Operator-based cloud-native firewall system

Abstract

The application discloses an Operator-based cloud native firewall system. The cloud native firewall system runs in the same Kubernetes cluster as customer cloud native business in a containerized manner. The cloud native firewall system comprises a configuration management page module, a multi-tenant business management module, a firewall instance management module, a firewall configuration management module and a data plane. The configuration management page module is used for providing opening / closing and custom configuration of the firewall for users. The multi-tenant business management module is used for generating firewall instance information and firewall configuration information according to configuration information in the custom configuration. The firewall instance management module is used for creating a firewall instance according to the firewall instance information. The firewall configuration management module is used for configuring the firewall instance according to the firewall configuration information, and generating a flow diversion rule to be issued to a virtual router in the customer cloud native business, so as to divert customer business traffic to the firewall instance. The data plane is used for deploying the firewall instance, and the firewall instance runs in a containerized manner. The application has the advantages of automatic deployment, elastic expansion and high reliability of cloud native.

Description

Technical Field

[0001] This invention relates to the field of cloud service technology, and in particular to a cloud-native firewall system based on Operator. Background Technology

[0002] After internet services are migrated to the cloud, cloud firewalls, as boundary protection devices for cloud-based services to provide external services, are not only a necessary requirement for security level protection, but also a key element of customer network security.

[0003] Currently, typical cloud firewall solutions in the industry include two modes: deploying third-party firewall instances via virtual machine clusters and enabling local filtering on the server terminal (e.g., through iptables / ebpf). The virtual machine cluster mode suffers from resource management difficulties: low resource utilization, as virtual machines require pre-planning of CPU / memory specifications, necessitating the pre-allocation of significant resources to meet expected firewall performance; extremely difficult dynamic adjustment of firewall resources, with real-time monitoring within virtual machines typically relying on additional agent proxies, resulting in low efficiency and slow response; costly and slow elastic scaling of virtual machine resources, failing to meet the performance requirements of rapidly changing business traffic; and inability to support multi-tenant sharing of firewall instances. The terminal firewall mode suffers from weak functionality and can easily impact business performance: performing filtering on the business terminal can easily lead to decreased network throughput and increased latency; embedded iptables / ebpf struggles to handle complex business processes such as DPI identification and processing, and if complex business processing is enabled locally, applications relying on high CPU / memory usage may experience a significant decline in actual business performance; and it cannot achieve high-reliability scenarios such as elastic scaling. Summary of the Invention

[0004] This invention provides an Operator-based cloud-native firewall system to address the problem of poor performance of existing cloud firewalls.

[0005] According to an embodiment of the present invention, the cloud-native firewall system based on Operator runs in a containerized manner within the same Kubernetes cluster as the customer's cloud-native business.

[0006] The cloud-native firewall system includes:

[0007] The management interface provides a configuration management interface for firewall products. It includes a configuration management page module and a multi-tenant service management module. The configuration management page module provides users with firewall activation / deactivation and custom configuration options. The multi-tenant service management module generates firewall instance information and firewall configuration information based on the configuration information in the custom configuration.

[0008] The control plane runs in Kubernetes operator mode; the control plane includes a firewall instance management module and a firewall configuration management module; the firewall instance management module is used to create firewall instances according to the firewall instance information; the firewall configuration management module is used to configure the firewall instance according to the firewall configuration information, and generate traffic redirection rules to be sent to the virtual router in the customer's cloud-native business, so as to redirect the customer's business traffic to the firewall instance;

[0009] The data plane is used to deploy the firewall instance, which runs in a containerized manner.

[0010] According to some embodiments of the present invention, the configuration management page module also provides the function of processing alarm events reported in real time by the firewall instance.

[0011] According to some embodiments of the present invention, the management plane further includes a storage module for persistently recording the configuration information and the alarm events.

[0012] According to some embodiments of the present invention, the configuration management page module also provides a query entry point for users to log in and query the data stored in the storage module.

[0013] According to some embodiments of the present invention, the configuration management page module provides users with firewall enabling / disabling and custom configuration via the web.

[0014] According to some embodiments of the present invention, the configuration information includes the IP address, IP network segment, and protocol port to be protected.

[0015] According to some embodiments of the present invention, the firewall instance management module is also used to monitor the running status of the firewall instance and dynamically adjust the resources used by the firewall instance.

[0016] According to some embodiments of the present invention, the resources used include CPU, memory, and network bandwidth.

[0017] According to some embodiments of the present invention, when the firewall instance management module detects that the resources used by the firewall instance exceed the security threshold and the firewall instance has no retunable service instances, it creates a new firewall instance and sends a service migration instruction to the firewall configuration management module.

