A network processing method and apparatus, an electronic device, and a storage medium

Abstract

The application discloses a network processing method and device, electronic equipment and storage medium. The network processing method comprises the following steps: configuring a data packet mark for a data packet according to a source position of the data packet; obtaining a first routing rule according to the data packet mark, and transmitting the data packet to a security device according to the first routing rule; obtaining a data packet transmitted by the security device, and updating the data packet mark of the data packet; determining a second routing rule according to the updated data packet mark, and transmitting the data packet to the source position of the data packet according to the second routing rule. The embodiment of the application realizes that the data packet is transmitted to the security device through the data packet mark and is forwarded back to the source position of the data packet, the security device does not need to configure a policy routing to forward the data packet, the security device is convenient for docking the data packet dragged by a cloud resource, and only a static routing needs to be configured for the security device, so that the security device is completely free of threshold when going online, the security device is convenient for directly going online, and immediate service is realized.

Description

A network processing method, apparatus, electronic device, and storage medium Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a network processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Cloud platforms offer convenient, flexible, and software-defined infrastructure resources. Network interaction with cloud resources requires security devices (such as web application firewalls and next-generation general-purpose firewalls) for network protection. Leveraging the inherent characteristics of cloud platforms, security devices can be deployed in a bypass manner using a redirection mode. Users do not need to change the original network topology; network traffic is redirected to the security device for protection and then injected back to the original routing device.

[0003] Currently, most security devices, designed for deployment on cloud platforms, offer basic networking capabilities found in traditional network architectures, such as static routing and NIC-based policy routing. When only one cloud resource (such as a virtual private cloud or cloud host) needs protection, routing rules are only required for that resource to direct traffic to the security device, necessitating simple static routing. However, when multiple cloud resources require protection, routing rules need to be applied to each resource, requiring the security device to incorporate multiple NICs and implement policy routing. This necessitates a large number of NICs and corresponding policy routing configurations for each resource, presenting a significant technical hurdle and operational cost. Furthermore, the rapid lifecycle changes and elastic scaling of cloud resources on cloud platforms complicate maintenance, creating a significant barrier to entry for security devices deployed on cloud platforms. Summary of the Invention

[0004] This invention provides a network processing method, apparatus, electronic device, and storage medium to lower the barrier to entry for using security devices on the cloud and facilitate the use of security devices on the cloud.

[0005] According to one aspect of the present invention, a network processing method is provided, characterized in that it includes:

[0006] Configure packet tags based on the packet's origin location;

[0007] Obtain the first routing rule based on the packet tag, and send the packet to the security device according to the first routing rule;

[0008] Retrieve data packets transmitted by the security device and update the data packet tags;

[0009] The second routing rule is determined based on the updated packet label, and the packet is then transmitted to its source location according to the second routing rule.

[0010] According to another aspect of the present invention, a network processing apparatus is provided, characterized in that it comprises:

[0011] The packet tagging module is used to configure packet tags based on the packet's origin location;

[0012] The data packet sending module is used to obtain the first routing rule based on the data packet tag, and send the data packet to the security device according to the first routing rule;

[0013] The data packet receiving module is used to acquire data packets transmitted by the security device and update the data packet tags.

[0014] A data packet transmission module is used to determine a second routing rule based on the updated data packet tag, and to transmit the data packet to its source location according to the second routing rule. According to another aspect of the present invention, an electronic device is provided, comprising:

[0015] At least one processor;

[0016] and memory that is communicatively connected to at least one processor;

[0017] The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to perform a network processing method according to any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute a network processing method according to any embodiment of the present invention.

[0019] The technical solution of this invention configures a data packet tag based on the data packet's source location, obtains a first routing rule based on the data packet tag, sends the data packet to a security device according to the first routing rule, obtains the data packet transmitted by the security device, updates the data packet tag of the data packet, determines a second routing rule based on the updated data packet tag, and transmits the data packet back to the data packet's source location according to the second routing rule. This enables data packets to be sent to the security device and forwarded back to the data packet's source location based on the data packet tag, eliminating the need to configure policy routing on the security device for forwarding data packets. This facilitates the connection of the security device to data packets driven by cloud resources, lowers the connection threshold for security device deployment, and facilitates the cloudification of security devices.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 is a topology diagram of a network processing method provided according to an embodiment of the present invention;

[0023] Figure 2 is a topology diagram of a network processing method provided according to an embodiment of the present invention;

