A session keeping alive method, network security system, electronic device and storage medium

Abstract

The embodiment of the present application provides a session keep-alive method, a network security system, an electronic device and a storage medium, the method comprising: a network element receives a flow message, parses the flow message, obtains a parsing result of the session, sends the parsing result to a driver module and an acceleration network card, and forms table entries of a first session table, a second session table and a third session table; the first session table and the second session table have corresponding timeout times; when the current time exceeds the timeout time of the session, the network element deletes the table entry about the session in the third session table; when the current time exceeds the timeout time of the session in the second session table, the driver module deletes the table entry about the session in the third session table; the acceleration network card obtains working parameters, sends the working parameters to the driver module and the network element, updates the timeout times in the first session table and the second session table, and avoids repeated uploading of data packets of the same flow message to the network element for security inspection.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a session keep-alive method, a network security system, an electronic device, and a computer-readable storage medium. Background Art

[0002] As cloud security technology is increasingly widely used, more and more security network elements are integrated into a hardware system. The processing performance of the central processing unit (CPU) restricts the performance of the network element, and hardware acceleration technology comes into being. Field Programmable Gate Array (FPGA) acceleration network card is a hardware acceleration technology. Sessions that have passed the network element inspection can be sent to the FPGA acceleration network card. The messages of the same session are no longer sent to the CPU for processing, but are directly forwarded in the FPGA acceleration network card. However, in this way, the session table in the security network element cannot obtain the message information, which will cause the session table in the security network element to time out and delete, and then delete the corresponding table entry in the FPGA acceleration network card, causing the traffic to be sent to the network element for processing again, which will cause the overall performance of the system to decline. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a session keep-alive method, a network security system, an electronic device and a computer-readable storage medium, which can solve the problem of timeout deletion of session tables in security network elements and degradation of overall system performance.

[0004] In a first aspect, an embodiment of the present application provides a session keeping alive method, including:

[0005] The network element receives the traffic message, parses the traffic message, obtains the parsing result of the session, adds the parsing result and the timeout time of the session as table entries of the first session table of the network element to the first session table, and sends the parsing result to the driving module;

[0006] The driver module adds the parsing result and the timeout period of the session as table entries of the second session table of the driver module to the second session table, and sends the parsing result to the acceleration network card;

[0007] The acceleration network card adds the parsing result as an entry of the third session table of the acceleration network card to the third session table;

[0008] When the current time exceeds the timeout time of the session in the first session table, the network element deletes the entry about the session in the third session table through the driving module;

[0009] The driving module deletes the entry about the session in the third session table when the current time exceeds the timeout time of the session in the second session table;

[0010] The acceleration network card obtains current working parameters and sends the working parameters to the driving module;

[0011] The driving module updates the timeout period of the session in the second session table according to the working parameter, and sends the working parameter to the network element;

[0012] The network element updates the timeout period of the session in the first session table according to the working parameter.

[0013] In the above implementation process, the acceleration network card will regularly upload the working parameters to the driver module. The driver module updates the timeout of the session in the second session table stored in the driver module according to the working parameters, and sends the working parameters to the network element. The network element updates the timeout of the session in the first session table stored in the network element according to the working parameters. Based on this, the first session table in the network element will not be deleted due to timeout, the network element will not issue a command to delete the third session table of the acceleration network card, and the data packets of the same traffic message will not be repeatedly uploaded to the network element for security inspection, thereby improving the performance of the network security system. The network element deletes the third session table through the driver module, and the network element and the driver module belong to different distributed systems, and the two systems transmit information through private protocol messages. When the network traffic is large, the message sent by the network element to the driver module may be lost. By saving the second session table on the driver module, it is ensured that the driver module can delete the third session table immediately when there is a problem in the communication between the network element and the driver module.

[0014] Furthermore, the step of sending the working parameters to the driving module includes:

[0015] The working parameters are sent to the driving module every first preset time.

[0016] In the above implementation process, the acceleration network card reports the working parameters to the driver module at preset intervals, the second session table of the driver module is updated in time, and the first session table and the second session table are highly consistent, further avoiding the first session table from being deleted due to timeout.

