Control method and device of network security equipment, storage medium and electronic equipment

Abstract

The application discloses a network security device control method and device, a storage medium and an electronic device. The method comprises the following steps: sending a first target heartbeat message sent by a plurality of processes and a kernel thread of a second device to a target interface of a first device, and receiving a second target heartbeat message sent by a plurality of processes and a kernel thread of the second device; obtaining a target switching strategy and target notification information through the second device, and determining a target control strategy of the running state of the first device and the running state of the second device according to the target switching strategy, the target notification information and the received first target heartbeat message; and controlling the running state of the first device and the running state of the second device according to the target control strategy. The application solves the technical problem of low switching accuracy in the prior art that controls the switching of a master device and a standby device by realizing the inter-device interaction negotiation in the control layer or the forwarding layer process of the network security device.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and more specifically, to a control method, apparatus, storage medium, and electronic device for network security equipment. Background Technology

[0002] Security devices such as firewalls are deployed at the network boundary to control network traffic. If a device fails, network communication will be interrupted. Therefore, high availability (HA) requirements are usually considered, using two or more devices to form an HA group. When one device fails, the remaining devices can take over the traffic of the failed device, ensuring uninterrupted data communication and enhancing network reliability.

[0003] The implementation of HA architecture mainly relies on the interaction and negotiation between devices. For example, two devices can negotiate to establish a master device through the sending and receiving of HA heartbeat messages. This master device is responsible for taking over the traffic, while the other device acts as a backup device, serving as a backup for the master device. When the original master device fails, the backup device will switch to become the new master device to take over the traffic.

[0004] Security devices are divided into a control plane (CP) and a data plane (DP) in terms of implementation architecture. The former is mainly responsible for network management and control, while the latter is mainly responsible for data traffic processing. Currently, the implementation of HA architecture solutions in existing technologies is often placed in the CP or DP. The former performs HA interaction negotiation within the CP process, that is, the HA function is implemented in the CP process, and the HA heartbeat message is sent and received and negotiated through the kernel driver interface. This solution has the following problems: (1) It is necessary to consider the issue of exclusive cores. Since most of the system cores are allocated to the DP, and most interfaces are driven by the DP, the limitation of not using the DP's resources for HA negotiation is large; (2) HA negotiation and switching depend solely on the HA heartbeat messages sent and received by the CP process, and timely and accurate switching cannot be achieved; (3) When a certain logic in the CP where the HA function is located gets stuck, for example, when it gets stuck while interacting with other processes, or when it has a problem receiving packets, it may cause the HA heartbeat to be lost. The latter involves HA negotiation within the DP process, meaning the HA functionality is implemented within the DP process. This allows the reception and transmission of HA heartbeat messages to be directly handled using the DP's interface packet sending and receiving APIs, such as... Figure 1As shown, the physical interface is driven by DPDK, and the sending and receiving of data packets is handled by the DP process. The CP process does not send HA heartbeat messages. When the CP detects a fault, it needs to notify the Ctrl dp process to renegotiate the HA status. This scheme has the following problems: (1) Since the DP process runs the main data forwarding service of the security device, once the DP itself has a problem, such as a certain logic block, the HA heartbeat cannot be sent and received in time. For example, if the DP has a problem receiving packets, it will also think that the other end has not sent a heartbeat, and the judgment is inaccurate; (2) The HA link interfaces are all driven by DP. Once the data plane is overloaded or the DP fails, the HA heartbeat message cannot be processed in time, which may lead to the problem of split brain between the two masters; (3) HA negotiation and switching depend solely on the HA heartbeat messages sent and received by the DP, and cannot achieve timely and accurate switching; (4) The HA processing logic in the DP may affect the processing of the main data flow.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This invention provides a control method, apparatus, storage medium, and electronic device for network security devices, to at least solve the technical problem of low switching accuracy in the prior art, which uses the method of inter-device interaction negotiation in the control layer or forwarding layer process of network security devices to control the switching between master and backup devices.

[0007] According to one aspect of the present invention, a control method for a network security device is provided, comprising: sending a first target heartbeat message issued by multiple processes and a kernel thread to a second device through a target interface of a first device, and receiving a second target heartbeat message issued by multiple processes and a kernel thread of the second device, wherein the first device is in a primary operating state, the second device is in a standby operating state, the target interface includes a kernel interface and a DP interface, and the multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process; acquiring a target switching policy and target notification information through the second device, and determining a target control policy for the operating states of the first device and the second device based on the target switching policy, the target notification information, and the received first target heartbeat message; and controlling the operating states of the first device and the second device according to the target control policy.

[0008] Furthermore, the first target heartbeat message issued by multiple processes and a kernel thread is sent to the second device through the target interface of the first device, including: sending the first target heartbeat message issued by the HA process of the first device to the HA process of the second device through the kernel interface of the first device; sending the first target heartbeat message issued by the control layer process of the first device to the HA process of the second device through the kernel interface of the first device; sending the first target heartbeat message issued by the forwarding layer process of the first device to the HA process of the second device through the DP interface of the first device; and sending the first target heartbeat message issued by the kernel thread of the first device to the HA process of the second device through the kernel interface of the first device.

[0009] Furthermore, the target switching strategy includes a target switching mode, which is either a first switching mode or a second switching mode. The first switching threshold corresponding to the first switching mode is less than the second switching threshold corresponding to the second switching mode. The target notification information includes TIPC heartbeat messages sent by multiple target processes of the second device. Based on the target switching strategy, the target notification information, and the received first target heartbeat message, a target control strategy for the operating status of the first device and the second device is determined. This includes: determining whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message; if the HA process and kernel thread of the first device are running normally, then determining the evaluation data corresponding to the second device through the HA process of the second device based on the received first target heartbeat message and target notification information, wherein the evaluation data is used to characterize the overall operating performance of the second device; when the target switching mode is the first switching mode, comparing the evaluation data corresponding to the second device with the first switching threshold to obtain a first comparison result, and determining the target control strategy based on the first comparison result; when the target switching mode is the second switching mode, comparing the evaluation data corresponding to the second device with the second switching threshold to obtain a second comparison result, and determining the target control strategy based on the second comparison result.

