A method for implementing a cloud shield scenario, a firewall, an electronic device, and a storage medium

Abstract

The present invention provides a method for implementing a cloud shield scenario, a firewall, an electronic device, and a storage medium. The method includes: a user sending a data request to a website; the firewall receiving the data request initiated by the user through an Ethernet bridge firewall and packet filtering firewall technologies, processing the data request according to fast packet processing technology, and sending the processed data request to the website corresponding to the data request; the website responding to the data request sent by the firewall and sending request data to the firewall; the firewall processing the request data sent by the website according to fast packet processing technology, and after completion of the processing, returning the request data to the user through the Ethernet bridge firewall and packet filtering firewall technologies; the user receiving the data; that is, the function of a single-port managed firewall on the cloud can be implemented without multiple interfaces; and relevant policies can be guaranteed to be configured in the public network, which is more flexible and convenient.

Description

Technical Field

[0001] The present invention belongs to the technical field of firewalls. More specifically, it particularly relates to a method for implementing a cloud shield scenario, a firewall, an electronic device, and a storage medium. Background Art

[0002] Traditional firewalls require at least three interfaces to implement the protection function. The three interfaces are respectively connected to the internal network, the external network, and the DMZ (demilitarized zone).

[0003] With the rise of cloud computing, various websites and applications have been widely used on the cloud, and at the same time, many network security problems have emerged, such as attacks like Trojans, worms, and DDoS (Distributed Denial of Service).

[0004] However, it is difficult for traditional firewalls to be deployed on the cloud. Since most hosts on the cloud have a single interface, when a traditional firewall is deployed on the cloud, there will be a problem of conflict between the service port and the management port. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method for implementing a cloud shield scenario, a firewall, an electronic device, and a storage medium, which can implement the function of managing a single-port firewall on the cloud without the need for multiple interfaces.

[0006] The first aspect of this application discloses a method for implementing a cloud shield scenario, including:

[0007] A user sends a data request to a website;

[0008] The firewall receives the data request initiated by the user through the Ethernet bridge firewall and packet filtering firewall technologies, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request; wherein, the firewall has a unique interface;

[0009] The website responds to the data request sent by the firewall and sends request data to the firewall;

[0010] The firewall processes the request data sent by the website according to the fast packet processing technology, and after completion of the processing, returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technologies;

[0011] The user receives the data.

[0012] Optionally, in the above method for implementing a cloud shield scenario, the data path in the data request sent by the user to the website is from the user address to the website address.

[0013] Optionally, in the above method for implementing the cloud security scenario, the firewall receives the data request initiated by the user through the Ethernet bridge firewall and packet filtering firewall technologies, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request, including:

[0014] The firewall receives the data request initiated by the user through the Ethernet bridge firewall and packet filtering firewall technologies;

[0015] The firewall is configured to hide the user address for the data request through the fast packet processing technology;

[0016] Send the data request with the user address hidden to the website corresponding to the data request.

[0017] Optionally, in the above method for implementing the cloud security scenario, the firewall is configured to hide the user address for the data request through the fast packet processing technology, including:

[0018] The firewall changes the user address of the data request to the firewall address through the fast packet processing technology.

[0019] Optionally, in the above method for implementing the cloud security scenario, the data path in the data request sent by the firewall to the website is from the firewall address to the website address.

[0020] Optionally, in the above method for implementing the cloud security scenario, the data path for the website to transmit request data to the firewall is from the website address to the firewall address.

[0021] Optionally, in the above method for implementing the cloud security scenario, the firewall processes the request data sent by the website according to the fast packet processing technology, and after the processing is completed, returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technologies, including:

[0022] The firewall modifies the destination address in the request data sent by the website from the firewall address to the user address according to the fast packet processing technology;

[0023] The firewall returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technologies.

[0024] The second aspect of this application discloses a firewall for performing the steps where the execution entity is the firewall in any of the methods for implementing the cloud security scenario in the first aspect of this application; the firewall is configured with an Ethernet bridge firewall, a packet filtering firewall, and a fast packet processing technology.

[0025] A third aspect of the present application discloses an electronic device, including:

[0026] One or more processors;

[0027] A storage device on which one or more programs are stored;

[0028] When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the cloud shield scenario implementation method described in any one of the first aspects of the present application.

[0029] A fourth aspect of the present application discloses a storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the cloud shield scenario implementation method described in any one of the first aspects of the present application is implemented.

