allocated; obtaining target network security devices corresponding to multiple target messages in the message to be allocated; wherein, the target network security devices include other network security devices and the local network security device; determining whether the target network security devices corresponding to the multiple target messages are other network security devices; if the target network security device is determined to be another network security device, redirecting the target messages to obtain redirected messages; and sending the redirected messages to other network security devices.
[0006] In the above implementation process, the packet forwarding method provided in this application embodiment obtains the initial packet from the local network security device, parses the initial packet, and further obtains the target network security device corresponding to the target packet. If the target network security device is another network security device, the target packet is redefined and sent to that other network security device. Therefore, using the packet forwarding method provided in this application embodiment can ensure normal communication; packet forwarding no longer relies on session synchronization, avoiding synchronization timing issues; simultaneously, service packets can normally complete flow reassembly, application identification, application decoding, etc., and threat traffic can be normally detected and blocked by application-layer security engines such as antivirus and IPS.
[0007] Optionally, in this embodiment of the application, the target message includes a forward message and a reverse message; obtaining the target network security device corresponding to multiple target messages in the message to be allocated includes: obtaining online network security devices; using a target allocation algorithm to obtain the target network security devices corresponding to the target messages from the online network security devices; wherein, the target allocation algorithm has the same algorithm result for forward messages and reverse messages of the same session.
[0008] In the above implementation process, in order to allocate the target packet to the corresponding network security device, the local network security device will select the target network security device to be allocated from the online devices; wherein, the target allocation algorithm used can ensure that the forward packet and the reverse packet are allocated to the same network security device; therefore, using the packet forwarding method provided in this application embodiment, the normal communication of the reverse packet is guaranteed without relying on session synchronization, avoiding the problem of business communication caused by the reverse packet arriving at the device earlier than the session synchronization, the reverse packet establishing a session and hitting the blocking policy.
[0009] Optionally, in this embodiment of the application, redirecting the target packet to obtain a redirected packet includes: encapsulating a private header in the header of the target packet to obtain a redirected packet; wherein the private header can be recognized by the target network security device corresponding to the target packet.
[0010] In the above implementation process, the message forwarding method provided in this application embodiment generates redirection messages by encapsulating specific private headers in the messages; by redirecting forward and reverse messages of the same session to the same device for processing, the device can normally enable the session state detection function, reducing the rate of new sessions caused by disabling session state detection and reducing device performance consumption.
[0011] Optionally, in this embodiment of the application, the header of the target packet includes an eth header and an IP header; the private header includes a packet type and a source interface; encapsulating the private header in the header of the target packet to obtain a redirected packet includes: adding a packet type and a source interface between the eth header and the IP header to obtain a custom packet; wherein the packet type indicates whether the packet is redirected; the source interface records the original ingress interface information of the packet; and encapsulating the custom packet after marking it to obtain the redirected packet.
[0012] In the above implementation process, a custom header is embedded between the eth header and the IP header to mark and encapsulate the custom packet, thereby obtaining a redirection packet. This integrates a specific identifier and the original access information of the packet into the redirection packet, enabling special communication with the target network security device.
[0013] Optionally, in this embodiment of the application, after sending the redirection message to other network security devices, the method further includes: the other network security devices obtaining and processing the redirection message according to the tag.
[0014] In the above implementation process, after the local security device receives the redirection message, the target security...
[0015] The device can identify redirection messages and then process them; thus, the process of message redirection and redirection message identification is completed, thereby ensuring message forwarding and normal communication.
[0016] Optionally, in the embodiments of this application, the method for processing redirected messages includes at least one of session creation, message forwarding, and security engine processing.
[0017] In the above implementation process, the message forwarding method provided in this application embodiment requires no further operation after the target security device obtains the redirected message after redirecting the message.
[0018] Instead of waiting, directly proceeding with the subsequent message forwarding process can improve message forwarding efficiency.
[0019] Optionally, in this embodiment of the application, the method further includes: if the target network security device is determined to be a local network security device, then the local network security device processes the target message.
[0020] In the above implementation process, when it is determined that the target security device is the local network security device, that is, the target packet is not sent from the local network security device to other network security devices; then, it is directly sent by...
[0021] The local network security device processes the target message, which involves at least one of session creation, message forwarding, and security engine processing.
[0022] Secondly, embodiments of this application provide a message forwarding system, which should...
[0023] Used in network security systems; this packet forwarding system includes: a packet acquisition module, a packet allocation module, and a packet processing module; the packet acquisition module is used by local network security devices.