[0010] Furthermore, the HA process of the second device determines the evaluation data corresponding to the second device based on the received first target heartbeat message and target notification information, including: determining the evaluation data corresponding to each target process of the second device based on the received first target heartbeat message and target notification information; and performing a weighted summation calculation based on the evaluation data corresponding to each target process of the second device to obtain the evaluation data corresponding to the second device.

[0011] Further, determining the target control strategy based on the first comparison result includes: if the first comparison result indicates that the evaluation data corresponding to the second device is greater than the first switching threshold, then the target control strategy is to switch the operating state of the first device from the main operating state to the standby operating state, and switch the operating state of the second device from the standby operating state to the main operating state; if the first comparison result indicates that the evaluation data corresponding to the second device is less than or equal to the first switching threshold, then the target control strategy is to not perform a state switch.

[0012] Furthermore, the target switching strategy includes target judgment rules. After determining whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message, the method further includes: if the HA process and kernel thread of the first device are not running normally, then according to the target judgment rules, the target control strategy is to switch the running state of the first device from the primary running state to the standby running state, and switch the running state of the second device from the standby running state to the primary running state.

[0013] Furthermore, the method also includes: broadcasting the current operating status of the first device to multiple target processes of the first device through the HA process of the first device according to a first preset time interval; and broadcasting the current operating status of the second device to multiple target processes of the second device through the HA process of the second device according to a second preset time interval.

[0014] According to another aspect of the present invention, a control device for a network security device is also provided, comprising: a transmission module, configured to send a first target heartbeat message issued by multiple processes and a kernel thread to a second device through a target interface of a first device, and to receive a second target heartbeat message issued by multiple processes and a kernel thread of the second device, wherein the first device is in a primary operating state and the second device is in a standby operating state, the target interface includes a kernel interface and a DP interface, and the multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process; a determination module, configured to obtain a target switching policy and target notification information through the second device, and determine a target control policy for the operating states of the first device and the second device based on the target switching policy, the target notification information, and the received first target heartbeat message; and a control module, configured to control the operating states of the first device and the second device according to the target control policy.

[0015] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, wherein the computer program is configured to execute the control method of the network security device described above when it is run.

[0016] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the control method of the network security device described above when running.

[0017] In this embodiment of the invention, the HA function module is treated as a separate process, and the control link interface for transmitting HA heartbeat messages combines a kernel interface and a DP driver interface. First, a first target heartbeat message from multiple processes and a kernel thread is sent to a second device via the target interface of the first device. Second target heartbeat messages from multiple processes and a kernel thread of the second device are received. Then, the target switching policy and target notification information are obtained through the second device. Based on the target switching policy, target notification information, and the received first target heartbeat messages, a target control policy for the operating states of the first and second devices is determined. Finally, the operating states of the first and second devices are controlled according to the target control policy. The first device is in a primary operating state, and the second device is in a standby operating state. The target interface includes a kernel interface and a DP interface, and the multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process.

[0018] In the above process, the HA function module is an independent HA process, which effectively improves the stability of the HA function module in the security device. The control link interface for transmitting HA heartbeat messages adopts a combination of kernel direct output interface and DP driver interface. A thread is established in the kernel to send HA heartbeats. All CP processes and DP processes send HA heartbeats. The CP process sends through the kernel direct output interface, and the DP process sends through the DP driver interface, realizing four levels of HA heartbeats. This fully reflects the operating status of the system kernel, CP, and DP layers, improves the stability of HA heartbeat transmission and reception, effectively avoids the occurrence of HA dual-master split-brain situation, and can determine whether the HA peer device function module is operating normally through HA heartbeat information, providing a basis for HA switching. Through TIPC notification information and the enhanced HA heartbeat mechanism, the local device and peer device are systematically and comprehensively learned, which improves the real-time performance and accuracy of HA switching.

[0019] Therefore, the technical solution of this invention effectively avoids the occurrence of a dual-master split-brain situation in HA, thereby improving the real-time performance and accuracy of HA switching. It also solves the technical problem of low switching accuracy in the prior art, which uses the method of inter-device interaction and negotiation in the control layer or forwarding layer process of network security equipment to control the switching of master and backup devices. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0021] Figure 1 This is a schematic diagram of the architecture for HA negotiation within the data plane (DP) in related technologies;

[0022] Figure 2 This is a flowchart of an optional control method for a network security device according to an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the architecture of an optional enhanced HA scheme according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of an optional HA link architecture that uses the DP driver interface and the kernel driver interface in parallel, according to an embodiment of the present invention.

[0025] Figure 5 This is a schematic diagram of an optional egress gateway firewall HA deployment according to an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of a control device for an optional network security device according to an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this invention are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or organization. Before obtaining relevant information, it needs to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0030] Example 1

[0031] According to an embodiment of the present invention, an embodiment of a control method for a network security device is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] Figure 2 This is a flowchart of an optional control method for a network security device according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0033] Step S201: Send a first target heartbeat message from multiple processes and a kernel thread to the second device through the target interface of the first device, and receive a second target heartbeat message from multiple processes and a kernel thread of the second device. The first device is in the primary running state, and the second device is in the standby running state. The target interface includes the kernel interface and the DP interface. The multiple processes include the high availability (HA) process, the control layer process, and the forwarding layer process.

[0034] In the above steps, heartbeat messages can be sent and received through application systems, processors, electronic devices, etc. Optionally, the first device is the negotiated HA master device, and the second device is the negotiated HA standby device. Optionally, the first target heartbeat message, i.e., the HA heartbeat message sent by the HA process, the HA heartbeat message sent by the control layer (CP) process, the HA heartbeat message sent by the data forwarding layer (DP) process, and the HA heartbeat message sent by the kernel thread, is sent to the HA standby device through the kernel interface and DP interface of the HA standby device. Optionally, the second target heartbeat message, i.e., the HA heartbeat message sent by the HA process, the HA heartbeat message sent by the control layer (CP) process, the HA heartbeat message sent by the data forwarding layer (DP) process, and the HA heartbeat message sent by the kernel thread, is sent to the HA master device through the kernel interface and DP interface of the HA standby device.