[0017] Furthermore, the step of sending the working parameters to the driving module includes:

[0018] The working parameters are sent to the driving module every preset number of messages.

[0019] In the above implementation process, the acceleration network card reports the working parameters to the driver module every preset number of messages, the second session table of the driver module is updated in time, and the first session table and the second session table are highly consistent, further avoiding the first session table from being deleted due to timeout.

[0020] Further, the method further comprises: the network element stores a first working state of the driving module; the driving module stores a second working state of the network element;

[0021] The driving module generates a heartbeat message every second preset time, and sends the heartbeat message to the network element;

[0022] The network element modifies the first working state according to the heartbeat message and generates a reply message, and sends the reply message to the driver module;

[0023] The driving module modifies the second working state according to the reply message.

[0024] In the above implementation process, the network element and the driver module belong to different independent systems, and the network element and the driver module transmit information through private protocol messages. In the case of large network traffic, the network element may not receive the working parameters submitted by the driver module due to being busy, and the first session table, the second session table and the third session table are not synchronized, so that the table items of the first session table are deleted due to timeout, and the table items of the third session table are also deleted due to timeout. Finally, the data packets of the traffic message are sent to the network element for processing, and the performance of the entire security system is reduced. The use of heartbeat messages and reply messages can keep the driver module and the network element able to obtain each other's working status, and corresponding measures can be taken according to the working status to ensure that the relevant table items in the first session table are not deleted, and further ensure that the third session table is not deleted.

[0025] Furthermore, if the first working state is to stop working, the network element stops sending the session table to the driving module, and retains the table entry about the session in the first session table.

[0026] In the above implementation process, if the network element does not receive the heartbeat message within the first time interval, it means that the communication between the network element and the driver module is unstable at this time, and the parsing result is no longer sent to the driver module to avoid the unreachable information sent and waste of network element resources. Since the table entry about the session in the first session table is retained, the session table entry in the third session table is not deleted by timeout.

[0027] Furthermore, the method further includes: if the second working state is stopping working, no longer sending the working parameter to the network element.

[0028] In the above implementation process, if the driving module does not receive a reply message within the second time interval, it means that the communication between the network element and the driving module is unstable at this time, and the working parameters will no longer be sent to the network element to avoid the sent information being unreachable and wasting the resources of the network element.

[0029] Furthermore, the working parameters are a session message count and a session timeout period.

[0030] In a second aspect, an embodiment of the present application provides a network security system, including:

[0031] Includes: network element, driver module and acceleration network card;

[0032] The network element is used to receive a flow message, parse the flow message, obtain a parsing result of the session, add the parsing result and the timeout time of the session as table entries of the first session table of the network element to the first session table, and send the parsing result to the driver module;

[0033] The driver module is used to add the parsing result and the timeout period of the session as table entries of the second session table of the driver module to the second session table, and send the parsing result to the acceleration network card;

[0034] The acceleration network card is used to add the parsing result as an entry of the third session table of the acceleration network card to the third session table;

[0035] The network element is used to delete the table entry about the session in the third session table through the driving module when the current time exceeds the timeout time of the session in the first session table;

[0036] The driving module is used for deleting the entry about the session in the third session table when the current time exceeds the timeout time of the session in the second session table;

[0037] The acceleration network card is used to obtain current working parameters and send the working parameters to the driving module;

[0038] The driving module is used to update the timeout period of the session in the second session table according to the working parameter, and send the working parameter to the network element;

[0039] The network element is used to update the timeout period of the session in the first session table according to the working parameter.

[0040] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0042] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0043] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A schematic diagram of the structure of a network security system provided in an embodiment of the present application;

[0046] Figure 2 A flow chart of a session keeping alive method provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0049] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0050] As cloud security technology is increasingly widely used, more and more security network elements are integrated into a hardware system. The processing performance of the central processing unit (CPU) restricts the performance of the network element, and hardware acceleration technology comes into being. Field Programmable Gate Array (FPGA) acceleration network card is a hardware acceleration technology. Sessions that have passed the network element inspection can be sent to the FPGA acceleration network card. The messages of the same session are no longer sent to the CPU for processing, but are directly forwarded in the FPGA acceleration network card. However, in this way, the session table in the security network element cannot obtain the message information, which will cause the session table in the security network element to time out and delete, and then delete the corresponding table entry in the FPGA acceleration network card, causing the traffic to be sent to the network element for processing again, which will cause the overall performance of the system to decline.

