A method, apparatus, device, and storage medium for accelerating a network security engine.

Abstract

This application discloses a method, apparatus, device, and storage medium for accelerating a network security engine, relating to the field of network security. The method includes: extracting data packets from the Rx queue of a multi-queue network interface card (NIC); determining the session associated with the data packet based on metadata extracted from the data packet; determining whether to block the data packet based on the session information; if not, extracting key information and ciphertext data from the data packet and writing it to a decryption device; reading decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device via polling; performing HTTP parsing on the decrypted data; sending the parsed data to the security engine for threat detection; and determining whether to block the data packet based on the detection result. This application implements the preprocessing flow originally in the security engine within the VPP protocol stack and offloads HTTPS decryption to the decryption device, thereby reducing CPU resource overhead, improving the processing performance of the security engine, and accelerating the network security engine.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a network security engine acceleration method, apparatus, device, and storage medium. Background Technology

[0002] With the development of the internet, network traffic has experienced explosive growth. For example, the proportion of traffic built on the SSL (Secure Socket Layer) layer has been increasing year by year. Security engines face high costs in handling encrypted traffic, with common traffic volumes reaching 50Gbps and 100Gbps. Traditional network security engines, such as Snort (a defense system), Suricata (a network threat detection engine), and ModSecurity (a web application firewall), suffer from severe performance issues. The overall system performance is heavily limited by decryption performance, making it unable to handle large-scale network traffic. In other words, traditional network security engines typically receive data packets from the kernel and then map them to user space for analysis. However, this data exchange method is extremely inefficient, and in high-traffic scenarios, receiving data packets becomes a performance bottleneck. Although network security engines can offload some functions to kernel space, the offloadable functions are very limited and can easily lead to system instability. While some network security engines can also send and receive data packets from user space, solving the packet receiving bottleneck problem, HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) decryption requires CPU (Central Processing Time) processing. Implemented in the CPU (Central Processing Unit), however, CPU decryption is inefficient, and the packet processing protocol stack and network security engine need to be deeply bound together, making it difficult to balance performance and the detection capabilities of the security engine in such complex logic processing. It also lacks scalability, and hackers' attack methods are becoming increasingly complex and diverse, so there are still hidden dangers to data security. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a network security engine acceleration method, apparatus, device, and storage medium, which can reduce CPU resource overhead, significantly improve the processing performance of the security engine, and reduce the processing pressure on the network security engine, thereby accelerating the network security engine. The specific solution is as follows:

[0004] In a first aspect, this application discloses a network security engine acceleration method applied to VPP worker threads, including:

[0005] Extract data packets from the Rx queue of the pre-configured multi-queue network interface card, and extract the metadata from the data packets;

[0006] The session associated with the data packet is determined based on the metadata, and the session information of the session is used to determine whether to block the data packet.

[0007] If the data packet is not blocked, the key information and ciphertext data are extracted from the data packet and written into the decryption device;

[0008] The decrypted data obtained by the decryption device using the key information is read from the decryption device through polling, and the decrypted data is parsed by HTTP to obtain the parsed data.

[0009] The parsed data is sent to the security engine for threat detection to obtain the corresponding detection results, and the decision on whether to block the data packet is based on the detection results.

[0010] Optionally, before retrieving packets from the Rx queue of a pre-configured multi-queue network interface card, the method further includes:

[0011] The system uses a polling method to check whether there are any data packets written to memory in the Rx queue of the pre-configured multi-queue network interface card; wherein, the Rx queue records the address of the data packet in memory;

[0012] Accordingly, the step of extracting data packets from the Rx queue of a pre-configured multi-queue network interface card includes:

[0013] If the polling method shows that the Rx queue contains data packets written to memory, then the data packets are extracted from the Rx queue of the pre-configured multi-queue network card.