[0035] Optionally, in this embodiment of the invention, the HA function module is separated into a single HA process, and all processes within the HA process run in a non-blocking manner. Memory within the process is pre-allocated, and the process does not explicitly call "malloc" during execution to ensure stable operation. The HA process does not run complex logic; it only sends its own HA heartbeat, receives HA heartbeats from various process modules of the peer HA device, and receives TIPC heartbeat messages from various process modules of the local device. These messages are then aggregated and used as the basis for HA state switching, enabling corresponding HA switching to be performed when conditions are met according to the configured HA switching mode.

[0036] Step S202: Obtain the target switching strategy and target notification information through the second device, and determine the target control strategy for the operating status of the first device and the operating status of the second device based on the target switching strategy, target notification information and the received first target heartbeat message.

[0037] Optionally, the target switchover strategy includes switchover priority rules and switchover modes. For example, the kernel heartbeat and the HA process heartbeat have the highest priority; their abnormalities indicate an anomaly in the entire system. When the HA standby device detects that its local system is normal and the peer system (i.e., the HA master device) is abnormal, it can directly switch to the master state. For example, the switchover modes are divided into active mode and deferred mode. Optionally, the target notification information is the TIPC heartbeat message sent by each process module of the local device. For example, the CP process module (daemon 1, daemon 2, ..., daemon N) and DP process module (Ctrl dp, Data dp 1, ..., Data dp N) of the HA standby device (or HA master device) periodically send TIPC heartbeat messages to the local HA process. Optionally, the target control strategy is to perform HA switchover or not perform switchover.

[0038] Optionally, priority rules, configured HA switching modes, and TIPC heartbeat messages are obtained through the HA standby device. These are then combined with HA heartbeat messages sent by the HA process of the HA master device, the HA heartbeat messages sent by the control layer (CP) process, the HA heartbeat messages sent by the data forwarding layer (DP) process, and the HA heartbeat messages sent by the kernel thread. The summaries are used as the basis for determining whether to perform HA state switching, thereby determining whether the target control policy should switch or not.

[0039] Step S203: Control the operating status of the first device and the second device according to the target control strategy.

[0040] Optionally, after determining the target control strategy, the operating status of the HA master equipment and the HA standby equipment can be controlled according to the target control strategy.

[0041] Figure 3 This is a schematic diagram of an optional enhanced HA scheme according to an embodiment of the present invention. Optionally, the present invention provides an optimized scheme for implementing HA functionality on a security device, such as... Figure 3 As shown, the HA function module is an independent HA process (HA daemon). The link interface for sending HA heartbeat messages adopts a combination of DP driver and kernel driver direct output. That is, HA daemon, daemon 1, daemon 2, ..., daemon N, and kernel thread send HA heartbeat messages through the kernel interface (Kernel direct send interface), while Ctrl dp, Data dp 1, ..., Data dp N send HA heartbeat messages through the DP interface (DP-driver interface). Figure 3 As shown, each module process sends an HA heartbeat message to the peer HA process, enabling the HA process to determine the operating status of the local device and the peer device by combining the status of each module process notified by the local TIPC, and to perform HA switching in a specific mode.

[0042] Based on the scheme defined in steps S201 to S203 above, it can be understood that in this embodiment of the invention, the HA function module is treated as a separate process, and the control link interface for transmitting HA heartbeat messages is a combination of the kernel interface and the DP driver interface. First, the first device sends a first target heartbeat message from multiple processes and a kernel thread to the second device through the target interface of the first device, and receives a second target heartbeat message from multiple processes and a kernel thread of the second device. Then, the second device obtains the target switching policy and target notification information, and determines the target control policy for the operating states of the first and second devices based on the target switching policy, target notification information, and the received first target heartbeat message. Finally, the operating states of the first and second devices are controlled according to the target control policy. The first device is in a primary operating state, and the second device is in a standby operating state. The target interface includes the kernel interface and the DP interface, and the multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process.

[0043] It is noteworthy that, in the above process, the HA function module is an independent HA process, which effectively improves the stability of the HA function module in the security device. The control link interface for transmitting HA heartbeat messages adopts a combination of kernel direct output interface and DP driver interface. A thread is established in the kernel to send HA heartbeats. All CP processes and DP processes send HA heartbeats. The CP process sends through the kernel direct output interface, and the DP process sends through the DP driver interface, realizing four levels of HA heartbeats. This fully reflects the operating status of the system kernel, CP, and DP layers, improves the stability of HA heartbeat transmission and reception, effectively avoids the occurrence of HA dual-master split-brain situation, and can determine whether the HA peer device function module is operating normally through HA heartbeat information, providing a basis for HA switching. Through TIPC notification information and the enhanced HA heartbeat mechanism, the local device and peer device are systematically and comprehensively learned, which improves the real-time performance and accuracy of HA switching.

[0044] Therefore, the technical solution of this invention effectively avoids the occurrence of a dual-master split-brain situation in HA, thereby improving the real-time performance and accuracy of HA switching. It also solves the technical problem of low switching accuracy in the prior art, which uses the method of inter-device interaction and negotiation in the control layer or forwarding layer process of network security equipment to control the switching of master and backup devices.

[0045] In one optional embodiment, sending a first target heartbeat message issued by multiple processes and a kernel thread to a second device through the target interface of the first device includes: sending a first target heartbeat message issued by the HA process of the first device to the HA process of the second device through the kernel interface of the first device; sending a first target heartbeat message issued by the control layer process of the first device to the HA process of the second device through the kernel interface of the first device; sending a first target heartbeat message issued by the forwarding layer process of the first device to the HA process of the second device through the DP interface of the first device; and sending a first target heartbeat message issued by the kernel thread of the first device to the HA process of the second device through the kernel interface of the first device.

[0046] Optionally, during the process of sending HA heartbeat messages to the HA standby device through the kernel interface and DP interface of the HA master device, the HA heartbeat messages issued by the HA process of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device; the HA heartbeat messages issued by the control layer process of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device; the HA heartbeat messages issued by the forwarding layer process of the HA master device are sent to the HA process of the HA standby device through the DP interface of the HA master device; and the HA heartbeat messages issued by the kernel thread of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device.