[0024] Figure 3 is a flowchart of a network processing method according to Embodiment 1 of the present invention;

[0025] Figure 4 is a flowchart of a network processing method according to Embodiment 2 of the present invention;

[0026] Figure 5 is a topology diagram of a network processing method according to Embodiment 3 of the present invention;

[0027] Figure 6 is a flowchart of a network processing method according to Embodiment 3 of the present invention;

[0028] Figure 7 is a schematic diagram of a network processing device according to Embodiment 4 of the present invention;

[0029] Figure 8 is a schematic diagram of the structure of an electronic device that implements the network processing method of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] Figure 1 is a topology diagram of a network processing method provided according to an embodiment of the present invention. As shown in Figure 1, this is a network processing topology diagram in the prior art. The topology diagram includes a cloud host (VM), a virtual private cloud (VPC), a virtual router (VR), and a security device (security instance). The security device is a virtual machine or physical machine with security software installed. The security software may include, but is not limited to, a Web Application Firewall (WAF) or a Next Generation Firewall (NGFW).

[0033] When VR1 and VR2 direct traffic to the WAF, they can establish communication with the WAF using two different network paths. The WAF has two corresponding network cards that communicate with VR1 and VR2 respectively. The WAF needs to be configured with policy routing to allow traffic to be redirected back to VR1 and VR2.

[0034] When only one cloud resource (such as a VPC or cloud host) in the cloud platform needs protection, only a routing policy needs to be configured for this cloud resource to redirect traffic to the security device. Therefore, the security device only needs to be configured with simple static routes. When multiple cloud resources in the cloud platform need protection, routing policies need to be configured for each cloud resource to redirect traffic to the security device. In this case, the security device needs to add multiple network interface cards and configure policy routing.

[0035] Understandably, when a cloud platform has a large number of cloud resources requiring network protection, security devices need to provide a large number of network interface cards (NICs) and configure corresponding policy routing for these NICs. This implementation method has certain technical barriers and operational costs. For hardware devices, it may also require purchasing NICs, which will increase hardware costs to some extent. Furthermore, the rapid changes in the lifecycle and elastic scaling of cloud resources on cloud platforms make maintenance complex and difficult, making the deployment of security devices on the cloud a barrier to entry.

[0036] Figure 2 is a topology diagram of a network processing method according to an embodiment of the present invention. In summary, to address the problems existing in the prior art, this application adds a network processing module based on the prior art. This network processing module establishes network communication with both the VR and the security device, facilitating data transmission between the security device and the VR. The network processing module may include multiple corresponding service data network cards to establish network communication with the VR, and a security engine network card to establish communication with the security device. This allows the complex network configuration and maintenance of the security device (WAF) to be handled by the network processing module in the cloud platform, at which point the security device only needs to be configured with fixed static routing.

[0037] Example 1

[0038] Figure 3 is a flowchart of a network processing method according to Embodiment 1 of the present invention. This embodiment is applicable to situations requiring network security protection of data packets. The method can be executed by a network processing device, which can be implemented in hardware and / or software and can be configured in a network processing module. As shown in Figure 3, the method includes:

[0039] S110. Configure packet tags according to the source location of the packet.

[0040] The source location of a data packet can be understood as the information about the packet's origin, which may include the source address and the routing scenario. For example, the source address may include a Media Access Control (MAC) address and an Internet Protocol (IP) address. The routing scenario may include policy routing based on the source MAC address and policy routing based on the network interface card (NIC). Packet tagging refers to tags used to indicate the source address and other information of the data packet, thereby determining the routing rules. In actual operation, packet tagging can be set based on a pre-defined packet tagging policy, and data packets can be tagged according to the pre-defined policy.

[0041] In this embodiment of the invention, the source location of the data packet can be determined, and the data packet can be labeled according to its source location. In actual operation, basic network information of the data packet can be extracted and used as the source location of the data packet. This basic network information may include MAC address, IP address, touting scenario, etc. A data packet labeling strategy can be preset, and the data packet label can be determined according to the preset strategy.