[0018] The firewall configuration management module is also used to configure and tune the original firewall instance and the new firewall instance according to the service migration instructions.

[0019] The cloud service protection method based on Operator according to embodiments of the present invention includes:

[0020] Deploy a cloud-native firewall system in a containerized manner within a Kubernetes cluster. The cloud-native firewall system is the cloud-native firewall system described above.

[0021] The embodiments of the present invention are deployed in a cloud-native containerized manner and the firewall service instance is managed by the Kubernetes operator mechanism, which has the advantages of cloud-native automatic deployment, elastic scaling and high reliability.

[0022] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0023] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of the embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings:

[0024] Figure 1 This is a schematic diagram of the composition of a cloud-native firewall system based on Operator in an embodiment of the present invention. Detailed Implementation

[0025] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey the scope of the invention to those skilled in the art. Furthermore, in some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0026] like Figure 1 As shown, the cloud-native firewall system based on Operator in this embodiment of the invention runs in a containerized manner within the same Kubernetes cluster as the customer's cloud-native business (customer cloud business area).

[0027] The cloud-native firewall system includes:

[0028] The management interface (which can be understood as the management subsystem) provides an interface for configuring and managing firewall products, allowing users to interact with the system.

[0029] The management interface includes a configuration management page module and a multi-tenant service management module. The configuration management page module provides users with the ability to enable / disable the firewall and customize its configuration. Users can enable or disable the firewall service through the configuration management page module. Once enabled, users can further configure service information according to their business needs to achieve personalized firewall configuration.

[0030] The multi-tenant service management module is used to generate firewall instance information and firewall configuration information based on the configuration information in the custom configuration.

[0031] The control plane (which can be understood as the control subsystem) runs in Kubernetes operator mode. The control plane includes a firewall instance management module and a firewall configuration management module.

[0032] The firewall instance management module is used to create firewall instances based on the firewall instance information. The firewall configuration management module is used to configure the firewall instance based on the firewall configuration information and generate traffic redirection rules to be sent to the virtual router in the customer's cloud-native service to redirect customer service traffic to the firewall instance, which provides protection for the customer service traffic. The firewall service instance processes the customer service traffic redirected from the virtual router, performs security checks, blocks malicious attack packets, or redirects normal traffic back to the customer service node.

[0033] The data plane (which can be understood as the data subsystem) is used to deploy the firewall instance, which runs in a containerized manner.

[0034] The embodiments of the present invention are deployed in a cloud-native containerized manner and the firewall service instance is managed by the Kubernetes operator mechanism, which has the advantages of cloud-native automatic deployment, elastic scaling and high reliability.

[0035] Based on the above embodiments, further variant embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in each variant embodiment.

[0036] According to some embodiments of the present invention, the configuration management page module also provides the function of processing alarm events reported in real time by the firewall instance. The firewall service instance records attack alarm events and reports them to the configuration management page module, which can process these alarm events. For example, the configuration management page module can process them automatically according to preset processing policies.

[0037] According to some embodiments of the present invention, the management plane further includes a storage module for persistently recording the configuration information and the alarm events.

[0038] According to some embodiments of the present invention, the configuration management page module also provides a query entry point for users to log in and query the data stored in the storage module.

[0039] According to some embodiments of the present invention, the configuration management page module provides users with the ability to enable / disable the firewall and customize its configuration via a web interface. This facilitates user operation.

[0040] According to some embodiments of the present invention, the configuration information includes the IP address, IP network segment, and protocol port to be protected.

[0041] According to some embodiments of the present invention, the firewall instance management module is also used to monitor the running status of the firewall instance and dynamically adjust the resources used by the firewall instance. When a containerized firewall service instance (i.e., a firewall instance) is initially started, only the minimum CPU and memory resources required to start the firewall instance need to be pre-allocated. Kubernetes will dynamically expand resource allocation according to the actual total amount of resources needed during service operation, without manual intervention. Therefore, resources can be used completely on demand.

[0042] According to some embodiments of the present invention, the resources used include CPU, memory, and network bandwidth.

[0043] According to some embodiments of the present invention, when the firewall instance management module detects that the resources used by the firewall instance exceed the security threshold and the firewall instance has no retunable service instances, it creates a new firewall instance and sends a service migration instruction to the firewall configuration management module.

[0044] The firewall configuration management module is also used to configure and tune the original firewall instance and the new firewall instance according to the service migration instructions.

[0045] The firewall instance management module on the control plane can further monitor the running status and resource usage of firewall service instances. When there is an abnormal status or resource usage exceeds the security threshold, the instance management module can perform dynamic tuning actions such as service migration and instance expansion.