[0047] Figure 4 This is a schematic diagram of an optional HA link architecture that uses the DP driver interface and the kernel driver interface in parallel, according to an embodiment of the present invention. Figure 4 As shown, in this embodiment of the invention, the HA control link interface adopts a combination of DP driver interface (DPDKinterface driver) and kernel driver interface (Kernel direct). The kernel thread and all CP processes, including the HA process (HA daemon), use the kernel driver interface to send and receive HA heartbeats. The DP processes (Ctrl dp, Data dp 1, ..., Data dp N) use their own driver interface to send and receive HA heartbeats.

[0048] It's important to note that if HA heartbeat messages are sent and received solely using the DP-driven interface, they are easily affected by the business message processing flow. For security devices, the number and complexity of messages processed by the kernel are much simpler than those processed by the data plane. Therefore, using a dedicated kernel-driven interface for HA heartbeat message sending and receiving ensures the stability of the HA heartbeat. Furthermore, since the simultaneous sending and receiving of HA heartbeats by both the kernel and DP-driven interfaces is virtually impossible, using a combination of DP-driven and kernel-driven interfaces for the HA control link interface effectively avoids serious problems such as split-brain issues.

[0049] In one optional embodiment, each process module of the security device periodically sends HA heartbeats to the HA process of the peer device. Simultaneously, a dedicated kernel thread is created in the kernel to send HA heartbeats. The sent HA heartbeats contain information about which module they originate from and whether that module is faulty. This mechanism effectively improves the stability of HA heartbeats, allowing the HA process to determine whether the peer device's process modules are running normally. If a process fails to receive HA heartbeats from another process multiple times consecutively, or if the received messages report a fault, then that process module on the peer device is determined to be abnormal.

[0050] In one optional embodiment, each process module of the local device periodically sends TIPC heartbeat messages to the local HA process. If the HA process fails to receive a TIPC heartbeat from a local process module multiple times consecutively, it determines that the local device's process module is malfunctioning. By combining the HA heartbeat and the TIPC heartbeat, the HA process can determine whether each process module of the local device and the peer device is operating normally, providing a basis for automatic HA master-slave failover and improving the real-time performance and accuracy of HA failover.

[0051] In one optional embodiment, the target switching strategy includes a target switching mode, which is either a first switching mode or a second switching mode. The first switching mode corresponds to a first switching threshold that is less than the second switching mode's second switching threshold. The target notification information includes TIPC heartbeat messages sent by multiple target processes of the second device. The target control strategy for the operating status of the first device and the second device is determined based on the target switching strategy, the target notification information, and the received first target heartbeat message. This includes: determining whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message; if the HA process of the first device... If the process and the kernel thread of the first device are running normally, the HA process of the second device determines the evaluation data corresponding to the second device based on the received first target heartbeat message and target notification information. The evaluation data is used to characterize the overall operating performance of the second device. When the target switching mode is the first switching mode, the evaluation data corresponding to the second device is compared with the first switching threshold to obtain the first comparison result, and the target control strategy is determined based on the first comparison result. When the target switching mode is the second switching mode, the evaluation data corresponding to the second device is compared with the second switching threshold to obtain the second comparison result, and the target control strategy is determined based on the second comparison result.

[0052] Optionally, the first switching mode can be an aggressive preemptive mode, and the second switching mode can be a deferred preemptive mode. Multiple target processes refer to CP processes (e.g., daemon 1, daemon 2, ..., daemon N) and DP processes (e.g., Ctrldp, Data dp 1, ..., Data dp N).

[0053] Optionally, in the process of determining the target control strategy for the operating status of the first device and the second device based on the target switching strategy, target notification information and the received first target heartbeat message, it can be determined whether the HA process and kernel thread of the HA master device are running normally based on the received HA heartbeat message.

[0054] In one optional embodiment, the target switching strategy includes target judgment rules, wherein, after determining whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message, if the HA process and kernel thread of the first device are not running normally, the target control strategy is determined according to the target judgment rules to switch the running state of the first device from the primary running state to the standby running state, and switch the running state of the second device from the standby running state to the primary running state.

[0055] Optionally, the target judgment rule can be to directly switch the HA state when the local system is detected to be normal while the heartbeats of the remote kernel and HAdaemon are abnormal. For example, if the HA process and kernel thread of the HA master device are not running normally, the target control strategy can be determined to switch according to the target judgment rule, that is, to switch the running state of the HA master device from the primary running state to the standby running state, and to switch the running state of the HA standby device from the standby running state to the primary running state.

[0056] Optionally, if the HA process and kernel thread of the HA master device are running normally, the HA process of the HA standby device can determine the evaluation data corresponding to the HA standby device based on the received HA heartbeat message and TIPC heartbeat message.

[0057] In one optional embodiment, the evaluation data corresponding to the second device is determined by the HA process of the second device based on the received first target heartbeat message and target notification information. This includes: determining the evaluation data corresponding to each target process of the second device based on the received first target heartbeat message and target notification information; and performing a weighted summation calculation based on the evaluation data corresponding to each target process of the second device to obtain the evaluation data corresponding to the second device.

[0058] Optionally, during the process of determining the evaluation data corresponding to the HA standby device based on the received HA heartbeat messages and TIPC heartbeat messages by the HA process of the HA standby device, the evaluation data corresponding to each target process can be determined by the received HA heartbeat messages and TIPC heartbeat messages. For example, the evaluation scores corresponding to CP processes daemon 1, daemon2, ..., daemon N and DP processes Ctrl dp, Data dp 1, ..., Data dp N are respectively.

[0059] Optionally, the evaluation data corresponding to the HA backup device can be obtained by weighted summation of the evaluation data corresponding to each target process of the HA backup device. For example, the evaluation scores corresponding to daemon 1, daemon 2, ..., daemon N, Ctrl dp, Datadp 1, ..., Data dp N can be weighted and summed to obtain the evaluation score corresponding to the HA backup device.

[0060] Optionally, when the target switching mode is the active preemption mode, the evaluation data corresponding to the HA standby device is compared with the first switching threshold to obtain the first comparison result, and the target control strategy is determined based on the first comparison result.

[0061] In one optional embodiment, determining the target control strategy based on the first comparison result includes: if the first comparison result indicates that the evaluation data corresponding to the second device is greater than the first switching threshold, then the target control strategy is to switch the operating state of the first device from the main operating state to the standby operating state, and switch the operating state of the second device from the standby operating state to the main operating state; if the first comparison result indicates that the evaluation data corresponding to the second device is less than or equal to the first switching threshold, then the target control strategy is to not perform a state switch.