[0051] In view of this, the embodiments of the present application provide a session keep-alive method, a network security system, an electronic device and a computer-readable storage medium, which can solve the problem of timeout deletion of session tables in security network elements and degradation of overall system performance.

[0052] Example 1

[0053] See also Figure 1 The embodiment of the present application provides a network security system, including: a network element, a driver module and an acceleration network card; the network element is used to receive a flow message, parse the flow message, obtain a parsing result of a session, add the parsing result and the timeout time of the session as table items of a first session table of the network element to the first session table, and send the parsing result to the driver module; the driver module is used to add the parsing result as a table item of a second session table of the driver module to the second session table, and send the parsing result to the acceleration network card; the acceleration network card is used to add the parsing result as a table item of a third session table of the acceleration network card to the third session table; the network element is used to delete the table item about the session in the third session table through the driver module when the current time exceeds the timeout time of the session; the driver module is used to delete the table item about the session in the third session table when the current time exceeds the timeout time of the session; the acceleration network card is used to obtain current working parameters and send the working parameters to the driver module; the driver module is used to update the timeout time of the session in the second session table according to the working parameters, and send the working parameters to the network element; the network element is used to update the timeout time of the session in the first session table according to the working parameters.

[0054] The parsing result includes: five-tuple, which is source IP address, source port, destination IP address, destination port and transport layer protocol. The five-tuple can distinguish different sessions, and the corresponding session is unique.

[0055] In the embodiment of the present application, the driver module is used to convert and forward the traffic message format between the acceleration network card and the network element. The driver module can be composed of OpenVSwitch (OVS) and Intel Data Plane Development Kit (DPDK). OVS is a high-quality, multi-layer virtual (software) switch that can send different traffic messages to different network elements. DPDK is a data plane development tool set provided by Intel, which can provide library functions and driver support for efficient data packet processing in user space. Based on DPDK, information transmission between network elements and FPGAs can be realized. In the network security system, the network element belongs to an independent system, and the driver module and the acceleration network card constitute another system, and the two are transmitted through private messages. The acceleration network card and the virtual switch are each a system, and the protocol message is assembled by the driver to achieve communication. The virtual switch and the network element are also each a system, which is realized through the UDP private protocol. OVS includes the driver program of the acceleration network card, so OVS can directly call the driver function to issue the configuration through function call, and the driver function then sends the configuration to the acceleration network card by assembling the protocol message.

[0056] For example, see Figure 2 When the first packet or the first few packets of a traffic message arrive at the network security system, they first pass through Figure 1 Link 1 in the figure reaches the acceleration network card, which sends it to the driver module through link 2, and the driver module sends it to the network element through link 3. The network element parses the first data packet or the first few data packets to obtain the five-tuple of the session corresponding to the traffic message, and the network element adds the five-tuple to the first session table in the network element. The first few data packets are forwarded to the next communication node through links 4, 5, and 6. At the same time, the network element sends the five-tuple to the driver module through link 6, and the driver module sends the five-tuple to the acceleration network card through link 7. The driver module and the acceleration network card each use the parsing results as entries in the local second session table and the third session table. The acceleration network card forwards the traffic through links 12 and 13 according to the third session table.

[0057] Each entry in the first session table and the second session table includes a timeout period. If the current time exceeds the timeout period of a certain entry in the first session table, the network element will delete the timed-out entry in the first session table, and then send a command to the driver module through a message to delete the relevant entries in the third session table and the second session table. When the subsequent data packets of the session cannot hit the entries in the third session table, the acceleration network card will re-upload the subsequent data packets to the network element. The driver module has a second session table. Since the second session table also has a timeout period, when the communication between the network element and the driver module is not smooth, resulting in the network element being unable to delete the first session table through the driver module, the driver module can delete the third session table according to the timeout period in the second session table.