[0014] Optionally, after checking whether there are data packets written to memory in the Rx queue of the pre-configured multi-queue network card by polling, the method further includes:

[0015] If the polling method shows that the Rx queue has no data packets written to memory, then continue polling to see if the Rx queue has any data packets written to memory.

[0016] Optionally, extracting metadata from the data packet includes:

[0017] Extract the IP address, port, and protocol type from the data packet.

[0018] Optionally, determining whether to block the data packet based on the detection result includes:

[0019] If the detection result indicates that a threat has been detected, the data packet is blocked, and the step of reading the decrypted data obtained by decrypting the ciphertext data using the key information from the decryption device through polling and subsequent steps are re-executed.

[0020] If the detection result indicates that no threat was detected, the data packet is allowed to pass.

[0021] Accordingly, if no threat is detected, after allowing the data packet to pass, the following steps are also included:

[0022] The data packet to be allowed is written into the Tx queue of the multi-queue network card, and the multi-queue network card is notified so that it can retrieve the data from the Tx queue and send the data to the service terminal for processing.

[0023] Optionally, extracting key information and ciphertext data from the data packet includes:

[0024] The data packet is parsed using HTTPS to obtain the SSL / TLS key information and ciphertext data.

[0025] Optionally, writing the key information and the ciphertext data into the decryption device includes:

[0026] The key information is sent to the decryption device, and the ciphertext data is written to the decryption queue.

[0027] Accordingly, reading the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device via polling includes:

[0028] The decryption device monitors whether the queue to be decrypted is empty.

[0029] When the decryption device detects that the queue to be decrypted is not empty, it obtains the data to be decrypted from the queue through the decryption device, and uses the key information corresponding to the data to be decrypted to decrypt the data to obtain the decrypted data.

[0030] The decryption completion queue is polled to monitor whether the decryption completion queue is empty; the decryption completion queue is a queue that stores the decrypted data written by the decryption device.

[0031] When the decryption completion queue is detected to be non-empty, the decrypted data is retrieved from the decryption completion queue.

[0032] Secondly, this application discloses a network security engine acceleration device applied to a VPP worker thread, comprising:

[0033] The first extraction module is used to extract data packets from the Rx queue of a pre-configured multi-queue network interface card;

[0034] Meta-information extraction module, used to extract metadata from the data packet;

[0035] A session determination module is used to determine the session associated with the data packet based on the metadata.

[0036] The first blocking module is used to determine whether to block the data packet based on the session information of the session;

[0037] The second extraction module is used to extract key information and ciphertext data from the data packet if the data packet is not blocked, and write the key information and ciphertext data into the decryption device.

[0038] The data reading module is used to read the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device in a polling manner.

[0039] The data decryption module is used to perform HTTP parsing on the decrypted data to obtain parsed data;

[0040] The data sending module is used to send the parsed data to the security engine for threat detection and to obtain the corresponding detection results.

[0041] The second blocking module is used to determine whether to block the data packet based on the detection result.

[0042] Thirdly, this application discloses an electronic device, including:

[0043] Memory, used to store computer programs;

[0044] A processor for executing the computer program to implement the steps of the aforementioned disclosed network security engine acceleration method.

[0045] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed network security engine acceleration method.

[0046] As can be seen, this application provides a network security engine acceleration method applied to a VPP worker thread, comprising: extracting data packets from the Rx queue of a pre-configured multi-queue network interface card and extracting metadata from the data packets; determining the session associated with the data packets based on the metadata, and determining whether to block the data packets based on the session information of the session; if the data packets are not blocked, extracting key information and ciphertext data from the data packets and writing the key information and ciphertext data into a decryption device; reading decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device through polling, and performing HTTP parsing on the decrypted data to obtain parsed data; sending the parsed data to the security engine for threat detection to obtain corresponding detection results, and determining whether to block the data packets based on the detection results. Therefore, this application, based on the VPP security engine architecture, implements the preprocessing process originally in the security engine within the VPP protocol stack, and offloads HTTPS decryption to the decryption device, thereby reducing CPU resource overhead, significantly improving the processing performance of the security engine, reducing the processing pressure on the network security engine, and thus accelerating the network security engine. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0048] Figure 1 This is a flowchart of a network security engine acceleration method disclosed in this application;

[0049] Figure 2 This application discloses a specific flowchart of a network security engine acceleration method.