[0062] Optionally, if the first comparison result indicates that the evaluation data corresponding to the HA standby device is greater than the first switching threshold, and the overall operating performance of the HA standby device is considered to be good, then the target control strategy is to switch the operating state of the HA master device from the master operating state to the standby operating state, and switch the operating state of the HA standby device from the standby operating state to the master operating state, that is, to perform a switch (HA standby device preempts master) as the target control strategy, and the HA standby device notifies the peer master device to switch to standby, and the local end switches to master; if the first comparison result indicates that the evaluation data corresponding to the HA standby device is less than or equal to the first switching threshold, then the target control strategy is to not perform a state switch.

[0063] Optionally, when the target switching mode is a hysteresis preemption mode, the evaluation data corresponding to the HA backup device and the second switching threshold are compared to obtain a second comparison result, and the target control strategy is determined based on the second comparison result. The specific implementation of determining the target control strategy based on the second comparison result is the same as that based on the first comparison result, and will not be elaborated here.

[0064] Optionally, in this embodiment of the invention, four levels of HA heartbeats are proposed: 1) Kernel HA heartbeat: if the local HA process receives this heartbeat, it indicates that the peer system (OS) is alive; 2) HA daemon heartbeat: if the local HA process receives this heartbeat, it indicates that the CP control plane is working; 3) DP heartbeat: if the local HA process receives this heartbeat, it indicates that the peer's DP data forwarding plane is normal; 4) Heartbeat of specific CP daemon modules: to measure whether specific CP process modules on the peer are working properly. Making HA switching decisions based on the functional definitions of different levels has higher accuracy and greater practicality.

[0065] Optionally, in this embodiment of the invention, the heartbeat of the Kernel and the heartbeat of the HA daemon have the highest priority. When they are abnormal, it means that there is a problem with the entire system. At this time, when the standby device detects that the local system is normal, it directly switches to the master state.

[0066] Optionally, for HA heartbeats of other CP and DP processes, if the monitoring results of a certain group of process modules show that the local device is normal for that process module while the peer device is abnormal, then the local device receives a "bonus" for the operation of that process module; if the local device is abnormal while the peer device is normal, then it receives a "minus"; if both ends are normal or abnormal, then no points are awarded. In this way, multiple groups of process modules can be weighted and summed to obtain a HA process group score, "ha_group_score", calculated as follows:

[0067]

[0068] Where i is the module process index, N represents the other N CP and DP process modules, and W i The weights corresponding to the modules measure their importance. Network-related CP and DP processes have higher weights than ordinary CP processes. ha_local_is_normal(i) is used to determine whether the process module is normal on the local device, returning 1 if normal and 0 if abnormal; ha_peer_is_normal(i) is used to determine whether the process module is normal on the HA peer device, returning 1 if normal and 0 if abnormal.

[0069] Optionally, on the HA standby device, a score can be calculated using the above formula. If this score is greater than 0, it indicates that the overall operating status of the HA standby device is better than that of the HA master device. When this score reaches a threshold greater than 0, the HA standby device can preemptively become the master device. Optionally, this invention defines two thresholds: threshold-low and threshold-high, and further defines two preemption modes: positive preemption and lazy preemption. Optionally, the mode that preempts when the score is higher than threshold-low is called positive preemption; the mode that preempts when the score is higher than threshold-high is called lazy preemption. Of the two switching modes, positive preemption has a lower threshold, higher switching accuracy, and is more sensitive, allowing the device with better operating status to take over traffic as early as possible. Lazy preemption has a higher threshold, which can avoid frequent preemption switching between HA master and standby devices, resulting in a more stable HA environment. Optionally, these two preemption modes can be selected according to the actual scenario requirements.

[0070] Optionally, when an HA standby device preempts to become the HA master, it needs to first notify the peer master device to switch to standby, and then the local device switches to master, avoiding the problem of instantaneous dual-master operation. Optionally, the weight W of each module... iThreshold-low and threshold-high can be configured based on empirical or design values ​​to meet various needs, and are not limited here.

[0071] It should be noted that in this embodiment of the invention, a four-level HA heartbeat is implemented, which fully reflects the operating status of the system kernel, CP, and DP layers, improves the stability of HA heartbeat transmission and reception, effectively avoids the occurrence of HA dual-master split-brain situation, and can determine whether the functional modules of the HA peer device are operating normally through HA heartbeat information, providing a basis for HA switching; through TIPC notification information and the enhanced HA heartbeat mechanism, the local device and peer device are systematically and comprehensively learned, improving the real-time performance and accuracy of HA switching.

[0072] In one optional embodiment, the current operating status of the first device is broadcast to multiple target processes of the first device through the HA process of the first device according to a first preset time interval; and the current operating status of the second device is broadcast to multiple target processes of the second device through the HA process of the second device according to a second preset time interval.

[0073] Optionally, in this embodiment of the invention, the HA process of this device periodically broadcasts to all service process modules of this device whether the HA status of this device is primary or backup. The first preset time interval can be the broadcast interval corresponding to the HA primary device, and the second preset time interval can be the broadcast interval corresponding to the HA backup device. The two can be the same or different, and are not limited here.

[0074] It should be noted that in this embodiment of the invention, the HA status is broadcast periodically. The HA status of the device needs to be notified to all process modules on the device. Since the process in the HA process runs in a non-blocking manner, it cannot wait for the destination process to reply to the notification message. Therefore, this invention proposes a scheme for the HA process to broadcast the HA status periodically. Even if an abnormal situation occurs in a certain notification, it can be corrected in the next notification, so that the data traffic processing of the device returns to normal. This achieves a combination of system stability, accuracy, and reliability, and improves the accuracy of HA switching.

[0075] Figure 5 This is a schematic diagram of an optional egress gateway firewall HA deployment according to an embodiment of the present invention, as shown below. Figure 5As shown, an enterprise deploys two firewalls in an HA (High Availability) group on its egress gateway to improve network communication stability. The HA architecture is implemented using the HA scheme in this embodiment of the invention. Two HA control links are used between the two firewalls: one link interface directly outputs from the kernel, and the other is a DP (Device Controller) driver interface. Through HA negotiation, FW1 acts as the HA master device, and FW2 as the HA backup device, with network traffic passing through the FW1 firewall. For example, in the HA environment, a lazy preemption mode is configured. When FW2 detects abnormalities in two CP (Content Processing) processes of FW1, it does not preempt HA master status; when FW2 detects a failure in the peer's DP process, FW2 preempts HA master status and takes over network traffic, while FW1 switches to HA backup status.