[0030] As can be seen from the above technical solutions, a cloud shield scenario implementation method provided by the present invention includes: a user sends a data request to a website; the firewall receives the data request initiated by the user through the Ethernet bridge firewall and packet filtering firewall technologies, and processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request; the website responds to the data request sent by the firewall and sends request data to the firewall; the firewall processes the request data sent by the website according to the fast packet processing technology, and after the processing is completed, returns the request data to the user through the Ethernet bridge firewall and packet filtering firewall technologies; the user receives the data; that is to say, the Ethernet bridge firewall ebtables, packet filtering firewall iptables and fast packet processing vpp technology are added to the configuration of the firewall. By using the layer 2 traffic filtering technology of ebtables, the layer 3 traffic filtering technology of iptables and the network high-performance characteristics of vpp, the data traffic on the cloud is processed so that the traffic can be normally transmitted on the cloud, and there is no need to worry about the problem of management and service conflicts caused by insufficient cloud interfaces. That is, the traditional firewall needs at least three interfaces during the protection process because it needs to connect different regions (i.e., the internal network, the external network, and the isolation area), while this embodiment can achieve the function of a single-port management firewall on the cloud without multiple interfaces; most of the traditional firewalls are hardware protection, and the security policy configuration sometimes needs to be configured on-site, which is not flexible; while the present application can ensure that relevant policies are configured in the public network, which is more flexible and convenient. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to these drawings without creative efforts.

[0032] Figure 1 It is a flowchart of a method for implementing a cloud shield scenario provided by an embodiment of the present invention;

[0033] Figure 2 It is a flowchart of another method for implementing a cloud shield scenario provided by an embodiment of the present invention;

[0034] Figure 3 It is a flowchart of another method for implementing a cloud shield scenario provided by an embodiment of the present invention;

[0035] Figure 4 It is a flowchart of another method for implementing a cloud shield scenario provided by an embodiment of the present invention;

[0036] Figure 5 It is a flowchart of another method for implementing a cloud shield scenario provided by an embodiment of the present invention;

[0037] Figure 6 It is a schematic diagram of the relationship between various interfaces in an operating system provided by an embodiment of the present invention;

[0038] Figure 7 It is a schematic diagram of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0040] In this application, the term "including", "comprising", or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or device including a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or device. Without further limitation, an element defined by the phrase "including a..." does not exclude the presence of additional identical elements in the process, method, article, or device including the element.

[0041] The embodiments of this application provide a method for implementing a cloud shield scenario, which is used to solve the problem that it is difficult to deploy a traditional firewall on the cloud in the prior art. Since most of the hosts on the cloud have a single interface, when a traditional firewall is deployed on the cloud, there will be a conflict between the service port and the management port.

[0042] See Figure 1, the method for implementing the cloud shield scenario includes:

[0043] S101. The user sends a data request to the website.

[0044] It should be noted that when the user needs to obtain relevant data through the website, a data request sent to the website will be generated.

[0045] The data request may carry the website address, and of course, it can also carry tags of the required data, etc. The specific content of the data request will not be elaborated here one by one. It depends on the actual situation and is within the protection scope of this application.

[0046] In practical applications, the data path in the data request sent by the user to the website is from the user address to the website address.

[0047] Specifically, taking the user address as 1.1.1.1, the firewall address as 2.2.2.2, and the website address as 3.3.3.3 as an example: that is, the data path in the data request sent by the user to the website is: 1.1.1.1 → 3.3.3.3.

[0048] The specific content of the above addresses is only an example and will not be elaborated here one by one. It depends on the actual situation and is within the protection scope of this application.

[0049] S102. The firewall receives the data request sent by the user through the Ethernet bridge firewall and packet filtering firewall technologies, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request.

[0050] That is to say, by setting the Ethernet bridge firewall and packet filtering firewall technologies on the firewall, data transmission between the user and the website needs to be achieved through this firewall.

[0051] That is, the firewall serves as a transfer station between the user and the website, avoiding direct data transmission between the website and the user, and further preventing the website from being directly invaded by the user.

[0052] Specifically, the data request sent by the user to the website needs to pass through the firewall.

[0053] In practical applications, the data path in the data request sent by the firewall to the website is from the firewall address to the website address.

[0054] Specifically, taking the user address as 1.1.1.1, the firewall address as 2.2.2.2, and the website address as 3.3.3.3 as an example: that is, the data path in the data request sent by the firewall to the website is: 2.2.2.2 → 3.3.3.3.