[0050] Figure 3 This is a schematic diagram of a network security engine acceleration framework disclosed in this application;

[0051] Figure 4 This is a schematic diagram of the structure of a network security engine acceleration device disclosed in this application;

[0052] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Currently, traditional network security engines suffer from severe performance issues, with overall system performance heavily limited by decryption capabilities. Furthermore, increasingly sophisticated and diverse hacker attack methods pose continued data security risks. Therefore, this application provides a novel network security engine acceleration solution that reduces CPU resource consumption, significantly improves the processing performance of the security engine, and alleviates its processing load, thereby accelerating the network security engine.

[0055] This invention discloses a network security engine acceleration method applied to VPP worker threads. See [link to relevant documentation]. Figure 1 As shown, the method includes:

[0056] Step S11: Extract data packets from the Rx queue of the pre-configured multi-queue network card, and extract the metadata from the data packets.

[0057] It is understandable that after the multi-queue network card is pre-configured, when a user accesses the backend service, the multi-queue network card can receive data packets. Then, the multi-queue network card distributes multiple data packets to different Rx queues through a preset distribution algorithm. Therefore, when the VPP worker thread starts, it can extract data packets from the Rx queues of the pre-configured multi-queue network card and then extract the metadata of the data packets. Specifically, it extracts the IP address, port, and protocol type from the data packets.

[0058] It should be noted that VPP (Vector Packet Processing) is an extensible open-source framework that provides the functionality of network switches or routers. Vector processing processes multiple packets at once, resulting in low latency. The preset distribution algorithm is a hash algorithm, which ensures that packets from the same session are distributed to the same Rx queue. Each worker thread is bound to an Rx queue, guaranteeing that a packet's lifecycle is limited to a single worker thread or CPU core. This ensures that the packet's lifecycle is within the same CPU, making it cache-friendly. Furthermore, it allows for various performance optimization techniques such as NUMA awareness, data prefetching, CPU instruction optimization, and vector processing, resulting in excellent CPU performance. A session refers to multiple packets with identical metadata grouped into the same processing context. This processing context, or session, records the processing status; that is, packets within the same session share the same IP address, port, and protocol type.

[0059] In this embodiment, before extracting data packets from the Rx queue of the pre-configured multi-queue network interface card (NIC), the method further includes: checking whether there are data packets written to memory in the Rx queue of the pre-configured multi-queue NIC using a polling method; wherein, the Rx queue records the address of the data packet in memory. It can be understood that if the polling method shows no data packets written to memory in the Rx queue, the polling method continues to check whether there are data packets written to memory in the Rx queue. If the polling method shows that there are data packets written to memory in the Rx queue, the step of extracting the data packet from the Rx queue of the pre-configured multi-queue NIC and extracting the metadata from the data packet is executed.

[0060] Step S12: Determine the session associated with the data packet based on the metadata, and determine whether to block the data packet based on the session information of the session.

[0061] In this embodiment, the metadata of the aforementioned data packet is extracted, that is, the IP address, port, and protocol type of the data packet are determined. Then, the session associated with the data packet can be determined based on this metadata, and whether to block the data packet can be determined based on the session information. If the session information does not meet the corresponding conditions, the data packet is blocked, that is, the current session is not allowed to pass.

[0062] Step S13: If the data packet is not blocked, extract the key information and ciphertext data from the data packet, and write the key information and ciphertext data into the decryption device.