[0076] It should be noted that the enhanced HA architecture implementation scheme in this embodiment of the invention is widely applicable to a wide range of security devices, including but not limited to network traffic security devices, network data forwarding devices, network traffic analysis devices, and network traffic management devices, such as FW / NGFW, IDS / IPS, WAF, ADC, BDS, etc.; it can also be applied to virtualized security devices, including but not limited to virtualized network traffic security devices, virtualized network data forwarding devices, virtualized network traffic analysis devices, and virtualized network traffic management devices, such as vFW / vNGFW, vIDS / vIPS, vWAF, vADC, vBDS, etc.

[0077] Therefore, the technical solution of this invention effectively avoids the occurrence of a dual-master split-brain situation in HA, thereby improving the real-time performance and accuracy of HA switching. It also solves the technical problem of low switching accuracy in the prior art, which uses the method of inter-device interaction and negotiation in the control layer or forwarding layer process of network security equipment to control the switching of master and backup devices.

[0078] Example 2

[0079] According to an embodiment of the present invention, an embodiment of a control device for a network security device is provided, wherein, Figure 6 This is a schematic diagram of a control device for an optional network security device according to an embodiment of the present invention, such as... Figure 6As shown, the device includes: a transmission module 601, used to send a first target heartbeat message issued by multiple processes and a kernel thread to a second device through the target interface of the first device, and to receive a second target heartbeat message issued by multiple processes and a kernel thread of the second device, wherein the first device is in a primary running state and the second device is in a standby running state, the target interface includes a kernel interface and a DP interface, and the multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process; a determination module 602, used to obtain a target switching policy and target notification information through the second device, and to determine a target control policy for the running states of the first device and the second device based on the target switching policy, the target notification information, and the received first target heartbeat message; and a control module 603, used to control the running states of the first device and the second device according to the target control policy.

[0080] It should be noted that the transmission module 601, the determination module 602 and the control module 603 mentioned above correspond to steps S201 to S203 in the above embodiments. The three modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the content disclosed in the above embodiment 1.

[0081] Optionally, the transmission module includes: a first sending unit, configured to send a first target heartbeat message issued by the HA process of the first device to the HA process of the second device through the kernel interface of the first device; a second sending unit, configured to send a first target heartbeat message issued by the control layer process of the first device to the HA process of the second device through the kernel interface of the first device; a third sending unit, configured to send a first target heartbeat message issued by the forwarding layer process of the first device to the HA process of the second device through the DP interface of the first device; and a fourth sending unit, configured to send a first target heartbeat message issued by the kernel thread of the first device to the HA process of the second device through the kernel interface of the first device.

[0082] Optionally, during the process of sending HA heartbeat messages to the HA standby device through the kernel interface and DP interface of the HA master device, the HA heartbeat messages issued by the HA process of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device; the HA heartbeat messages issued by the control layer process of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device; the HA heartbeat messages issued by the forwarding layer process of the HA master device are sent to the HA process of the HA standby device through the DP interface of the HA master device; and the HA heartbeat messages issued by the kernel thread of the HA master device are sent to the HA process of the HA standby device through the kernel interface of the HA master device.

[0083] In this embodiment of the invention, the HA control link interface adopts a combination of DP driver interface (DPDK interface driver) and kernel driver interface (Kernel direct). The kernel thread and all CP processes, including the HA process (HA daemon), use the kernel driver interface to send and receive HA heartbeats. The DP processes (Ctrl dp, Data dp 1, ..., Data dp N) use their own driver interface to send and receive HA heartbeats.

[0084] It's important to note that if HA heartbeat messages are sent and received solely using the DP-driven interface, they are easily affected by the business message processing flow. For security devices, the number and complexity of messages processed by the kernel are much simpler than those processed by the data plane. Therefore, using a dedicated kernel-driven interface for HA heartbeat message sending and receiving ensures the stability of the HA heartbeat. Furthermore, since the simultaneous sending and receiving of HA heartbeats by both the kernel and DP-driven interfaces is virtually impossible, using a combination of DP-driven and kernel-driven interfaces for the HA control link interface effectively avoids serious problems such as split-brain issues.

[0085] Optionally, the target switching strategy includes a target switching mode, which is either a first switching mode or a second switching mode. The first switching threshold corresponding to the first switching mode is less than the second switching threshold corresponding to the second switching mode. The target notification information includes TIPC heartbeat messages sent by multiple target processes of the second device. The determining module includes: a first determining unit, used to determine whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message; a second determining unit, used to determine the evaluation data corresponding to the second device through the HA process of the second device based on the received first target heartbeat message and target notification information if the HA process and kernel thread of the first device are running normally, wherein the evaluation data is used to characterize the comprehensive operating performance of the second device; a third determining unit, used to compare the evaluation data corresponding to the second device with the first switching threshold when the target switching mode is the first switching mode, to obtain a first comparison result, and to determine the target control strategy based on the first comparison result; and a fourth determining unit, used to compare the evaluation data corresponding to the second device with the second switching threshold when the target switching mode is the second switching mode, to obtain a second comparison result, and to determine the target control strategy based on the second comparison result.

[0086] Optionally, the first switching mode can be an aggressive preemptive mode, and the second switching mode can be a deferred preemptive mode. Multiple target processes refer to CP processes (e.g., daemon 1, daemon 2, ..., daemon N) and DP processes (e.g., Ctrldp, Data dp 1, ..., Data dp N).

[0087] Optionally, in the process of determining the target control strategy for the operating status of the first device and the second device based on the target switching strategy, target notification information and the received first target heartbeat message, it can be determined whether the HA process and kernel thread of the HA master device are running normally based on the received HA heartbeat message.