[0024] The system receives and parses the initial message to obtain the message to be allocated. The message allocation module is used to obtain the target network security devices corresponding to multiple target messages in the message to be allocated. The target network security devices include other network security devices and local network security devices. The message allocation module is also used to determine whether the target network security device is another network security device. When the target network security device is determined to be another network security device, the message processing module is used to redirect the target message to obtain the redirected message and send the redirected message to the other network security device.
[0025] Thirdly, embodiments of this application provide an electronic device, which includes a memory and a processor. The memory stores program instructions, and when the processor reads and runs the program instructions, it executes the steps in any of the above implementation methods.
[0026] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer program instructions, which are read and executed by a processor to perform the steps in any of the above implementations. Attached Figure Description
[0027] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0028] Figure 1 This is a schematic diagram of session synchronization in the prior art;
[0029] Figure 2 A flowchart of message forwarding provided for embodiments of this application;
[0030] Figure 3 A flowchart of message allocation provided for embodiments of this application;
[0031] Figure 4 A flowchart for message redirection provided in the embodiments of this application;
[0032] Figure 5 This is a schematic diagram of the structure of a redirection message provided in an embodiment of this application;
[0033] Figure 6 This is a schematic diagram of a forward message redirection scenario provided in an embodiment of this application;
[0034] Figure 7 This is a schematic diagram of a return message redirection scenario provided in an embodiment of this application;
[0035] Figure 8 This is a schematic diagram of the module of the message forwarding system provided in the embodiments of this application;
[0036] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0037] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. For example, the flowcharts and block diagrams in the drawings illustrate the architecture, functions, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, program segment, or part of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions. In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0038] During the research process, the applicant discovered that when network security devices are deployed in a cluster mode in a network environment, they are typically interconnected with upstream and downstream devices using interface aggregation (bond). This deployment mode improves both overall security processing performance and operational reliability. However, in this network deployment mode, upstream and downstream devices distribute traffic through load balancing algorithms configured on the bond interface. Different algorithms yield different distribution results; there are situations where forward and reverse packets of the same session are distributed to different network security devices for processing. In this case, the session-based state detection mechanism takes effect, and packets cannot be forwarded normally through the devices. To ensure that business packets can be forwarded normally, session synchronization and shutdown are usually used.
[0039] While closed-state detection methods exist, session- or state machine-based detection methods still cannot avoid timing issues between forward and reverse packets; they also suffer from problems such as packet inability to be forwarded, disruption of normal communication, and low application-layer threat detection rates.
[0040] Based on this, embodiments of this application provide a message forwarding method that does not rely on synchronous sessions and uses redirection to overcome synchronization timing issues; in the case of traffic forwarding via different routes, service packets...
[0041] The system can successfully perform stream reconstruction, application identification, and application decoding, and threat traffic can be detected and blocked by application-layer security engines such as antivirus and IPS.
[0042] To better understand the existing technical solutions for solving the message forwarding problem, we will first introduce the existing technologies; please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a schematic diagram of session synchronization in existing technology; in this diagram, network security devices are interconnected via heartbeat lines to form a cluster mode.
[0043] like Figure 1 As shown, when a forward packet sent by the client is load-distributed by the downstream switch, it reaches firewall device A. Figure 1 The equipment FW(A) in the middle, that is Figure 1 Middle route ① and ②. FW(A) connection
[0044] Upon receiving a positive message, FW(A) will perform session creation, forwarding process, and security engine module processing;
[0045] And construct a session synchronization message and send it to device B ( Figure 1 The equipment FW(B) in the middle, that is Figure 1 Middle route ④; furthermore, FW(A) sends the forward message to the upstream switch, i.e. Figure 1 Middle route ③. When FW(B)
[0046] Upon receiving a synchronization session, FW(B) parses the message to obtain session information and creates a session locally. After receiving a forward message, the upstream device sends it to the server; the server responds with a reverse message.
[0047] Right now Figure 1 In sections ⑤ and ⑥, after load splitting by the upstream switch, the load reaches device FW(B), i.e. Figure 1 middle
[0048] ⑦; After receiving the reverse message, FW(B) searches for the session; if the search is successful, it performs subsequent processing according to the security policy of the session record. After processing, it sends the message to the downstream switch, which then forwards it to the client.
[0049] Those skilled in the art will understand that when FW(B) receives a reverse message, if the reverse message arrives at FW(B) earlier than the session synchronization message, the session lookup fails. If session state detection is disabled, the reverse message creates a session and searches for the security policy again. At this time, there is a situation where the forward and reverse policies are inconsistent, and the reverse message is blocked, which will lead to the inability to access services.