[0055] The specific content of the above address is only an example and will not be elaborated one by one here. It depends on the actual situation and is within the protection scope of this application.

[0056] Among them, the firewall has a unique interface.

[0057] This unique interface is the single interface eth0 on the cloud; as Figure 6 shown, kernel represents the linux operating system kernel, vpp runs on the linux operating system. In the figure, the linuxhost interface and the vethpeer interface are both virtual interfaces in the linux kernel, and the host-vethpeer interface is a vpp virtual interface generated by the vpp program based on the linux kernel virtual interface. In the linux operating system, the unique interface eth0 (i.e., the unique interface on the cloud) is bound to the linux virtual interface linuxhost in the bridge br0.

[0058] S103. The website responds to the data request sent by the firewall and sends request data to the firewall.

[0059] That is to say, the website parses the data request, determines the data required by the user, and sends the data required by the user to the firewall.

[0060] Specifically, the website parses the data request, obtains the tags of the data required by the user, and filters the corresponding data through the tags of the data required by the user to obtain the data required by the user.

[0061] The specific response process of the website to the data request will not be elaborated one by one here. It depends on the actual situation and is within the protection scope of this application.

[0062] In actual applications, the data path for the website to transmit request data to the firewall is from the website address to the firewall address.

[0063] Specifically, taking the user address as 1.1.1.1, the firewall address as 2.2.2.2, and the website address as 3.3.3.3 as an example: that is, the data path for the website to send data to the firewall is: 3.3.3.3 → 2.2.2.2.

[0064] The specific content of the above address is only an example and will not be elaborated one by one here. It depends on the actual situation and is within the protection scope of this application.

[0065] S104. The firewall processes the request data sent by the website based on the fast packet processing technology, and after the processing is completed, returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology.

[0066] That is to say, by setting up the Ethernet bridge firewall and the packet filtering firewall technology on the firewall, data transmission between users and websites needs to pass through the firewall.

[0067] That is, the firewall acts as a transit station between the user and the website, preventing direct data transmission between the website and the user, and further preventing the website from being directly invaded by the user.

[0068] Specifically, the data request sent by the website to the user needs to pass through the firewall.

[0069] S105: The user receives data.

[0070] In actual applications, the data path for a user to receive firewall transmission request data is from the firewall address to the user address.

[0071] Specifically, take the user address of 1.1.1.1, the firewall address of 2.2.2.2 and the website address of 3.3.3.3 as an example: that is, the data path for the user to receive the firewall transmission request data is: 2.2.2.2→1.1.1.1.

[0072] The specific content of the above address is only an example and will not be described in detail here. It will depend on the actual situation and is within the scope of protection of this application.

[0073] Ebtables technology: Ebtables is an Ethernet bridge firewall. Ethernet bridge works at the data link layer. Ebtables is mainly used to filter data packets at the data link layer. Ebtables can filter the second layer data traffic in the network.

[0074] Iptables technology: iptables is a packet filtering firewall under the Linux platform. It can implement firewall solutions, complete functions such as packet filtering, packet redirection and network address translation (NAT), and can filter the three-layer data traffic in the network.

[0075] The specific filtering process of the Ethernet bridge firewall and packet filtering firewall technology will not be described here one by one. It will depend on the actual situation and is within the protection scope of this application.

[0076] vpp technology: VPP is a fast packet processing development platform for network applications. It can run on most general-purpose CPUs with various architectures including ARM32 / 64 and X86, and can further improve performance with the help of DPDK. It exists as an application in Linux user mode.

[0077] In this embodiment, the user initiates a data request to a website; the firewall receives the data request initiated by the user through the Ethernet bridge firewall and the packet filtering firewall technology, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request; the website responds to the data request sent by the firewall and sends the request data to the firewall; the firewall processes the request data sent by the website according to the fast packet processing technology, and returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology after completing the processing; the user receives the data; that is, the Ethernet bridge firewall ebtables, the packet filtering firewall iptables and the fast packet processing vpp technology are added to the configuration of the firewall, and the second-layer traffic filtering technology of ebtables, the third-layer traffic filtering technology of iptables and the high-performance network characteristics of vpp are utilized to process the data traffic on the cloud so that the traffic can be transmitted normally on the cloud, without having to worry about the problem of insufficient cloud interfaces causing management and business conflicts. That is, traditional firewalls need at least three interfaces to connect different areas (i.e., intranet, extranet, and isolation zone) during the protection process, while this embodiment does not require multiple interfaces and can realize the single-port management firewall function on the cloud; traditional firewalls are mostly hardware protection, and security policy configuration sometimes requires on-site configuration, which is inflexible; and this application can ensure that relevant policies are configured on the public network, which is more flexible and convenient.