[0088] Optionally, the second determining unit includes: a first determining submodule, used to determine the evaluation data corresponding to each target process of the second device based on the received first target heartbeat message and target notification information through the HA process of the second device; and a calculation submodule, used to perform weighted summation calculation based on the evaluation data corresponding to each target process of the second device to obtain the evaluation data corresponding to the second device.

[0089] Optionally, during the process of determining the evaluation data corresponding to the HA standby device based on the received HA heartbeat messages and TIPC heartbeat messages by the HA process of the HA standby device, the evaluation data corresponding to each target process can be determined by the received HA heartbeat messages and TIPC heartbeat messages. For example, the evaluation scores corresponding to CP processes daemon 1, daemon2, ..., daemon N and DP processes Ctrl dp, Data dp 1, ..., Data dp N are respectively.

[0090] Optionally, the evaluation data corresponding to the HA backup device can be obtained by weighted summation of the evaluation data corresponding to each target process of the HA backup device. For example, the evaluation scores corresponding to daemon 1, daemon 2, ..., daemon N, Ctrl dp, Datadp 1, ..., Data dp N can be weighted and summed to obtain the evaluation score corresponding to the HA backup device.

[0091] Optionally, when the target switching mode is the active preemption mode, the evaluation data corresponding to the HA standby device is compared with the first switching threshold to obtain the first comparison result, and the target control strategy is determined based on the first comparison result.

[0092] Optionally, the third determining unit includes: a second determining submodule, configured to determine the target control strategy as switching the operating state of the first device from the primary operating state to the standby operating state and switching the operating state of the second device from the standby operating state to the primary operating state if the first comparison result indicates that the evaluation data corresponding to the second device is greater than the first switching threshold; and a third determining submodule, configured to determine the target control strategy as not performing a state switch if the first comparison result indicates that the evaluation data corresponding to the second device is less than or equal to the first switching threshold.

[0093] Optionally, if the first comparison result indicates that the evaluation data corresponding to the HA standby device is greater than the first switching threshold, and the overall operating performance of the HA standby device is considered to be good, then the target control strategy is to switch the operating state of the HA master device from the master operating state to the standby operating state, and switch the operating state of the HA standby device from the standby operating state to the master operating state, that is, to perform a switch (HA standby device preempts master) as the target control strategy, and the HA standby device notifies the peer master device to switch to standby, and the local end switches to master; if the first comparison result indicates that the evaluation data corresponding to the HA standby device is less than or equal to the first switching threshold, then the target control strategy is to not perform a state switch.

[0094] Optionally, when the target switching mode is a hysteresis preemption mode, the evaluation data corresponding to the HA backup device and the second switching threshold are compared to obtain a second comparison result, and the target control strategy is determined based on the second comparison result. The specific implementation of determining the target control strategy based on the second comparison result is the same as that based on the first comparison result, and will not be elaborated here.

[0095] Optionally, in this embodiment of the invention, four levels of HA heartbeats are proposed: 1) Kernel HA heartbeat: if the local HA process receives this heartbeat, it indicates that the peer system (OS) is alive; 2) HA daemon heartbeat: if the local HA process receives this heartbeat, it indicates that the CP control plane is working; 3) DP heartbeat: if the local HA process receives this heartbeat, it indicates that the peer's DP data forwarding plane is normal; 4) Heartbeat of specific CP daemon modules: to measure whether specific CP process modules on the peer are working properly. Making HA switching decisions based on the functional definitions of different levels has higher accuracy and greater practicality.

[0096] Optionally, in this embodiment of the invention, the heartbeat of the Kernel and the heartbeat of the HA daemon have the highest priority. When they are abnormal, it means that there is a problem with the entire system. At this time, when the standby device detects that the local system is normal, it directly switches to the master state.

[0097] Optionally, for HA heartbeats of other CP and DP processes, if the monitoring results of a certain group of process modules show that the local device is normal for that process module while the peer device is abnormal, then the local device receives a "bonus" for the operation of that process module; if the local device is abnormal while the peer device is normal, then it receives a "minus"; if both ends are normal or abnormal, then no points are awarded. In this way, multiple groups of process modules can be weighted and summed to obtain a HA process group score, "ha_group_score", calculated as follows:

[0098]

[0099] Where i is the module process index, N represents the other N CP and DP process modules, and W i The weights corresponding to the modules measure their importance. Network-related CP and DP processes have higher weights than ordinary CP processes. ha_local_is_normal(i) is used to determine whether the process module is normal on the local device, returning 1 if normal and 0 if abnormal; ha_peer_is_normal(i) is used to determine whether the process module is normal on the HA peer device, returning 1 if normal and 0 if abnormal.

[0100] Optionally, on the HA standby device, a score can be calculated using the above formula. If this score is greater than 0, it indicates that the overall operating status of the HA standby device is better than that of the HA master device. When this score reaches a threshold greater than 0, the HA standby device can preemptively become the master device. Optionally, this invention defines two thresholds: threshold-low and threshold-high, and further defines two preemption modes: positive preemption and lazy preemption. Optionally, the mode that preempts when the score is higher than threshold-low is called positive preemption; the mode that preempts when the score is higher than threshold-high is called lazy preemption. Of the two switching modes, positive preemption has a lower threshold, higher switching accuracy, and is more sensitive, allowing the device with better operating status to take over traffic as early as possible. Lazy preemption has a higher threshold, which can avoid frequent preemption switching between HA master and standby devices, resulting in a more stable HA environment. Optionally, these two preemption modes can be selected according to the actual scenario requirements.

[0101] Optionally, when an HA standby device preempts to become the HA master, it needs to first notify the peer master device to switch to standby, and then the local device switches to master, avoiding the problem of instantaneous dual-master operation. Optionally, the weight W of each module... iThreshold-low and threshold-high can be configured based on empirical or design values ​​to meet various needs, and are not limited here.

[0102] It should be noted that in this embodiment of the invention, a four-level HA heartbeat is implemented, which fully reflects the operating status of the system kernel, CP, and DP layers, improves the stability of HA heartbeat transmission and reception, effectively avoids the occurrence of HA dual-master split-brain situation, and can determine whether the functional modules of the HA peer device are operating normally through HA heartbeat information, providing a basis for HA switching; through TIPC notification information and the enhanced HA heartbeat mechanism, the local device and peer device are systematically and comprehensively learned, improving the real-time performance and accuracy of HA switching.