[0050] pass Figure 1 It is known that existing methods mainly ensure that reverse packets are correctly forwarded after hitting a session during packet forwarding by synchronizing sessions, disabling session state detection, and configuring reverse security policies. However, using session synchronization to solve the packet forwarding problem has the following drawbacks: First, when finding a session on device B fails, the session state detection function needs to be disabled; under the same traffic conditions, the rate at which devices create new sessions increases, leading to increased device performance consumption; Second, when communication traffic is high, there may be cases where session synchronization lags behind the arrival of the reverse packet at the peer device, which may cause the reverse packet to hit the access control policy that blocks session creation, affecting normal communication; Third, since forward and reverse packets are processed on different devices, flow reassembly, application identification, and application decoding cannot be completed normally; this prevents security engines (such as antivirus and intrusion detection) from effectively detecting threats and blocking them in a timely manner.
[0051] Therefore, the applicant proposes a message forwarding method to solve the above problems and ensure normal communication; message forwarding no longer relies on session synchronization, avoiding synchronization timing issues; simultaneously, business messages can normally complete flow reassembly, application identification, and application decoding, while threat traffic can be normally detected and blocked by application-layer security engines such as antivirus software and IPS. Please refer to... Figure 2 , Figure 2 A flowchart illustrating message forwarding provided in this application embodiment; the message forwarding method is applied to network security devices, and the network security devices are deployed in a cluster mode; the message forwarding method provided in this application embodiment may include the following steps:
[0052] Step S100: The local network security device receives and parses the initial message to obtain the message to be allocated.
[0053] In step S100 above, the local network security device receives the initial message. After receiving the initial message, the local network security device parses the initial message and obtains the message to be allocated.
[0054] Step S101: Obtain the target network security devices corresponding to multiple target packets in the packets to be allocated.
[0055] In step S101 above, after completing the message parsing, the target network security device corresponding to each target message in the message to be allocated is obtained.
[0056] Step S102: Determine whether the target network security device corresponding to multiple target packets is another network security device.
[0057] Step S103: If the target network security device is determined to be another network security device, the target packet is redirected to obtain a redirection packet; and the redirection packet is sent to the other network security device.
[0058] In step S103 above, after obtaining the target network security device corresponding to the target message, it is determined whether the target network security device is a local network security device or another network security device. It should be understood that the local network security device in this application embodiment refers to the device that receives the message. Other security devices are all other network security devices.
[0059] If the target network security device is another network security device, meaning the target packet will be sent from the local network security device to another network security device, then the target packet needs to be redirected to the other network security device.
[0060] pass Figure 2 As can be seen, the packet forwarding method provided in this application embodiment involves the local network security device obtaining the initial packet, parsing the initial packet, and further obtaining the target network security device corresponding to the target packet. If the target network security device is another network security device, the target packet is redefined and sent to that other network security device. Therefore, using the packet forwarding method provided in this application embodiment can ensure normal communication; packet forwarding no longer relies on session synchronization, avoiding synchronization timing issues; simultaneously, service packets can normally complete flow reassembly, application identification, application decoding, etc., and threat traffic can be normally detected and blocked by application-layer security engines such as antivirus and IPS.
[0061] Please refer to Figure 3 , Figure 3 A flowchart for message allocation provided in this application embodiment; in an optional implementation of this application embodiment, the target message may include a forward message and a reverse message; following the above, obtaining the target network security device corresponding to multiple target messages in the message to be allocated can be achieved through the following steps:
[0062] Step S200: Obtain online network security devices.
[0063] In step S200 above, online network security devices are obtained. It should be noted that, in the packet forwarding method provided in this application embodiment, when the cluster load mode is enabled, devices send heartbeat messages to each other through the heartbeat interface for the other party to monitor the online information of the devices. The online and offline status of the devices is identified based on the heartbeat information. When the peer device goes offline, the load balancing group is dynamically updated, and subsequent traffic will no longer be load-distributed to the offline device. When the peer device goes online, the load balancing group is dynamically updated, and subsequent traffic will be load-distributed to the online device.
[0064] Therefore, local network security devices can accurately identify the online device to which the target message is about to be assigned.
[0065] Step S201: Use the target allocation algorithm to obtain the target network security devices corresponding to the target packets from the online network security devices.
[0066] In step S201 above, a security device corresponding to the target network security device is obtained from online network security devices using a target allocation algorithm. For example, this can be based on the binary data parsed from the message.