[0078] In practical applications, see Figure 2 Step S102: The firewall receives the data request initiated by the user through the Ethernet bridge firewall and the packet filtering firewall technology, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request, including:

[0079] S201. The firewall receives a data request initiated by a user through the Ethernet bridge firewall and the packet filtering firewall technology.

[0080] This technology improves the vpp technology and combines ebtables and iptables technologies to achieve the integration of the cloud firewall service port and management port. The implementation plan is as follows:

[0081] ebtables -t broute -A BROUTING -i br0 -p ipv4 --ip -proto tcp --ip -dport xx --ip -dst xxx.xxx.xxx.xxx -j redirect --redirect -target DROP, iptables -A PREROUTING -t nat -i br0 -p tcp -d xxx.xxx.xxx.xxx --dport xx -j DNAT --to xxx.xxx.xxx.xxx:xx. This configuration means that the ebtables technology and iptables technology are set in the firewall. This technology can achieve that when the user manages the firewall, the user data is forwarded to the firewall itself, and the firewall returns the information to the user side. This configuration realizes the function of single - port management of the firewall on the cloud.

[0082] S202. The firewall configuration hides the user address for the data request through fast packet processing technology.

[0083] cnat translation addproto TCP real xxxx xx to->xxxx xx. This configuration means that the vpp technology is set in the firewall. This technology can achieve that when the user requests a cloud website, the firewall will perform source address translation, modifying the user → website data to firewall → website. After the website returns the information, the website → firewall information is modified to website → user. The information received by the website is initiated by the firewall from beginning to end. This method can well protect the security of the website. This configuration realizes the function of single - interface protection of the website on the cloud, that is, the business function.

[0084] S203. Send the data request with the hidden user address to the website corresponding to the data request.

[0085] The purpose of hiding the user address is to prevent the user from directly accessing the website, but to access the website through the firewall.

[0086] The specific ways of hiding the user address will not be elaborated here one by one. It depends on the actual situation and is within the protection scope of this application.

[0087] In practical applications, refer to Figure 3 , step S202. The firewall configuration hides the user address for the data request through fast packet processing technology, including:

[0088] S301. The firewall changes the user address of the data request to the firewall address through fast packet processing technology.

[0089] That is to say, the firewall modifies the user source address to its own address and initiates a request to the website.

[0090] Specifically, take the user address of 1.1.1.1, the firewall address of 2.2.2.2 and the website address of 3.3.3.3 as an example: that is, the firewall modifies the data path of the data request from 1.1.1.1→3.3.3.3 to: 2.2.2.2→3.3.3.3.

[0091] The specific content of the above address is only an example and will not be described in detail here. It will depend on the actual situation and is within the scope of protection of this application.

[0092] In practical applications, see Figure 4 Step S104: The firewall processes the request data sent by the website according to the fast packet processing technology, and returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology after the processing is completed, including:

[0093] S401. The firewall modifies the destination address in the request data sent by the website from the firewall address to the user address based on the fast packet processing technology.

[0094] S402. The firewall returns the request data to the user through the Ethernet bridge firewall and packet filtering firewall technology.

[0095] In other words, the firewall changes its own address to the website address and returns the data to the user.

[0096] Specifically, take the user address of 1.1.1.1, the firewall address of 2.2.2.2 and the website address of 3.3.3.3 as an example: that is, the firewall modifies the data path 3.3.3.3→2.2.2.2 to: 3.3.3.3→1.1.1.1.

[0097] The specific content of the above address is only an example and will not be described in detail here. It will depend on the actual situation and is within the scope of protection of this application.

[0098] See also Figure 5 The following is an application scenario to illustrate the implementation method of Cloud Shield scenario:

[0099] The user address is 1.1.1.1; the firewall address is 2.2.2.2, where 2.2.2.2 is the only interface of the firewall; the website address is 3.3.3.3.

[0100] (1) The user initiates a request to the website.

[0101] Specifically, a user initiates a request to a website through the firewall, wherein the data flow, or data path, is 1.1.1.1→3.3.3.3.