[0042] In one embodiment, a packet marking strategy may include multiple strategies. The bits for packet marking can be predetermined, and the value of each bit is determined based on the packet marking strategy and the source location of the packet. For example, a 12-bit strategy can be used to mark the packet, where the first bit is reserved; the second bit is used for marking policy routing based on the network interface card (NIC); the third bit is used for marking policy routing based on the source MAC address; the fourth bit indicates whether the packet has been processed by the security engine; and the last eight bits mark the source address. For example, when the routing scenario at the source location is policy routing based on the NIC, the IP address of the packet can be obtained, the location information corresponding to the IP address can be determined in a preset routing table, and the location information and the flag bits corresponding to the policy routing based on the NIC can be filled with the corresponding packet marking value according to the preset packet marking strategy. When the routing scenario at the source location is policy routing based on the source MAC address, the source MAC address of the packet can be obtained, the location information corresponding to the MAC address can be determined in a preset routing table, and the location information and the flag bits corresponding to the policy routing based on the source MAC address can be filled with the corresponding packet marking value according to the preset packet marking strategy.

[0043] S120. Obtain the first routing rule based on the packet tag, and send the packet to the security device according to the first routing rule.

[0044] Here, routing rules refer to routing information from the current address to the destination address. The first routing rule can be a routing rule stored in a preset routing table that matches the packet tag, and it's the routing rule that sends the packet from the network processing module to the security device. The first routing rule can also be routing information from the network processing module's address to the security device's address. Since the routing table can store the security device's address and how packets reach the security device, packets can be forwarded based on matching the corresponding first routing rule according to the packet tag. A security device, also called a security instance or security engine, is a virtual machine or physical machine with security software installed. This security software can include, but is not limited to, Web Application Firewalls (WAFs) and Next Generation Firewalls (NGFWs).

[0045] In this embodiment, the source address and routing scenario of the data packet marker can be obtained to determine the corresponding first routing rule in the preset routing table. In actual operation, a matching mask can be obtained based on the corresponding location information in the data packet marker, the matching marker value can be determined, the routing table can be determined based on the matching marker value, the first routing rule can be determined, and the data packet can be sent to the security device according to the first routing rule. In one embodiment, when the corresponding location information in the data packet marker is 1027 (decimal), which corresponds to 0x403 (hexadecimal), the matching mask can be determined to be 0xf00. The value 0x400 is obtained by ANDing the data packet marker value 0x403 with 0xf00 (matching mask). The corresponding routing table is determined based on the 0x400 value, the first routing rule corresponding to the routing table is determined based on the data packet source address, and the data packet is sent to the security device according to the first routing rule.

[0046] S130. Obtain the data packets transmitted by the security device and update the data packet tags of the data packets.

[0047] In this embodiment, after receiving a data packet, the security device processes it using its security engine. Depending on the actual business scenario, healthy data packets can be returned along their original path. After obtaining the data packet transmitted by the security device, the network processing module can query the data packet marker and set the corresponding marker to indicate that the data packet has been processed by the security engine. In actual operation, after configuring the data packet marker according to its source location, the marker can be saved as a connection record. After obtaining the data packet transmitted by the security device, the marker can be restored in the connection record, and the corresponding marker policy can be queried and updated accordingly. The marker indicating that the data packet has been processed by the security engine can be set to 1 to indicate that the data packet has been processed by the security engine.

[0048] In one embodiment, depending on the actual business scenario, the security device can discard data packets that pose a security threat and return healthy data packets during the data packet processing process.

[0049] S140. Determine the second routing rule based on the updated packet label, and transmit the packet to the source location of the packet according to the second routing rule.

[0050] The second routing rule can be a routing rule that sends data packets from the network processing module to the location where the data packets originated. The second routing rule can be determined based on the updated data packet tags.

[0051] In one embodiment of the invention, the corresponding routing table can be determined based on the updated data packet tag, a second routing rule can be queried, and the data packet can be transmitted to its source location according to the second routing rule. In actual operation, the corresponding data packet tag value can be determined based on the updated data packet tag, the corresponding routing table can be determined based on the data packet tag value, the second routing rule can be queried, and the data packet can be transmitted to its source location according to the second routing rule.

[0052] This invention, through configuring data packet tags based on the data packet's source location, obtaining a first routing rule based on the data packet tags, sending the data packet to a security device according to the first routing rule, obtaining the data packet transmitted by the security device, updating the data packet tags of the data packet, determining a second routing rule based on the updated data packet tags, and transmitting the data packet back to the data packet's source location according to the second routing rule, achieves the transmission of data packets to the security device via data packet tags and forwarding them back to the data packet's source location. This eliminates the need to configure policy routing on the security device for forwarding data packets, facilitating the connection of the security device to data packets driven by cloud resources. It also makes the network deployment and connection of the security device in the cloud platform in a drive-mode manner barrier-free, enabling the security device to be deployed to the cloud and provide immediate service.