[0058] The acceleration network card obtains the working parameters and sends the working parameters to the driver module through link 8, and the driver module sends the working parameters to the driver module and the network element through link 9. The network element and the driver module update the first session table and the second session table respectively, so that the contents of the first session table, the second session table and the third session table remain synchronized, and the network element will not issue a command to delete the table items in the acceleration network card.

[0059] Since the acceleration network card will regularly upload the working parameters to the driver module, the driver module updates the timeout item of the session in the second session table stored in the driver module according to the working parameters, and sends the working parameters to the network element, and the network element updates the timeout of the session in the first session table stored in the network element according to the working parameters. Based on this, the first session table in the network element will not be deleted due to timeout, the network element will not issue a command to delete the third session table of the acceleration network card, and the data packets of the same traffic message will not be repeatedly uploaded to the network element for security inspection, thereby improving the performance of the network security system. The network element deletes the third session table through the driver module, and the network element and the driver module belong to different distributed systems and transmit information through private protocol messages. When the network traffic is large, the message sent by the network element to the driver module may be lost. By saving the second session table on the driver module and maintaining a high degree of consistency between the second session table and the third session table of the driver module, it is ensured that the driver module can delete the third session table immediately when there is a problem in the communication between the network element and the driver module.

[0060] In a possible implementation manner, the acceleration network card is further configured to send the operating parameters to the driving module at first preset intervals.

[0061] In a possible implementation manner, the acceleration network card is further configured to send the operating parameters to the driving module every preset number of messages.

[0062] In a possible implementation, the network element stores a first working state of the driving module; the driving module stores a second working state of the network element; the driving module is also used to generate a heartbeat message every second preset time and send the heartbeat message to the network element; the network element is also used to modify the first working state according to the heartbeat message and generate a reply message, and send the reply message to the driving module; the driving module is also used to modify the second working state according to the reply message.

[0063] In a possible implementation manner, the network element is further configured to stop sending the session table to the driving module when the first working state is stopping working.

[0064] In a possible implementation manner, the working parameter is a message count of a session.

[0065] Example 2

[0066] See also Figure 3 The present application embodiment provides a session keep-alive method, which is applied to the network security system in embodiment 1, including:

[0067] S201: The network element receives a traffic message, parses the traffic message, obtains a parsing result of the session, adds the parsing result and the timeout time of the session as table entries of the first session table of the network element, and sends the parsing result to the driver module;

[0068] In one possible implementation, after the network element receives the traffic message, it performs a security check on the data packet corresponding to the traffic message. When the check result is safe, the traffic message is parsed. When the check result is unsafe, the session corresponding to the traffic message is directly refused to be forwarded.

[0069] S202: The driver module adds the parsing result and the session timeout time as table entries of the second session table of the driver module to the second session table, and sends the parsing result to the acceleration network card;

[0070] S203: The acceleration network card adds the parsing result as an entry in the third session table of the acceleration network card to the third session table;

[0071] After the network element establishes the session table, it will assemble the parsing results into a UDP private protocol message, and send it to the driver module through the network element's message processing interface. The driver module parses the message content, confirms the characteristics of the UDP private protocol message, and then parses the message content to obtain the parsing result. After adding it to the second session table, the parsing result is sent to the acceleration network card to enable the fast path function.

[0072] That is to say, after the fast path is enabled, the traffic packets are directly forwarded by the network security system through path 10 and path 11, and are no longer sent to the network element for inspection.

[0073] For example, if the entry about a session in the third session table is:

[0074] Source Address Destination Address Source Port Destination Port Transport layer protocol action 127.1.1.1 127.2.2.2 30 40 TCP allow

[0075] When the subsequent acceleration network card receives a new data packet of the traffic message, it parses the data packet and obtains the corresponding parsing result corresponding to the above. Since the action is allowed, it is determined that the session has passed the security check of the network element and can be released directly.

[0076] It should be understood that the first session table, the second session table and the third session table are not necessarily completely the same, but all have a five-tuple and a session timeout period.

[0077] S204: When the current time exceeds the timeout time of the session in the first session table, the network element deletes the entry about the session in the third session table through the driver module; when the current time exceeds the timeout time of the session in the second session table, the driver module deletes the entry about the session in the third session table;

[0078] S205: The acceleration network card obtains the current working parameters and sends the working parameters to the driver module;

[0079] The working parameters include: packet count and TCP change status. The packet count is the number of packets that the accelerator card has forwarded. The TCP status change refers to the session connection changing from the establish state to the finish or reset state.