[0102] (2) The firewall processes the data request.

[0103] Specifically, the firewall changes the user source IP to its own IP to initiate a request to the website, and changes the data flow 1.1.1.1→3.3.3.3 to 2.2.2.2→3.3.3.3.

[0104] (3) The website receives the request and responds.

[0105] Specifically, the website receives the request initiated by the firewall and transmits the request data to the firewall. The data flow is 3.3.3.3→2.2.2.2.

[0106] (4) The firewall processes the data again and returns it to the user.

[0107] Specifically, after receiving the website recovery, the firewall changes the destination to the user address, transmits the data to the user, and changes the data flow 3.3.3.3→2.2.2.2 to 3.3.3.3→1.1.1.1.

[0108] (5) The user receives the data information.

[0109] Another embodiment of the present application provides a firewall for executing the steps in the Cloud Shield scenario implementation method in which the execution subject is the firewall; the firewall is configured with an Ethernet bridge firewall, a packet filtering firewall and a fast packet processing technology.

[0110] The specific process and principle of the cloud shield scenario implementation method will not be described here one by one, and it will depend on the actual situation and is within the scope of protection of this application.

[0111] See also Figure 6 , which shows the relationship between various interfaces in an operating system; Figure 6 As shown in the figure, kernel represents the Linux operating system kernel, and vpp represents running on the Linux operating system. The linuxhost interface and vethpeer interface in the figure are both virtual interfaces in the Linux kernel. The host-vethpeer interface is a vpp virtual interface generated by the vpp program based on the Linux kernel virtual interface. In the Linux operating system, the only interface eth0 (that is, the only interface on the cloud) and the Linux virtual interface linuxhost are bound to the bridge br0.

[0112] 1. Ebtables technology: Ebtables is an Ethernet bridge firewall. Ethernet bridge works at the data link layer. Ebtables is mainly used to filter data packets at the data link layer. Ebtables can filter the second layer data traffic in the network.

[0113] 2. iptabls Technology: iptables is a packet filtering firewall that forms part of the Linux platform. It can implement firewall solutions, complete functions such as packet filtering, packet redirection, and network address translation (NAT), and can filter three-layer data traffic in the network.

[0114] 3. vpp Technology: vpp is a fast packet processing development platform for network applications. It can run on most general-purpose CPUs with various architectures including ARM32 / 64 and X86, and can further improve performance with the help of DPDK, etc. It exists as an application in the Linux user space.

[0115] Principle: This technology adds the configurations of ebtables, iptables, and vpp to the configuration of the traditional firewall. By using the layer-2 traffic filtering technology of ebtables, the layer-3 traffic filtering technology of iptables, and the high network performance characteristics of vpp, the data traffic on the cloud is processed so that the traffic can be transmitted normally on the cloud, without worrying about the problem of management and service conflicts caused by insufficient cloud interfaces. Through the improvement of the vpp technology and the combination of ebtables and iptables technologies, this technology has completed the implementation plan for the integration of the service port and management port of the cloud firewall. The implementation plan is as follows:

[0116] ebtables -t broute -A BROUTING -i br0 -p ipv4 --ip-proto tcp --ip-dport xx --ip-dst xxx.xxx.xxx.xxx -j redirect --redirect-target DROP, iptables -A PREROUTING -t nat -i br0 -p tcp -d xxx.xxx.xxx.xxx --dport xx -j DNAT --to xxx.xxx.xxx.xxx:xx. This configuration means that the ebtables technology and iptables technology are set in the firewall. This technology can achieve that when the user manages the firewall, the user data is forwarded to the firewall itself, and the firewall returns the information to the user side. This configuration realizes the function of managing the firewall with a single port on the cloud.

[0117] The cnattranslation adds the protocol TCP realxxxxxxto->xxxx xx. This configuration indicates that the vpp technology is set in the firewall. This technology can achieve that when a user requests a website on the cloud, the firewall will perform source address translation, modifying the user->website data to firewall->website. After the website returns information, the website->firewall information is modified to website->user. The information received by the website is initiated by the firewall from beginning to end. This method can well protect the security of the website. This configuration realizes the function of protecting the website with a single interface on the cloud, that is, the business function.

[0118] Through the combination of three technologies and the improvement of the vpp technology, a technical solution for integrating the management port and the service port on the cloud is realized.