[0053] In one embodiment, after configuring packet tags according to the source location of the packet, the method further includes: saving the packet tags as connection records.

[0054] The connection record may include recording the packet tags.

[0055] In the embodiments of the invention, after configuring a data packet tag according to the source location of the data packet, the data packet tag can be saved as a connection record so that the corresponding data packet tag can be obtained and updated after the data packet is processed by the security device.

[0056] Example 2

[0057] Figure 4 is a flowchart of a network processing method according to Embodiment 2 of the present invention. This embodiment is a further optimization and extension of the network processing method based on the above-described embodiments. As shown in Figure 4, the method includes:

[0058] S2010. Extract the basic network information of the data packet, which includes the source address and the tracing scenario.

[0059] Here, basic network information refers to the network information corresponding to the data packet. Basic network information can include the source address and the routing scenario. The source address can include both MAC address and IP address. The routing scenario can include policy routing based on the source MAC address and policy routing based on the network interface card (NIC).

[0060] In the embodiments of the invention, the basic network information of the data packet can be stored in the cloud platform. The basic network information of the data packet can be found in a pre-configured configuration file containing data packet information to determine the source address and the routing scenario of the data packet.

[0061] S2020: Take the source address and the towing scenario as the source location, and find the first data packet marking policy corresponding to the source location in the preset data packet marking policy set.

[0062] The preset packet marking policy set can be a collection of pre-set stored packet marking policies, which may include five packet marking policies. For example, a packet marking policy may include a reserved marking bit, marking whether the marking is based on a network interface card (NIC) policy route, marking whether the marking is based on a source MAC address policy route, marking whether the packet has been processed by a security device, and marking the source address of the packet. The first packet marking policy may refer to a policy that configures the marking of packets based on their source location. In one embodiment, the first packet marking policy may include at least one packet marking policy from the packet marking policy set.

[0063] In this embodiment, the acquired source address and the torrent scenario can be used as the source location, and a first data packet marking strategy corresponding to the source location can be searched in a preset data packet marking strategy set. In actual operation, for different source location information of data packets, multiple marking strategies can be included, and the corresponding first data packet marking strategy can be extracted based on the source location.

[0064] S2030. Generate packet tags for packets according to the first packet tagging strategy.

[0065] In this embodiment, when the routing scenario is a policy-based routing based on the source MAC address, the location information corresponding to the MAC address can be determined in a preset routing table, and the location information and the flag bits corresponding to the policy-based routing based on the source MAC address are filled with the corresponding packet tag values ​​according to the first packet tagging policy. When the routing scenario is a policy-based routing based on the network interface card (NIC), the location information corresponding to the IP address can be determined in a preset routing table, and the location information and the flag bits corresponding to the policy-based routing based on the NIC are filled with the corresponding packet tag values ​​according to the first packet tagging policy.

[0066] S2040. Search the preset routing table for the first routing rule that matches the source address and traction scenario marked on the data packet.

[0067] In this embodiment, a corresponding preset routing table can be determined based on the traction scenario, and a matching first routing rule can be found in the preset routing table based on the source address marked on the data packet. In actual operation, the corresponding preset routing table can be different for different traction matching scenarios. The corresponding preset routing table can be determined according to the traction scenario, and the first routing rule to the destination address of the security device can be determined based on the source address marked on the data packet.

[0068] S2050: Forward the data packet to the security device according to the first routing rule.

[0069] In an embodiment of the invention, once the first routing rule is determined, data packets can be forwarded to the security device according to the first routing rule.

[0070] S2060: Receive data packets from the security device.

[0071] In an embodiment of the invention, after the security device processes the data packet using its security engine, it can return the data packet, and the network processing module can receive the data packet returned by the security device.

[0072] S2070. Determine the connection record corresponding to the data packet and extract the data packet marker stored in the connection record.

[0073] In this embodiment, connection records can be stored in a preset configuration file or configuration table. This information is ultimately stored directly in memory, resulting in fast read / write speeds. Connection records corresponding to data packets can be extracted from the configuration file or configuration table, and the data packet markers stored in these records can be extracted as well. In actual operation, connection records corresponding to data packets can be extracted, and the data packet markers stored in these records can be obtained to facilitate updating the data packet markers.

[0074] S2080: Search for the second data packet marking policy corresponding to the address information of the security device in the preset data packet marking set.