[0063] If the aforementioned session information meets the corresponding conditions, the data packet is not blocked, i.e., the current session is allowed. Then, key information and ciphertext data are extracted from the data packet and written to the decryption device. Specifically, the data packet is parsed using HTTPS to obtain SSL / TLS (Transport Layer Security) key information and ciphertext data. The key information is sent to the decryption device, and the ciphertext data is written to the decryption queue. It is understood that in this embodiment, offloading the HTTPS decryption task to the decryption device greatly reduces the CPU's processing burden and significantly improves the processing performance of the security engine.

[0064] Step S14: Read the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device by polling, and perform HTTP parsing on the decrypted data to obtain parsed data.

[0065] In this embodiment, the decryption device decrypts the ciphertext data. The VPP worker thread reads the decrypted data obtained by the decryption device using the key information through polling, and then performs HTTP parsing on the decrypted data to obtain parsed data. Specifically, the decryption device monitors whether the queue to be decrypted is empty. When the decryption device detects that the queue to be decrypted is not empty, it retrieves the data to be decrypted from the queue and decrypts it using the key information corresponding to the data to be decrypted to obtain the decrypted data. Then, it polls the decryption completion queue to monitor whether the queue is empty. The decryption completion queue is a queue that stores the decrypted data written by the decryption device. When the decryption completion queue is detected to be not empty, it retrieves the decrypted data from the queue and finally performs HTTP parsing on the decrypted data to obtain parsed data.

[0066] Step S15: Send the parsed data to the security engine for threat detection to obtain the corresponding detection results, and determine whether to block the data packet based on the detection results.

[0067] It should be noted that a network security engine refers to a type of traffic engine that can identify hacker-initiated behavior based on traffic characteristics, and can block attacks while allowing normal business traffic to pass through. Examples include WAF (Web Application Firewall), IDS (Intrusion Detection System), and IPS (Intrusion Prevention System).

[0068] In this embodiment, after performing HTTP parsing on the decrypted data to obtain parsed data, the parsed data is sent to the security engine for threat detection to obtain the corresponding detection result. Based on the detection result, it is determined whether to block the data packet. It is understood that if the detection result indicates a threat is detected, the data packet is blocked, and the step of reading the decrypted data obtained by decrypting the ciphertext data using the key information from the decryption device via polling, and subsequent steps, are re-executed. If the detection result indicates no threat is detected, the data packet is allowed to pass, and the allowed data packet is written into the Tx queue of the multi-queue network card. The multi-queue network card is notified so that it can retrieve data from the Tx queue and send the data to the service terminal for processing. Furthermore, when a threat is detected, the session information can be updated, and the process can jump back to the step of determining whether to block the data packet based on the session information.

[0069] As can be seen, in this embodiment of the application, the VPP-based security engine architecture implements the preprocessing process that was originally in the security engine in the VPP protocol stack, and offloads the decryption of HTTPS to the decryption device, thereby reducing CPU resource overhead, significantly improving the processing performance of the security engine, reducing the processing pressure of the network security engine, and thus accelerating the network security engine.

[0070] For example, see Figure 2As shown, the input data packets are obtained through polling. Then, the metadata of the data packets is extracted, and the existence of a corresponding session is determined based on this metadata. If no session exists, a session is created. If a session exists, the session information is used to determine whether to block the data packet. If the data packet is not blocked, HTTPS parsing is performed on the data packet to obtain the SSL / TLS key information and ciphertext data. The key information and ciphertext data are then written to the decryption device, i.e., the HTTPS decryption task is offloaded to the decryption device. After writing the key information and ciphertext data corresponding to the current data packet to the decryption device and associating the key information with the ciphertext data, the process continues to poll for new data packets. After the decryption device completes decryption, the decrypted data, i.e., plaintext data, is written to the decryption completion queue. Specifically, VPPWorker polls the decryption completion queue, and when it detects that the decryption completion queue is not empty, it reads the decrypted data from the queue. The worker performs HTTP parsing on the decrypted data and sends the parsed data to the network security engine. The network security engine then performs corresponding threat detection based on the received parsed data. If a threat is detected, the data packet is blocked, the session information is updated, and the process jumps to the step of determining whether to block the data based on the session information; otherwise, the data is allowed.