[0119] Another embodiment of this application provides a storage medium, on which a computer program is stored. Among them, when the computer program is executed by a processor, it realizes the cloud shield scenario implementation method in any one of the above embodiments.

[0120] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0121] It should be noted that the computer-readable medium described above can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. In the present disclosure, the computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, and this computer-readable signal medium can send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0122] The above computer-readable medium can be included in the above electronic device; or it can exist separately and not be assembled into the electronic device.

[0123] Another embodiment of the present invention provides an electronic device, as Figure 7 shown, including:

[0124] One or more processors 201.

[0125] A storage device 202, on which one or more programs are stored.

[0126] When one or more programs are executed by one or more processors 201, it causes the one or more processors 201 to implement the cloud shield scenario implementation method as described in any one of the above embodiments.

[0127] In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, an embodiment of the present disclosure includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes program code for performing the methods shown in the flowcharts.

[0128] Although the subject matter has been described in language specific to structural features and / or methodological acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

[0129] Although a number of specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be implemented combinatorially in a single embodiment. Conversely, the various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0130] The above description is only a preferred embodiment of the present disclosure and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of the disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosure concept. For example, a technical solution formed by mutually replacing the above features with the (but not limited to) technical features having similar functions disclosed in the present disclosure.

[0131] It should be noted that the method and system for implementing the cloud shield scenario, the electronic device, and the storage medium provided by the present invention can be used in the fields of artificial intelligence, blockchain, distributed, cloud computing, big data, Internet of Things, mobile Internet, network security, chip, virtual reality, augmented reality, holographic technology, quantum computing, quantum communication, quantum measurement, digital twin, or finance. The above are only examples and do not limit the application fields of the method and system for implementing the cloud shield scenario, the electronic device, and the storage medium provided by the present invention.

[0132] The features described in the various embodiments in this specification can be replaced or combined with each other. For the parts that are the same or similar among the various embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for a system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and reference can be made to the relevant part of the method embodiment for the related content. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative work.

[0133] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0134] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for implementing a cloud shield scenario. It is characterized in that include: The user initiates a data request to the website; The firewall receives the data request initiated by the user through the Ethernet bridge firewall and the packet filtering firewall technology, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request; wherein the firewall has a unique interface, which is a single interface on the cloud, and the Ethernet bridge firewall and the packet filtering firewall technology are used to forward user data to the firewall itself when the user manages the firewall, and the firewall itself returns the information to the user end; The website responds to the data request sent by the firewall and sends the request data to the firewall. The data path for the website to transmit the request data to the firewall is from the website address to the firewall address. The firewall processes the request data sent by the website according to the fast packet processing technology, and returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology after the processing is completed; The user receives the data, and the data path for the user to receive the firewall transmission request data is from the firewall address to the user address; The firewall receives the data request initiated by the user through the Ethernet bridge firewall and the packet filtering firewall technology, processes the data request according to the fast packet processing technology, and sends the processed data request to the website corresponding to the data request, including: The firewall receives the data request initiated by the user through the Ethernet bridge firewall and packet filtering firewall technology; The firewall changes the user address of the data request to the firewall address through the fast packet processing technology; The data request after hiding the user address is sent to the website corresponding to the data request.

2. According to the cloud shield scenario implementation method described in claim 1, It is characterized in that The data path in the data request initiated by the user to the website is from the user address to the website address.

3. The cloud shield scenario implementation method according to claim 1, It is characterized in that The data path for the website to transmit request data to the firewall is from the website address to the firewall address.

4. The cloud shield scenario implementation method according to claim 1, It is characterized in that The firewall processes the request data sent by the website according to the fast packet processing technology, and returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology after the processing is completed, including: The firewall modifies the destination address in the request data sent by the website from the firewall address to the user address according to the fast packet processing technology; The firewall returns the request data to the user through the Ethernet bridge firewall and the packet filtering firewall technology.

5. A firewall, It is characterized in that Used to execute the steps in which the execution subject is a firewall in the Cloud Shield scenario implementation method as described in any one of claims 1-4; the firewall is configured with an Ethernet bridge firewall, a packet filtering firewall and fast packet processing technology.

6. An electronic device, It is characterized in that Comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the cloud shield scenario implementation method according to any one of claims 1-4.

7. A storage medium, Characterized in that, A computer program is stored thereon, wherein when the computer program is executed by a processor, the cloud shield scenario implementation method according to any one of claims 1-4 is implemented.

Images