[0075] The second marking strategy can be a marking strategy used to update whether a data packet has been processed by a security device. The corresponding data packet marking bit is set according to the second marking strategy to indicate that it has been processed by the security engine.

[0076] In this embodiment of the invention, when the data packet is sent by a security device, a corresponding second data packet marking strategy can be found from a preset data packet marking set based on the address information of the security device. The second data packet marking strategy may include a strategy for marking whether the data packet has been processed by the security device.

[0077] S2090. Update the packet tag of the data packet according to the second packet tagging strategy.

[0078] In the embodiment of the invention, after determining the second data packet marking policy, the security engine processing flag bit can be obtained according to the second data packet marking policy, and the security engine processing flag bit can be updated to 1 to mark that the data packet has been processed by the security device.

[0079] In one embodiment, updating the packet tag of a data packet according to a second packet tagging policy includes:

[0080] According to the second packet marking policy, packets marked as processed by the security engine are identified as having been processed.

[0081] In the embodiments of the invention, the data packet identifier contains an identifier bit indicating whether it has been processed by the security engine. The identifier indicating that the data packet has been processed by the security engine can be updated to indicate that it has been processed according to the second data packet marking strategy.

[0082] S2100, Determine the routing rule flag bit in the packet tag.

[0083] The routing rule flags are used to determine routing rules. These flags can include those corresponding to the packet's source address. Routing rules can be determined based on these flags.

[0084] In an embodiment of the invention, the tag bit corresponding to the source address of the data packet can be determined as the routing rule tag bit based on the data packet tag, and the routing rule tag bit can be determined to determine the corresponding second routing rule.

[0085] S2110. In the preset routing rule table, find the second routing rule corresponding to the routing rule flag.

[0086] In this embodiment, a corresponding preset routing rule table can be determined based on the routing rule flag, and the second routing rule corresponding to the routing rule flag can be found. In actual operation, a pre-stored preset routing rule table can be retrieved based on the routing rule flag, the preset routing rule table corresponding to the routing rule flag can be determined, and the corresponding second routing rule can be queried in the preset routing rule table according to the routing rule flag.

[0087] S2120. Transmit the data packet to the source location according to the destination address of the second routing rule.

[0088] In this case, the destination address of the second routing rule is the source address in the source location of the data packet transmission.

[0089] In an embodiment of the invention, once the second routing rule is determined, the destination address of the second route can be determined, and the data packet can be transmitted to the source location according to the second routing rule.

[0090] This invention extracts basic network information from data packets, identifies the source address and the towing scenario as the source location, searches for a first data packet marking policy corresponding to the source location in a preset data packet marking policy set, generates a data packet label for the data packet according to the first data packet marking policy, searches for a first routing rule in a preset routing table that matches the source address and towing scenario of the data packet label, forwards the data packet to the security device according to the first routing rule, receives data packets from the security device, determines the connection record corresponding to the data packet, extracts the data packet label stored in the connection record, searches for a second data packet marking policy corresponding to the address information of the security device in the preset data packet label set, updates the data packet label of the data packet according to the second data packet marking policy, determines the routing rule flag bit in the data packet label, searches for the second routing rule corresponding to the routing rule flag bit in the preset routing rule table, and transmits the data packet to the source location according to the destination address of the second routing rule. This achieves the determination of routing rules based on data packet labels to transmit data packets to the target location through routing rules, thereby eliminating the need to configure policy routing for forwarding data packets on the security device. It only requires a simple fixed static IP address and default IP routing for connection, making the security device completely barrier-free, directly accessible to the cloud, and providing immediate service.

[0091] Example 3

[0092] Figure 5 is a topology diagram of a network processing method according to Embodiment 3 of the present invention. As shown in Figure 5, the network processing module includes a security engine network card and at least one service data network card. Figure 5 uses two service data network cards as an example, namely service data network card 1 and service data network card 2, and the security engine network card in the network processing module is security engine network card 2, while the security engine network card in the security device is security engine network card 1.

[0093] In the network processing module, the security engine network interface card (NIC 2) communicates with security devices; the service data NIC communicates with the virtual router, and multiple service data NICs can be used. The service data NIC and the security engine NIC can be determined by the actual business requirements and can be virtual NICs, physical NICs, or software-defined NICs. For example, the security engine NIC and the service data NIC can be created or defined by the cloud platform. The cloud platform can store and manage the IP addresses and MAC addresses of the security engine NIC and the service data NIC. Business traffic is packaged into data packets and sent to the service data NIC; the business traffic can originate from VR.