[0046] Containerized firewall service instances based on operator scheduling can be shared by multiple tenants to optimize resource utilization. For example, some tenants' services primarily involve high traffic (such as video or upload / download services), requiring high bandwidth resources for protection while having low CPU / memory usage; other tenants' services are complex and variable (such as web services), requiring high CPU and memory DPI functionality for protection while having low bandwidth usage. Rationally allocating services with different resource requirements from multiple tenants to specific firewall service instances can improve resource utilization and reduce costs.

[0047] The Operator-based cloud-native firewall system of this invention is described in detail below with reference to the accompanying drawings and a specific embodiment. It is to be understood that the following description is merely exemplary and should not be construed as a specific limitation of the invention.

[0048] The cloud-native firewall system based on Operator in this invention runs in a containerized manner within the same Kubernetes cluster as the customer's cloud-native business, providing protection for the customer's cloud business.

[0049] like Figure 1 As shown, the cloud-native firewall system based on Operator in this embodiment of the invention is divided into three layers: management plane, control plane, and data plane.

[0050] Management plane: Provides an interface for firewall product configuration management, including a configuration management page module, a multi-tenant service management module, and a storage module. The configuration management page module provides users with the ability to enable, disable, and customize firewall configurations via the web, and offers the function of viewing and handling alarm events. The multi-tenant service management module shields the control plane from the differences in services among multiple tenants, transforming the service requirements of multiple tenants into corresponding firewall configuration rules to achieve the goal of multi-tenant sharing of firewall instances. The storage module persistently records configuration information and log and alarm information reported by the firewall instance.

[0051] Control plane: Running in Kubernetes operator mode, it is responsible for managing firewall instances on the data plane, including the firewall instance management module and the firewall configuration management module. The firewall instance management module is responsible for creating firewall instances, monitoring their running status, and dynamically adjusting their CPU and memory resources. The firewall configuration management module is responsible for distributing the protection configurations issued by the management plane to the firewall instances, generating corresponding traffic redirection rules based on the protection configurations, and distributing these rules to the virtual routers in the customer's cloud business area to redirect customer business traffic to the firewall business instances for protection.

[0052] Data plane: Containerized firewall instances are deployed within the data plane to perform network traffic protection for customer services.

[0053] The usage method of the cloud-native firewall system based on Operator in this embodiment of the invention is as follows:

[0054] S1: Activate and configure the firewall product according to the customer's operation instructions;

[0055] S2: The cloud-native firewall system control plane automatically monitors the running status of firewall instances and dynamically adjusts them;

[0056] S3: Firewall instances provide protection for customer business traffic and report traffic logs and attack alerts in real time.

[0057] In detail, step S1 includes:

[0058] S11: Customers can log in to the cloud-native firewall configuration management page via the web to create a firewall and configure business information such as the IP address, IP network segment, and protocol port to be protected.

[0059] S12: The multi-tenant service management module allocates a firewall instance to the tenant based on the user's input information, generates the corresponding firewall configuration for the tenant, and sends it to the firewall instance management module and firewall configuration management module on the control plane, respectively.

[0060] S13: The firewall instance management module receives instance information from the multi-tenant business management module and, based on the current running status of the firewall instance, calls the Kubernetes native interface to perform operations to create a new firewall instance or expand the existing instance.

[0061] S14: The firewall configuration management module receives the configuration information issued by the multi-tenant service management module and issues it to the corresponding firewall service instances.

[0062] S15: After the configuration is distributed, the multi-tenant business management module will persistently save the configuration information in the storage module.

[0063] Step S2 includes:

[0064] S21: The firewall instance management module on the control plane monitors the usage status of resources such as CPU, memory, and network bandwidth of all running firewall service instances in real time.

[0065] S22: When the firewall instance management module detects uneven resource usage on a service node, such as high CPU / memory usage and low network bandwidth usage, it notifies the firewall configuration management module to dynamically adjust services that use a lot of CPU / memory, such as DPI services, to other service nodes with low CPU / memory usage.

[0066] S23: After receiving the service migration instruction, the firewall configuration management module recalculates the firewall configuration rules and virtual router traffic redirection rules and sends them to the corresponding firewall service instances and virtual routers respectively to complete the configuration tuning.

[0067] S24: When the firewall instance management module discovers that the resource usage on a service node exceeds the security threshold and there is no retunable service instance, it creates a new firewall instance and notifies the firewall configuration management module to migrate some services to this instance.

[0068] S25: The firewall configuration management module performs business migration according to the process in S23.

[0069] Step S3 includes:

[0070] S31: Firewall service instances process customer service traffic redirected from virtual routers, perform security checks, and then block malicious attack packets or redirect normal traffic back to customer service nodes.