[0071] For example, see Figure 3As shown, when a user accesses the backend service, the multi-queue network interface card (NIC) can receive data packets. The NIC distributes multiple data packets to different Rx queues, and each worker thread is bound to one Rx queue. The worker thread polls to check if any data packets have been written to memory. If so, it retrieves the data packet from the Rx queue and extracts metadata, such as the IP address, port, and protocol type. Based on this metadata, it associates the data packet with a session, determining the associated session. Then, based on the session content, it determines whether to block the data packet. If the data packet is not blocked, it performs HTTPS parsing to obtain the SSL / TLS key information and ciphertext data. The key information is sent to the decryption device, and the ciphertext data is written to the decryption queue. When the decryption device finds that the decryption queue is not empty, it retrieves the data to be decrypted from the queue and searches for the matching data. The encrypted data corresponding to the encrypted data is decrypted. After decryption, the decrypted data is written to the decryption completion queue. The worker thread polls the decryption completion queue. When the queue is not empty, the decrypted data is retrieved and HTTP parsed. The parsed data is then sent to the security engine for threat detection. If a threat is detected, the session information is updated, subsequent data packets are blocked, and the polling of the decryption completion queue resumes. Otherwise, the data is allowed and written to the network interface card (NIC) Tx queue. The multi-queue NIC is notified. When the multi-queue NIC knows there is a data packet to send in the Tx queue, it retrieves the data from the NIC Tx queue and sends it to the application for processing. Therefore, because VPP uses a polling method to capture data packets and implements the preprocessing process originally in the security engine within the VPP protocol stack, it reduces the overhead of data packets in the preprocessing stage. Offloading the decryption task to a dedicated hardware decryption device significantly reduces the CPU's processing load and improves the security engine's processing performance.

[0072] Accordingly, this application also discloses a network security engine acceleration device applied to VPP worker threads, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0073] The first extraction module 11 is used to extract data packets from the Rx queue of a pre-configured multi-queue network card;

[0074] Meta-information extraction module 12 is used to extract metadata from the data packet;

[0075] Session determination module 13 is used to determine the session associated with the data packet based on the metadata;

[0076] The first blocking module 14 is used to determine whether to block the data packet based on the session information of the session;

[0077] The second extraction module 15 is used to extract key information and ciphertext data from the data packet if the data packet is not blocked, and write the key information and ciphertext data into the decryption device.

[0078] The data reading module 16 is used to read the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device in a polling manner.

[0079] Data decryption module 17 is used to perform HTTP parsing on the decrypted data to obtain parsed data;

[0080] Data sending module 18 is used to send the parsed data to the security engine for threat detection and to obtain the corresponding detection results;

[0081] The second blocking module 19 is used to determine whether to block the data packet based on the detection result.

[0082] As can be seen from the above, the security engine architecture based on VPP in this embodiment implements the preprocessing process that was originally in the security engine in the VPP protocol stack, and offloads the decryption of HTTPS to the decryption device, thereby reducing the CPU resource overhead, significantly improving the processing performance of the security engine, reducing the processing pressure of the network security engine, and thus accelerating the network security engine.

[0083] In some specific embodiments, the network security engine acceleration device may specifically include:

[0084] The packet viewing module is used to check whether there are packets written to memory in the Rx queue of the pre-configured multi-queue network card by polling; wherein, the Rx queue records the address of the packet in memory;

[0085] In some specific embodiments, the first extraction module 11 may specifically include:

[0086] The first extraction unit is used to extract the data packet from the Rx queue of the pre-configured multi-queue network card if the Rx queue is found to contain the data packet written to memory through the polling method.