[0094] The security device may include a security engine network card 1. The security engine network card 1 in the security device and the security engine network card 2 in the network processing module can establish a Layer 2 network and exchange data through static routing.

[0095] In one embodiment, the network address of the security engine network card 2 in the network processing module can be fixed. The network address of the security engine network card 2 in the network processing module and the network address of the security engine network card 1 in the security device can be stored in a configuration file or in data in advance to facilitate communication between the network processing module and the security device.

[0096] Based on the network processing topology diagram in Figure 5, Figure 6 is a flowchart of a network processing method according to Embodiment 3 of the present invention, which can realize data communication between the network processing module and the security device. As shown in Figure 6, the specific method includes the following steps:

[0097] S310. Extract basic network information from data packets.

[0098] In this embodiment, basic network information can be obtained from a preset configuration table. In one embodiment, the preset configuration table stored in the cloud platform may be as shown in Table 1:

[0099] Table 1

[0100] Business data source location number VR MAC address VR IP address Network processing module corresponding network card name Network processing module corresponding network card MAC address Network processing module corresponding network card IP address VR33 MAC address 1 IP address 1 Business data network card 3 MAC address 3 IP address 3 VR44 MAC address 2 IP address 2 Business data network card 4 MAC address 4 IP address 4 surface

[0101] As shown in Table 1, assuming there are two networks, net3 and net4, a Layer 2 network connection is established between VR and the network processing module. The network processing module receives data packets from VR3 through service data interface card 3 and receives data packets from VR4 through service data interface card 4.

[0102] In one embodiment, before the network processing module communicates with the security device, policy routing rules based on source MAC addresses and policy routing rules based on network interface cards (NICs) can be configured. The policy routing based on source MAC addresses may include first creating a configuration chain (which can also be understood as a configuration category or sub-configuration) for this scenario based on the service data NIC device, then setting rules within it to save packet tags to connection records, and finally adding rule redirection to the main pre-routing chain to make the configuration chain of policy routing rules based on source MAC addresses effective. The policy routing rules based on NICs may include first creating a common configuration chain for this scenario, then setting rules within it to save packet tags to connection records, and finally adding rule redirection to the main pre-routing chain to make the configuration chain of policy routing rules based on NICs effective.

[0103] S320. Configure data packet tags based on the basic network information of the data packet.

[0104] A preset packet labeling policy can be established, and packet labels can be configured according to the preset policy. For example, a 12-bit packet label can be used, such as 1111 0000 0000.

[0105] From left to right, the first bit can be reserved and not used for future function expansion; the second bit can mark the towing scenario as a policy routing based on the network card; the third bit can mark the towing scenario as a policy routing based on the source MAC address; the fourth bit indicates whether the data packet has been processed by the security engine, i.e., whether the data packet comes from network card 2 of the security engine; the last eight bits can indicate the location of the data packet's origin, i.e., it can support 0xff (255) locations. The routing table can be set to start counting from 1000, for example, location 1 is 1001, location 2 is 1002. In one embodiment, data packets can be marked using iptables rules. When the data packet is marked as 0x403, the towing scenario corresponding to this value is a policy routing based on the network card and the location number is 3.

[0106] In one embodiment, the configuration of setting packet tags described above is sequential. This step should configure the rules first, i.e., in the header, to give them the highest priority, achieving the goal of setting tags first and then saving packet tags to the connection record last.

[0107] S330. Save the data packet tag as a connection record.

[0108] S340. Match the first routing rule according to the packet tag, and send the packet to the security device according to the first routing rule.

[0109] In one embodiment, policy routing is configured for the security engine network interface card 2 (NIC 2) that communicates with the security device. For example, the policy routing could be `ip rule add fwmark 0x400 / 0xf00 lookup 256`, where 0x400 indicates that the second bit of the packet marker is 1, meaning the packet's routing scenario is NIC-based policy routing, defaulting to routing table 256. Routing table 256 is configured with a static default route pointing to the security device. In the rule, 0x400 is the matching marker value, and 0xf00 is the matching mask. The algorithm for matching the first routing rule can be: packet marker value 0x403 & (AND operation) 0xf00 (matching mask) = 0x400, which equals the matching marker value 0x400, thus matching the first routing rule, and using routing table 256.

[0110] S350: Receives data packets from security devices.