[0080] In a possible implementation, the method also includes: when the acceleration network card detects that the TCP session connection of the session is changed from the establish state to the finish or reset state, sending deletion information to the virtual switch, the virtual switch deletes the table entry of the session in the second session table and further sends the deletion information to the network element, and the network element deletes the table entry of the session in the first session table.

[0081] In a possible implementation manner, the acceleration network card sends the operating parameters to the driving module every first preset time.

[0082] In a possible implementation, the acceleration network card sends the working parameters to the driving module every preset number of messages.

[0083] S206: The driving module updates the timeout period of the session in the second session table according to the working parameters, and sends the working parameters to the network element;

[0084] like Figure 1As shown in , after the driver module receives the information message about the working parameters of the acceleration network card, it assembles the UDP private protocol message and notifies the first session table to update the message count and timeout time, so as to prevent the problem of inconsistent timeout time in the first session table and the second session table.

[0085] S207: The network element updates the timeout period of the session in the first session table according to the working parameters.

[0086] The timeout period can be updated by resetting the timeout period. For example, the existing timeout period is 35 seconds. When the network element receives a message from the driver module when the timer reaches 30 seconds, the count starts from 0. Once the timer exceeds 35 seconds, the relevant table entry of the session is deleted.

[0087] Since the acceleration network card will regularly upload the working parameters to the driver module, the driver module updates the timeout of the session in the second session table stored in the driver module according to the working parameters, and sends the working parameters to the network element, and the network element updates the timeout of the session in the first session table stored in the network element according to the working parameters. Based on this, the first session table in the network element will not be deleted due to timeout, the network element will not issue a command to delete the third session table of the acceleration network card, and the data packets of the same traffic message will not be repeatedly uploaded to the network element for security inspection, thereby improving the performance of the network security system. The network element deletes the third session table through the driver module, and the network element and the driver module belong to different distributed systems, and the two systems transmit information through private protocol messages. When the network traffic is large, the message sent by the network element to the driver module may be lost. By saving the second session table on the driver module, it is ensured that the driver module can delete the third session table immediately when there is a problem in the communication between the network element and the driver module.

[0088] Since in the network security system, the network element belongs to a distributed system, the acceleration network card and the driver module belong to another distributed system, and the two distributed systems communicate through private messages. In order to ensure the configuration consistency between the network element and the driver module, in a possible implementation, the method also includes: the network element stores a first working state of the driver module; the driver module stores a second working state of the network element; the driver module generates a heartbeat message every second preset time, and sends the heartbeat message to the network element; the network element modifies the first working state according to the heartbeat message and generates a reply message, and sends the reply message to the driver module; the driver module modifies the second working state according to the reply message.

[0089] In the above implementation process, the network element and the driver module belong to different independent systems, and the network element and the driver module transmit information through private protocol messages. In the case of large network traffic, the network element may not receive the working parameters submitted by the driver module due to being busy, and the first session table, the second session table and the third session table are not synchronized, so that the table items of the first session table are deleted due to timeout, and the table items of the third session table are also deleted due to timeout. Finally, the data packets of the traffic message are sent to the network element for processing, and the performance of the entire security system is reduced. The use of heartbeat messages and reply messages can keep the driver module and the network element able to obtain each other's working status, and corresponding measures can be taken according to the working status to ensure that the relevant table items in the first session table are not deleted, and further ensure that the third session table is not deleted.

[0090] In a possible implementation manner, if the first working state is stopping working, the network element stops sending the session table to the driving module, and retains the table entry about the session in the first session table.

[0091] In the above implementation process, if the network element does not receive the heartbeat message within the first time interval, it means that the communication between the network element and the driver module is unstable at this time, and the parsing result is no longer sent to the driver module to avoid the unreachable information sent and waste of network element resources. Since the table entry about the session in the first session table is retained, the session table entry in the third session table is not deleted by timeout.

[0092] In a possible implementation manner, the method further includes: if the second working state is stopping working, no longer sending the working parameters to the network element.