[0071] S32: Firewall service instances record traffic logs and report them to the management plane, and persist the records in the storage module.

[0072] S33: Firewall service instances record attack alarm events and report them to the management plane, and persist the records in the storage module.

[0073] S34: The configuration management page of the management plane provides a query entry point. Users can log in to the page to view persistent traffic logs and alarm events.

[0074] The cloud-native firewall system based on Operator in this invention has the following advantages:

[0075] Deployed in a cloud-native containerized manner, the firewall service instance lifecycle is managed using the Kubernetes operator mechanism. It boasts the advantages of cloud-native automatic deployment, elastic scaling, and high reliability.

[0076] When a containerized firewall instance is initially started, it only needs to be pre-allocated with the minimum CPU and memory resources required to start the instance. Kubernetes will dynamically expand resource allocation based on the actual total resources needed during service operation, without manual intervention. This achieves completely on-demand resource usage.

[0077] The firewall instance management module on the control plane can further monitor the running status and resource usage of firewall service instances. When there is an abnormal status or resource usage exceeds the security threshold, the instance management module can perform dynamic tuning actions such as service migration and instance expansion.

[0078] Containerized firewall service instances based on operator scheduling can be shared by multiple tenants to optimize resource utilization. For example, some tenants' services primarily involve high traffic (such as video or upload / download services), requiring high bandwidth resources for protection while having low CPU / memory usage; other tenants' services are complex and variable (such as web services), requiring high CPU and memory DPI functionality for protection while having low bandwidth usage. Rationally allocating services with different resource requirements from multiple tenants to specific firewall service instances can improve resource utilization and reduce costs.

[0079] It should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0080] The cloud service protection method based on Operator according to embodiments of the present invention includes:

[0081] Deploy a cloud-native firewall system in a containerized manner within a Kubernetes cluster. The cloud-native firewall system is the cloud-native firewall system described above.

[0082] It should be noted that any content not described in detail in this specification is common knowledge to those skilled in the art.

[0083] The terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0084] Any reference symbols enclosed in parentheses should not be construed as limiting the claims. The word "a" or "an" preceding an element does not exclude the existence of multiple such elements. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

Claims

1. A cloud-native firewall system based on Operator, characterized in that, The cloud-native firewall system runs in a containerized manner within the same Kubernetes cluster as the customer's cloud-native business. The cloud-native firewall system includes: The management plane provides an interface for configuring and managing firewall products. It includes a configuration management page module and a multi-tenant service management module. The configuration management page module provides users with firewall activation / deactivation and custom configuration options. The multi-tenant service management module generates firewall instance information and firewall configuration information based on the configuration information in the custom configuration. This module shields the control plane from the differences in services among multiple tenants, transforming the service requirements of multiple tenants into corresponding firewall configuration rules to achieve the goal of multi-tenant sharing of firewall instances. The control plane operates in Kubernetes operator mode. It includes a firewall instance management module and a firewall configuration management module. The firewall instance management module creates firewall instances based on the firewall instance information, monitors the running status of the firewall instances, and dynamically adjusts the resources used by the firewall instances. When the resources used by the firewall instance exceed a security threshold and the firewall instance has no retunable service instances, it creates a new firewall instance and sends a service migration command to the firewall configuration management module. The firewall configuration management module configures the firewall instances based on the firewall configuration information and generates traffic redirection rules, which are then sent to the virtual routers in the customer's cloud-native services to redirect customer service traffic to the firewall instances. Based on the service migration command, it configures and retunes the original firewall instances and the new firewall instances. The data plane is used to deploy the firewall instance, which runs in a containerized manner.

2. The cloud-native firewall system as described in claim 1, characterized in that, The configuration management page module also provides the function of processing alarm events reported in real time by the firewall instance.

3. The cloud-native firewall system as described in claim 2, characterized in that, The management plane also includes a storage module, which is used to persistently record the configuration information and the alarm events.

4. The cloud-native firewall system as described in claim 3, characterized in that, The configuration management page module also provides a query portal, allowing users to log in and query the data stored in the storage module.

5. The cloud-native firewall system as described in claim 1, characterized in that, The configuration management page module provides users with firewall enabling / disabling and custom configuration via the web.

6. The cloud-native firewall system as described in claim 1, characterized in that, The configuration information includes the IP address, IP network segment, and protocol port that need to be protected.

7. The cloud-native firewall system as described in claim 1, characterized in that, The resources used include CPU, memory, and network bandwidth.

8. A cloud-based service protection method based on Operator, characterized in that, include: Deploy a cloud-native firewall system in a containerized manner within a Kubernetes cluster, wherein the cloud-native firewall system is the cloud-native firewall system as described in any one of claims 1 to 7.

Images