[0067] Information such as groups, triples, or quintuples is used to perform hash calculations on the messages using the same-origin, same-destination hash algorithm. Based on the calculation results, the devices for traffic distribution are selected from the online devices maintained by the load balancing group.
[0068] It should be noted that in the message forwarding method provided in this application embodiment, the target allocation algorithm is used to allocate the target message to the target network security device. The same source and same destination hash algorithm can be used, which can make the calculation results of the forward message and the reverse message the same, so that the forward message and the reverse message will be allocated to the same network security device.
[0069] pass Figure 3 It is known that in order to distribute target packets to the corresponding network security devices, the local network...
[0070] The network security device selects the target network security device to be assigned from online devices; the target allocation algorithm used ensures that forward and reverse packets are assigned to the same network security device; therefore, the packet forwarding method provided in this application does not rely on session synchronization.
[0071] This ensures normal communication of reverse messages, preventing issues with business communication caused by reverse messages arriving at the device before session synchronization, establishing a session, and triggering blocking policies.
[0072] In an optional embodiment, redirecting the target packet to obtain a redirected packet includes: encapsulating a private header in the header of the target packet to obtain the redirected packet. It should be noted that the private header is a structure that can be recognized by the target security device to ensure normal communication.
[0073] Therefore, it can be seen that the message forwarding method provided in this application generates redirection messages by encapsulating specific private headers in the messages; and redirects forward and reverse messages of the same session to the same...
[0074] The method of handling the device allows the device to normally enable the session state detection function, reducing the rate of new sessions caused by disabling session state detection and reducing device performance consumption.
[0075] Please refer to Figure 4 , Figure 4 A flowchart of message redirection provided for embodiments of this application; please refer to it. Figure 5 , Figure 5 This is a schematic diagram of the structure of a redirection message provided in an embodiment of this application. In an optional embodiment of this application, the header of the target message includes an eth header and an IP header; the private header includes the message type and the source interface. The aforementioned encapsulation of the private header into the header of the target message to obtain a redirection message can be achieved through the following steps:
[0076] Step S300: Add the message type and source interface between the eth header and the IP header to obtain a custom message.
[0077] In step S300 above, such as Figure 5 As shown, a custom header (PrivateTag) is embedded between the eth header and the IP header. The custom header consists of a message type and a source port. The message type identifier indicates whether the message is a redirect message, and the source port is used to record the original ingress interface information of the message.
[0078] Step S301: Mark and encapsulate the custom message to obtain the redirection message.
[0079] In step S301 above, after embedding a custom header between the eth header and the IP header, the custom packet is marked; further, the marked custom packet is encapsulated to obtain a redirection packet.
[0080] pass Figure 4 and Figure 5 It is known that by embedding a custom header between the eth header and the IP header, and marking and encapsulating the custom message, a redirection message can be obtained. This allows specific identifiers and the original access information of the message to be integrated into the redirection message, thus enabling special communication with the target network security device.
[0081] In an optional embodiment, after sending the redirection message to other network security devices, the method further includes: having the other network security devices obtain and process the redirection message based on a tag.
[0082] For example, after receiving a redirection message, the target network security device identifies it as a redirection message through the heartbeat interface and the type field in the message's private tag. Messages identified as redirection messages directly enter the process of session processing, security engine detection, etc. After processing, they are sent to upstream or downstream devices.
[0083] Therefore, when the local security device receives a redirection message, the target security device can identify the redirection message and then process it; thus, the process of message redirection and redirection message identification is completed, thereby ensuring message forwarding and normal communication.
[0084] In one alternative implementation, the method for processing redirected messages includes at least one of session creation, message forwarding, and security engine processing.
[0085] Therefore, it can be seen that the message forwarding method provided in this application embodiment, after redirecting the message, allows the target security device to directly proceed with the subsequent message forwarding process without performing any other operations or waiting after obtaining the redirected message, thereby improving the efficiency of message forwarding.
[0086] In an optional implementation, the packet forwarding method further includes: if the target network security device is determined to be a local network security device, then the local network security device processes the target packet.
[0087] In other words, when the target security device is determined to be a local network security device, meaning the target packet is not sent from the local network security device to other network security devices, the target packet is directly processed by the local network security device, which includes at least one of session creation, packet forwarding, and security engine processing.