[0111] In one embodiment, after processing the data packet, the security device can discard data packets that pose a security threat and return healthy data packets to their original path, based on the actual business scenario. Therefore, the data packets will be returned to the security engine network card 2 in the security engine module.

[0112] S360. Restore the packet marker in the connection record and update the packet marker.

[0113] After receiving a data packet, the security engine network interface card 2 in the security engine module can recover the data packet tag from the connection record and set the corresponding data packet tag bit to indicate that it has been processed by the security device. For example, it can first recover the data packet tag from the connection record, and then set the fourth bit of the recovered data packet tag to 1 to indicate that the data packet has been processed by the security device.

[0114] S370. Determine the second routing rule based on the updated packet label, and transmit the packet to the source location of the packet according to the second routing rule.

[0115] In this embodiment, the second routing rule is determined in the same way as the first routing rule. The second routing rule can be determined, and data packets can be transmitted to their source location according to the second routing rule.

[0116] In one embodiment, if subsequent traffic demands for cloud resources are increased or decreased, the changes can be made simply by following specific rules, without requiring major modifications. This approach effectively addresses the agile and elastic nature of cloud computing environments. Based on this configuration management method, operations and maintenance become clearer and easier, development becomes more organized, and network management becomes more convenient.

[0117] Example 4

[0118] Figure 7 is a schematic diagram of a network processing device according to Embodiment 4 of the present invention. As shown in Figure 7, the device includes: a data packet marking module 41, a data packet sending module 42, a data packet receiving module 43, and a data packet receiving module 44.

[0119] Among them, the packet marking module 41 is used to configure packet marking on the packet according to the source location of the packet.

[0120] The data packet sending module 42 is used to obtain the first routing rule based on the data packet tag and send the data packet to the security device according to the first routing rule.

[0121] The data packet receiving module 43 is used to acquire data packets transmitted by the security device and update the data packet tags of the data packets.

[0122] The data packet transmission module 44 is used to determine the second routing rule based on the updated data packet label, and to transmit the data packet to the source location of the data packet according to the second routing rule.

[0123] In this embodiment of the invention, a data packet marking module configures data packet markings based on the source location of the data packet. A data packet sending module obtains a first routing rule based on the data packet markings and sends the data packet to the security device according to the first routing rule. A data packet receiving module obtains the data packet transmitted by the security device and updates the data packet markings of the data packet. A data packet transmission module determines a second routing rule based on the updated data packet markings and transmits the data packet to the source location of the data packet according to the second routing rule. This achieves the transmission of data packets to the security device via data packet markings and forwarding them back to the source location of the data packet. There is no need to configure policy routing on the security device to forward data packets. This facilitates the connection of the security device with data packets driven by cloud resources, making the network deployment and connection of the security device in the cloud platform in a drive mode barrier-free, and facilitating the cloud deployment of security devices for immediate service.

[0124] In one embodiment, the packet marking module 41 includes:

[0125] The information extraction unit is used to extract basic network information of data packets, including source address and tracing scenario.

[0126] The tagging policy lookup unit is used to take the source address and the torsion scenario as the source location, and to look up the first data packet tagging policy corresponding to the source location in the preset data packet tagging policy set;

[0127] A packet marking unit is used to generate packet tags for packets according to a first packet marking strategy.

[0128] In one embodiment, the network processing apparatus further includes:

[0129] The tag saving module is used to save data packet tags as connection records.

[0130] In one embodiment, the data packet sending module 42 includes:

[0131] The first routing rule lookup unit is used to look up the first routing rule in the preset routing table that matches the source address and traction scenario marked by the data packet.

[0132] The packet forwarding unit is used to forward packets to the security device according to the first routing rule.

[0133] In one embodiment, the data packet receiving module 43 includes:

[0134] A data packet receiving unit is used to receive data packets fed back by security devices.

[0135] The tag determination unit is used to determine the connection record corresponding to the data packet and extract the data packet tag stored in the connection record;

[0136] The second routing rule lookup unit is used to look up the second data packet marking policy corresponding to the address information of the security device in the preset data packet marking set;

[0137] The tag update unit is used to update the data packet tag according to the second data packet tagging strategy.

[0138] In one embodiment, the tag update unit includes:

[0139] The tagging unit is used to mark packets that have been processed by the security engine as processed, according to the second packet tagging policy.

[0140] In one embodiment, the data packet transmission module 44 includes:

[0141] The label is designated as a determination unit and is used to determine the routing rule label bit in the packet labeling;

[0142] The rule lookup unit is used to look up the second routing rule corresponding to the routing rule flag in the preset routing rule table.