[0087] In some specific embodiments, the data packet viewing module may specifically include:

[0088] The polling unit is used to continue polling the Rx queue to check if there are any data packets written to memory if the polling method shows no such data packets in the Rx queue.

[0089] In some specific embodiments, the metadata extraction module 12 may specifically include:

[0090] Extract the IP address, port, and protocol type from the data packet.

[0091] In some specific embodiments, the second blocking module 19 may specifically include:

[0092] The blocking unit is used to block the data packet if the detection result indicates that a threat has been detected, and to re-execute the step of reading the decrypted data obtained by decrypting the ciphertext data using the key information from the decryption device by polling, and the subsequent steps thereafter.

[0093] In some specific embodiments, the second blocking module 19 may specifically include:

[0094] A clearance unit is configured to allow the data packet to pass if the detection result indicates that no threat has been detected.

[0095] In some specific embodiments, the step of allowing the data packet to pass if the detection result indicates that no threat has been detected may specifically include:

[0096] The data processing unit is used to write the data packets to be allowed into the Tx queue of the multi-queue network interface card (NIC), notify the multi-queue NIC so that the multi-queue NIC can retrieve data from the Tx queue, and send the data to the service terminal for processing.

[0097] In some specific embodiments, the second extraction module 15 may specifically include:

[0098] The extraction unit is used to perform HTTPS parsing on the data packet to obtain SSL / TLS key information and ciphertext data.

[0099] In some specific embodiments, the second extraction module 15 may specifically include:

[0100] A key sending unit is used to send the key information to a decryption device;

[0101] The ciphertext writing unit is used to write the ciphertext data to the queue to be decrypted;

[0102] In some specific embodiments, the data reading module 16 may specifically include:

[0103] The monitoring unit is used to monitor whether the queue to be decrypted is empty through the decryption device;

[0104] The first data acquisition unit is used to acquire data to be decrypted from the queue to be decrypted by the decryption device when the decryption device detects that the queue to be decrypted is not empty, and to decrypt the data to be decrypted by using the key information corresponding to the data to be decrypted to obtain decrypted data.

[0105] A polling monitoring unit is used to poll the decryption completion queue to monitor whether the decryption completion queue is empty; the decryption completion queue is a queue that stores the decrypted data written by the decryption device;

[0106] The second data acquisition unit is used to acquire the decrypted data from the decryption completion queue when it is detected that the decryption completion queue is not empty.

[0107] Furthermore, embodiments of this application also provide an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0108] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network security engine acceleration method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0109] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0110] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0111] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network security engine acceleration method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0112] Furthermore, embodiments of this application also disclose a computer-readable storage medium storing a computer program, which, when loaded and executed by a processor, implements the network security engine acceleration method steps disclosed in any of the foregoing embodiments.

[0113] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0114] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0115] The foregoing has provided a detailed description of a network security engine acceleration method, apparatus, device, and storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A network security engine acceleration method, characterized by, Applied to VPP worker threads, including: Extract data packets from the Rx queue of the pre-configured multi-queue network interface card, and extract the metadata from the data packets; The session associated with the data packet is determined based on the metadata, and the session information of the session is used to determine whether to block the data packet. If the data packet is not blocked, the key information and ciphertext data are extracted from the data packet and written into the decryption device; The decrypted data, obtained by the decryption device using the key information, is read from the decryption device via polling, and the decrypted data is then parsed via HTTP to obtain the parsed data. The parsed data is sent to the security engine for threat detection to obtain the corresponding detection results, and based on the detection results, it is determined whether to block the data packet; Before extracting data packets from the Rx queue of the pre-configured multi-queue network interface card (NIC), the NIC distributes multiple data packets to different Rx queues using a preset distribution algorithm. The preset distribution algorithm ensures that data packets from the same session are distributed to the same Rx queue, that data packets from the same session have the same metadata, and that each VPP worker thread is bound to an Rx queue.