[0088] Please refer to Figure 6 , Figure 6 This is a schematic diagram of a forward message redirection scenario provided in an embodiment of this application; Figure 6In this scenario, two network security devices (Firewall A (FW(A)) and Firewall B (FW(B))) are transparently connected to the network. Upstream and downstream switches enable interface aggregation (bond) through the firewalls. Due to inconsistent hash-based traffic splitting algorithms configured on the upstream and downstream bond interfaces, after service packets undergo load balancing on the upstream and downstream switches, forward and reverse packets of the same session may be distributed to different devices. The specific solution is as follows: Figure 6 As shown.
[0089] exist Figure 6 In the process, the forward packets of client service traffic reach the downstream switch, i.e., route ①; after the switch looks up the forwarding table, the outgoing interface is the bond port. According to the hash algorithm configured on the bond port, the forward packets are diverted and forwarded to firewall device A, i.e. Figure 6 Route ②: After receiving the forward packet, firewall device A extracts the packet's tuple and uses a same-source, same-destination algorithm such as XOR. Further, based on the hash calculation result, it selects the corresponding online device, and the packet, after passing through the redirection module, is sent to firewall device B. Figure 6 Route ③. After receiving the packet, firewall device B identifies it as a redirection packet and continues with the process of session creation, forwarding module, and security engine processing. Finally, the packet is sent to the upstream switch, and ultimately reaches the server. Figure 6 Route 4: After the reverse message from the server arrives at firewall device B, due to the use of the same-source, same-destination algorithm, the calculation result is still device B, and the subsequent session processing and security engine processing flow continue; finally, the reverse message arrives at the client via the downstream switch.
[0090] Similarly, please see Figure 7 , Figure 7 This is a schematic diagram of a return message redirection scenario provided in an embodiment of this application.
[0091] exist Figure 7 In the process, the forward packets of client service traffic reach the downstream switch, i.e., route ①; after the switch looks up the forwarding table, the outgoing interface is the bond port. According to the hash algorithm configured on the bond port, the forward packets are diverted and forwarded to firewall device A, i.e. Figure 7 Route ②. After receiving a forward packet, firewall device A extracts the packet's tuple and uses a same-origin, same-destination algorithm such as XOR. Based on the hash calculation result, the packet is routed to local device A, requiring no redirection. It then proceeds with session creation, forwarding module processing, security engine processing, etc., and finally sends the packet to the upstream switch, ultimately reaching the server. Figure 7Route ③. The reverse message from the server arrives at device B, i.e., route ⑥. The tuple of the message is extracted, and using a same-origin, same-destination algorithm such as XOR, the corresponding online device A is selected within the load balancing group based on the hash result. After passing through the redirection module, the message is sent to firewall device A, i.e., route ⑦. After receiving the message, firewall device A identifies it as a redirection message and continues with session processing, security engine processing, and other procedures. Finally, the message is sent to the downstream switch, i.e., route ⑧. Finally, the reverse message arrives at the client via the downstream switch.
[0092] Please refer to Figure 8 , Figure 8 This is a schematic diagram of the module of the message forwarding system provided in the embodiments of this application; the message forwarding system is applied to a network security system; the message forwarding system 100 includes: a message acquisition module 110 to be allocated, a message allocation module 120, and a message processing module 130.
[0093] The message acquisition module 110 is used by the local network security device to receive and parse the initial message in order to obtain the message to be allocated.
[0094] The message allocation module 120 is used to obtain the target network security devices corresponding to multiple target messages in the message to be allocated; wherein, the target network security devices include other network security devices and local network security devices; the message allocation module 120 is also used to determine whether the target network security device is another network security device.
[0095] The message processing module 130 is used to redirect the target message to obtain a redirected message when it is determined that the target network security device is another network security device; and to send the redirected message to the other network security device.
[0096] In an optional embodiment, the target packet includes a forward packet and a reverse packet; the packet allocation module 120 obtains the target network security devices corresponding to multiple target packets in the packets to be allocated, including: obtaining online network security devices; the packet allocation module 120 uses a target allocation algorithm to obtain the target network security devices corresponding to the target packets from the online network security devices; wherein, the target allocation algorithm has the same algorithm result for forward packets and reverse packets of the same session.
[0097] In an optional embodiment, the message processing module 130 includes a message redirection module 131; the message processing module 130 redirects a target message to obtain a redirected message, including: the message redirection module 131 encapsulates a private header in the message header of the target message to obtain a redirected message; wherein the private header can be recognized by the target network security device corresponding to the target message.