[0143] The data packet transmission unit is used to transmit data packets to the source location according to the destination address of the second routing rule.

[0144] The network processing apparatus provided in the embodiments of the present invention can execute the network processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0145] Example 5

[0146] Figure 8 is a schematic diagram of the structure of an electronic device 10 implementing the network processing method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0147] As shown in Figure 8, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0148] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0149] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a network processing method.

[0150] In some embodiments, a network processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of a network processing method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform a network processing method by any other suitable means (e.g., by means of firmware).

[0151] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0152] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0153] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0154] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0155] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0156] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0157] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0158] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network processing method, characterized in that, include: Configure packet tags based on the packet's origin location; Obtain a first routing rule based on the packet tag, and send the packet to the security device according to the first routing rule; Obtain the data packet transmitted by the security device, and update the data packet tag of the data packet; A second routing rule is determined based on the updated packet tag, and the packet is transmitted to the source location of the packet according to the second routing rule; The step of configuring data packet marking based on the source location of the data packet includes: extracting the MAC address, IP address, touting scenario, and whether it has been processed by the security engine from the network basic information of the data packet; searching for a first data packet marking policy corresponding to the source location in a preset data packet marking policy set; pre-determining the bits of the data packet marking specified in the first data packet marking policy; filling the extracted MAC address, IP address, touting scenario, and whether it has been processed by the security engine into the corresponding bits according to the provisions of the first data packet marking policy; determining the value of each bit to configure the data packet marking for the data packet; wherein, the touting scenario includes policy routing based on the source MAC address and policy routing based on the network interface card; the source location refers to the MAC address, the IP address, and the touting scenario.

2. The method according to claim 1, characterized in that, After configuring the data packet with a data packet tag according to the source location of the data packet, the method further includes: saving the data packet tag as a connection record.

3. The method according to claim 1, characterized in that, The step of obtaining a first routing rule based on a data packet tag and sending the data packet to a security device according to the first routing rule includes: searching in a preset routing table for a first routing rule that matches the source address and traction scenario of the data packet tag; and forwarding the data packet to the security device according to the first routing rule.

4. The method according to claim 1, characterized in that, The step of acquiring the data packet transmitted by the security device and updating the data packet tag includes: receiving the data packet fed back by the security device; determining the connection record corresponding to the data packet and extracting the data packet tag stored in the connection record; searching for a second data packet tagging strategy corresponding to the address information of the security device in a preset data packet tagging set; and updating the data packet tag of the data packet according to the second data packet tagging strategy.

5. The method according to claim 4, characterized in that, Updating the packet label according to the second packet labeling policy includes: marking the packet label as processed by the security engine according to the second packet labeling policy.

6. The method according to claim 1, characterized in that, The step of determining the second routing rule based on the updated data packet tag and transmitting the data packet to the source location of the data packet according to the second routing rule includes: determining a routing rule tag bit on the data packet tag; searching for the second routing rule corresponding to the routing rule tag bit in a preset routing rule table; and transmitting the data packet to the source location according to the destination address of the second routing rule.

7. A network processing device, characterized in that, include: A packet tagging module is used to configure packet tags for the packets according to their source location; The data packet sending module is used to obtain a first routing rule based on the data packet tag, and send the data packet to the security device according to the first routing rule; A data packet receiving module is used to acquire the data packet transmitted by the security device and update the data packet tag of the data packet; A data packet transmission module is used to determine a second routing rule based on the updated data packet tag, and to transmit the data packet to the source location of the data packet according to the second routing rule; The data packet marking module includes: an information extraction unit, used to extract the MAC address, IP address, touting scenario, and whether it has been processed by the security engine from the network basic information of the data packet; a marking policy lookup unit, used to look up the first data packet marking policy corresponding to the source location in a preset data packet marking policy set; and a data packet marking unit, used to pre-determine the bits of the data packet marking specified in the first data packet marking policy, fill the extracted MAC address, IP address, touting scenario, and whether it has been processed by the security engine into the corresponding bits according to the provisions of the first data packet marking policy, and determine the value of each bit to configure the data packet marking for the data packet; wherein, the touting scenario includes policy routing based on the source MAC address and policy routing based on the network card; and the source location refers to the MAC address, IP address, and touting scenario.

8. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network processing method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network processing method according to any one of claims 1-6.

Images