[0093] In the above implementation process, if the driver module does not receive a reply message within the second time interval, it means that the communication between the network element and the driver module is unstable at this time, and the working parameters are no longer sent to the network element to avoid the unreachable information and waste of network element resources.

[0094] This application also provides an electronic device, see Figure 3 , Figure 3 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33, and at least one communication bus 34. The communication bus 34 is used to realize direct connection and communication between these components. The communication interface 32 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0095] The processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 31 can also be any conventional processor, etc.

[0096] The memory 33 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions, and when the computer-readable instructions are executed by the processor 31, the electronic device may execute the various steps involved in the above method embodiment.

[0097] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0098] The memory 33, storage controller, processor 31, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the electronic device.

[0099] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0100] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown. Figure 3Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0101] The embodiment of the present application also provides a computer-readable storage medium, on which instructions are stored. When the instructions are run on a computer, the method of the method embodiment is implemented when the computer program is executed by the processor. To avoid repetition, it will not be described here.

[0102] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0104] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0105] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0106] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0107] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A session keep-alive method, characterized in that: include: The network element receives the traffic message, parses the traffic message, obtains the parsing result of the session, adds the parsing result and the timeout time of the session as table entries of the first session table of the network element to the first session table, and sends the parsing result to the driving module; The driver module adds the parsing result and the timeout period of the session as table entries of the second session table of the driver module to the second session table, and sends the parsing result to the acceleration network card; The acceleration network card adds the parsing result as an entry of the third session table of the acceleration network card to the third session table; When the current time exceeds the timeout time of the session in the first session table, the network element deletes the entry about the session in the third session table through the driving module; The driving module deletes the entry about the session in the third session table when the current time exceeds the timeout time of the session in the second session table; The acceleration network card obtains current working parameters and sends the working parameters to the driving module; The driving module updates the timeout period of the session in the second session table according to the working parameter, and sends the working parameter to the network element; The network element updates the timeout period of the session in the first session table according to the working parameter.

2. The session keeping alive method according to claim 1, characterized in that: The step of sending the working parameters to the driving module comprises: The working parameters are sent to the driving module every first preset time.

3. The session keeping alive method according to claim 1, characterized in that: The step of sending the working parameters to the driving module comprises: The working parameters are sent to the driving module every preset number of messages.

4. The session keeping alive method according to claim 2, characterized in that: The network element stores a first working state of the driving module; The driving module stores the second working state of the network element; the method further comprises: the driving module generates a heartbeat message every second preset time, and sends the heartbeat message to the network element; The network element modifies the first working state according to the heartbeat message and generates a reply message, and sends the reply message to the driver module; The driving module modifies the second working state according to the reply message.

5. The session keeping alive method according to claim 4, characterized in that: The method further includes: if the first working state is stopping working, the network element stops sending the session table to the driving module, and retains the table entry about the session in the first session table.

6. The session keeping alive method according to claim 4, characterized in that: The method further includes: if the second working state is stopping working, the driving module no longer sends the working parameter to the network element.

7. The session keeping alive method according to any one of claims 1 to 6, characterized in that: The working parameter is the message count of the session.

8. A network security system, characterized in that: include: Network elements, driver modules and accelerator cards; The network element is used to receive a flow message, parse the flow message, obtain a parsing result of the session, add the parsing result and the timeout time of the session as table entries of the first session table of the network element to the first session table, and send the parsing result to the driver module; The driver module is used to add the parsing result and the timeout period of the session as table entries of the second session table of the driver module to the second session table, and send the parsing result to the acceleration network card; The acceleration network card is used to add the parsing result as an entry of the third session table of the acceleration network card to the third session table; The network element is used to delete the entry about the session in the third session table through the driving module when the current time exceeds the timeout time of the session in the first session table; The driving module is used for deleting the entry about the session in the third session table when the current time exceeds the timeout time of the session in the second session table; The acceleration network card is used to obtain current working parameters and send the working parameters to the driving module; The driving module is used to update the timeout period of the session in the second session table according to the working parameter, and send the working parameter to the network element; The network element is used to update the timeout period of the session in the first session table according to the working parameter.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 7.

Images