[0098] In an optional embodiment, the header of the target packet includes an eth header and an IP header; the private header includes a packet type and a source interface; the packet processing module 130 encapsulates the private header in the header of the target packet to obtain a redirected packet, including: the packet redirection module 131 adding a packet type and a source interface between the eth header and the IP header to obtain a custom packet; wherein, the packet type indicates whether the packet is redirected; the source interface records the original ingress interface information of the packet; the custom packet is marked and then encapsulated to obtain a redirected packet.
[0099] In an optional embodiment, after the redirection message is sent to other network security devices, the method further includes: the other network security devices, message processing module 130, obtaining and processing the redirection message according to a tag.
[0100] In an optional embodiment, the method for processing redirected messages includes at least one of session creation, message forwarding, and security engine processing via message processing module 130.
[0101] In an optional embodiment, if the target network security device is determined to be a local network security device, the message processing module 130 controls the local network security device to process the target message.
[0102] Please see Figure 9 , Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes: a processor 301 and a memory 302. The memory 302 stores machine-readable instructions executable by the processor 301. When the machine-readable instructions are executed by the processor 301, the method described above is performed.
[0103] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing computer program instructions, which, when read and executed by a processor, perform the steps in any of the above implementations.
[0104] The computer-readable storage medium can be any medium capable of storing program code, such as Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM). The storage medium stores the program, and the processor executes the program after receiving an execution instruction. The method executed by the electronic terminal as defined in any embodiment of this invention can be applied to the processor or implemented by the processor.
[0105] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.
[0106] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0107] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.
[0108] It can be replaced and can be implemented, wholly or partially, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, wholly or partially, in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated.
[0109] The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.
[0110] In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.
[0111] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A message forwarding method, characterized in that, The method is applied to a network security device; the method includes: The local network security device receives and parses the initial message to obtain the message to be allocated; Obtain the target network security devices corresponding to multiple target packets in the packets to be allocated; wherein, the target network security devices include other network security devices and the local network security device; Determine whether the target network security device corresponding to the multiple target packets is another network security device; If the target network security device is determined to be another network security device, the target packet is redirected to obtain a redirected packet; and the redirected packet is sent to the other network security device. The target message includes a forward message and a reverse message; obtaining the target network security device corresponding to multiple target messages in the message to be allocated includes: obtaining the online network security devices; using a target allocation algorithm to obtain the target network security devices corresponding to the target messages from the online network security devices; wherein the target allocation algorithm has the same algorithm result for the forward message and the reverse message in the same session.
2. The method according to claim 1, characterized in that, The redirection of the target message to obtain a redirected message includes: A private header is encapsulated in the header of the target message to obtain a redirection message; wherein the private header can be recognized by the target network security device corresponding to the target message.
3. The method according to claim 2, characterized in that, in, The header of the target message includes an eth header and an IP header; the private header includes the message type and the source interface. The process of encapsulating the header of the target message with a private header to obtain a redirected message includes: The packet type and source interface are added between the eth header and the IP header to obtain a custom packet; wherein, the packet type indicates whether the packet is redirected; the source interface records the original ingress interface information of the packet; The custom message is marked and then encapsulated to obtain a redirection message.
4. The method according to claim 3, characterized in that, After sending the redirection message to the other network security device, the method further includes: The other network security devices acquire and process the redirection message based on the tag.
5. The method according to claim 4, characterized in that, in, The method for processing the redirected message includes at least one of session creation, message forwarding, and security engine processing.
6. The method according to claim 1, characterized in that, The method further includes: if the target network security device is determined to be the local network security device, then the local network security device processes the target packet.
7. A message forwarding system, characterized in that, The message forwarding system is applied to a network security system; the message forwarding system includes: a message acquisition module, a message allocation module, and a message processing module; The unassigned message acquisition module is used by the local network security device to receive and parse the initial message in order to obtain the unassigned message; The message allocation module is used to obtain the target network security devices corresponding to multiple target messages in the message to be allocated; wherein, the target network security devices include other network security devices and the local network security device; The message distribution module is also used to determine whether the target network security device is another network security device; The message processing module is used to redirect the target message when it determines that the target network security device is another network security device, so as to obtain a redirected message; and send the redirected message to the other network security device. The target message includes a forward message and a reverse message; the message allocation module is specifically used to: obtain the online network security devices; use a target allocation algorithm to obtain the target network security devices corresponding to the target messages from the online network security devices; wherein the target allocation algorithm has the same algorithm result for the forward message and the reverse message of the same session.
8. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores program instructions, and when the processor executes the program instructions, it performs the steps of the method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, perform the steps of the method according to any one of claims 1-6.