2. The network security engine acceleration method according to claim 1, characterized in that, Before retrieving data packets from the Rx queue of the pre-configured multi-queue network interface card, the process also includes: The system uses a polling method to check whether there are any data packets written to memory in the Rx queue of the pre-configured multi-queue network interface card; wherein, the Rx queue records the address of the data packet in memory; Accordingly, the step of extracting data packets from the Rx queue of a pre-configured multi-queue network interface card includes: If the polling method shows that the Rx queue contains data packets written to memory, then the data packets are extracted from the Rx queue of the pre-configured multi-queue network card.

3. The network security engine acceleration method according to claim 2, characterized in that, After checking whether the Rx queue of the pre-configured multi-queue network card has been written to memory via polling, the process also includes: If the polling method shows that the Rx queue does not contain any data packets written to memory, then the polling continues to check if the Rx queue contains any data packets written to memory.

4. The network security engine acceleration method according to claim 1, characterized in that, The extraction of metadata from the data packet includes: Extract the IP address, port, and protocol type from the data packet.

5. The network security engine acceleration method according to claim 1, characterized in that, The step of determining whether to block the data packet based on the detection result includes: If the detection result indicates that a threat has been detected, the data packet is blocked, and the step of reading the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data through polling and subsequent steps are re-executed. If the detection result indicates that no threat was detected, the data packet is allowed to pass. Accordingly, if no threat is detected, after allowing the data packet to pass, the following steps are also included: The data packet to be allowed is written into the Tx queue of the multi-queue network card, and the multi-queue network card is notified so that it can retrieve the data from the Tx queue and send the data to the service terminal for processing.

6. The network security engine acceleration method according to claim 1, characterized in that, The step of extracting key information and ciphertext data from the data packet includes: The data packet is parsed using HTTPS to obtain the SSL / TLS key information and ciphertext data.

7. The network security engine acceleration method according to any one of claims 1 to 6, characterized in that, The step of writing the key information and the ciphertext data into the decryption device includes: The key information is sent to the decryption device, and the ciphertext data is written to the decryption queue. Accordingly, reading the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device via polling includes: The decryption device monitors whether the queue to be decrypted is empty. When the decryption device detects that the queue to be decrypted is not empty, it obtains the data to be decrypted from the queue through the decryption device, and uses the key information corresponding to the data to be decrypted to decrypt the data to obtain the decrypted data. The decryption completion queue is polled to monitor whether the decryption completion queue is empty; the decryption completion queue is a queue that stores the decrypted data written by the decryption device. When the decryption completion queue is detected to be non-empty, the decrypted data is retrieved from the decryption completion queue.

8. A network security engine acceleration device, characterized in that, Applied to VPP worker threads, including: The first extraction module is used to extract data packets from the Rx queue of a pre-configured multi-queue network interface card; Meta-information extraction module, used to extract metadata from the data packet; A session determination module is used to determine the session associated with the data packet based on the metadata. The first blocking module is used to determine whether to block the data packet based on the session information of the session; The second extraction module is used to extract key information and ciphertext data from the data packet if the data packet is not blocked, and write the key information and ciphertext data into the decryption device. The data reading module is used to read the decrypted data obtained by the decryption device using the key information to decrypt the ciphertext data from the decryption device in a polling manner. The data decryption module is used to perform HTTP parsing on the decrypted data to obtain parsed data; The data sending module is used to send the parsed data to the security engine for threat detection and to obtain the corresponding detection results. The second blocking module is used to determine whether to block the data packet based on the detection result; Before extracting data packets from the Rx queue of the pre-configured multi-queue network interface card (NIC), the NIC distributes multiple data packets to different Rx queues using a preset distribution algorithm. The preset distribution algorithm ensures that data packets from the same session are distributed to the same Rx queue, that data packets from the same session have the same metadata, and that each VPP worker thread is bound to an Rx queue.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the network security engine acceleration method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the steps of the network security engine acceleration method as described in any one of claims 1 to 7.

Images