[0103] Optionally, the target switching strategy includes target judgment rules, and the control device of the network security device further includes: a first determining module, used to determine whether the HA process of the first device and the kernel thread of the first device are running normally based on the received first target heartbeat message; if the HA process of the first device and the kernel thread of the first device are not running normally, then according to the target judgment rules, determine the target control strategy to switch the running state of the first device from the primary running state to the standby running state, and switch the running state of the second device from the standby running state to the primary running state.

[0104] Optionally, the target judgment rule can be to directly switch the HA state when the local system is detected to be normal while the heartbeats of the remote kernel and HAdaemon are abnormal. For example, if the HA process and kernel thread of the HA master device are not running normally, the target control strategy can be determined to switch according to the target judgment rule, that is, to switch the running state of the HA master device from the primary running state to the standby running state, and to switch the running state of the HA standby device from the standby running state to the primary running state.

[0105] Optionally, if the HA process and kernel thread of the HA master device are running normally, the HA process of the HA standby device can determine the evaluation data corresponding to the HA standby device based on the received HA heartbeat message and TIPC heartbeat message.

[0106] Optionally, the control device of the network security device further includes: a first notification module, used to broadcast the current operating status of the first device to multiple target processes of the first device through the HA process of the first device according to a first preset time interval; and a second notification module, used to broadcast the current operating status of the second device to multiple target processes of the second device through the HA process of the second device according to a second preset time interval.

[0107] Optionally, in this embodiment of the invention, the HA process of this device periodically broadcasts to all service process modules of this device whether the HA status of this device is primary or backup. The first preset time interval can be the broadcast interval corresponding to the HA primary device, and the second preset time interval can be the broadcast interval corresponding to the HA backup device. The two can be the same or different, and are not limited here.

[0108] It should be noted that in this embodiment of the invention, the HA status is broadcast periodically. The HA status of the device needs to be notified to all process modules on the device. Since the process in the HA process runs in a non-blocking manner, it cannot wait for the destination process to reply to the notification message. Therefore, this invention proposes a scheme for the HA process to broadcast the HA status periodically. Even if an abnormal situation occurs in a certain notification, it can be corrected in the next notification, so that the data traffic processing of the device returns to normal. This achieves a combination of system stability, accuracy, and reliability, and improves the accuracy of HA switching.

[0109] Example 3

[0110] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the control method of the network security device described above when it is run.

[0111] Example 4

[0112] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the control method of the network security device described above when running.

[0113] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0119] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A control method of a network security device, characterized by, include: The first device sends a first target heartbeat message from multiple processes and a kernel thread to the second device through the target interface of the first device, and receives a second target heartbeat message from multiple processes and a kernel thread of the second device. The first device is in the primary running state, and the second device is in the standby running state. The target interface includes a kernel interface and a data plane DP interface. The multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process. The target switching strategy and target notification information are obtained through the second device, and the target control strategy for the operating status of the first device and the operating status of the second device is determined based on the target switching strategy, the target notification information and the received first target heartbeat message. The operating states of the first device and the second device are controlled according to the target control strategy.

2. The method of claim 1, wherein, The first device sends a first target heartbeat message, consisting of multiple processes and a kernel thread, to the second device via the target interface of the first device. This includes: The first target heartbeat message issued by the HA process of the first device is sent to the HA process of the second device through the kernel interface of the first device. The first target heartbeat message issued by the control layer process of the first device is sent to the HA process of the second device through the kernel interface of the first device. The first target heartbeat message issued by the forwarding layer process of the first device is sent to the HA process of the second device through the DP interface of the first device. The kernel interface of the first device sends the first target heartbeat message issued by the kernel thread of the first device to the HA process of the second device.

3. The method of claim 2, wherein, The target switching strategy includes a target switching mode, which is either a first switching mode or a second switching mode. The first switching mode corresponds to a first switching threshold that is less than the second switching mode's second switching threshold. The target notification information includes TIPC heartbeat messages sent by multiple target processes of the second device. The target control strategy for the operating states of the first device and the second device is determined based on the target switching strategy, the target notification information, and the received first target heartbeat messages, including: Based on the received first target heartbeat message, determine whether the HA process of the first device and the kernel thread of the first device are running normally; If the HA process and kernel thread of the first device are running normally, the HA process of the second device determines the evaluation data corresponding to the second device based on the received first target heartbeat message and the target notification information. The evaluation data is used to characterize the overall operating performance of the second device. When the target switching mode is the first switching mode, the evaluation data corresponding to the second device is compared with the first switching threshold to obtain a first comparison result, and the target control strategy is determined based on the first comparison result; When the target switching mode is the second switching mode, the evaluation data corresponding to the second device and the second switching threshold are compared to obtain a second comparison result, and the target control strategy is determined based on the second comparison result.

4. The method of claim 3, wherein, The HA process of the second device determines the evaluation data corresponding to the second device based on the received first target heartbeat message and the target notification information, including: The HA process of the second device determines the evaluation data corresponding to each target process of the second device based on the received first target heartbeat message and the target notification information. The evaluation data corresponding to the second device is obtained by weighted summation based on the evaluation data corresponding to each target process of the second device.

5. The method of claim 3, wherein, Determining the target control strategy based on the first comparison result includes: If the first comparison result indicates that the evaluation data corresponding to the second device is greater than the first switching threshold, then the target control strategy is determined to switch the operating state of the first device from the main operating state to the standby operating state, and switch the operating state of the second device from the standby operating state to the main operating state. If the first comparison result indicates that the evaluation data corresponding to the second device is less than or equal to the first switching threshold, then the target control strategy is determined to be not to perform state switching.

6. The method of claim 3, wherein, The target switching strategy includes target judgment rules, wherein, after determining whether the HA process and kernel thread of the first device are running normally based on the received first target heartbeat message, the method further includes: If the HA process and kernel thread of the first device are not running normally, then according to the target judgment rule, the target control strategy is to switch the running state of the first device from the primary running state to the standby running state, and switch the running state of the second device from the standby running state to the primary running state.

7. The method of claim 1, wherein, The method further includes: According to a first preset time interval, the current operating status of the first device is broadcast to multiple target processes of the first device through the HA process of the first device; Based on a second preset time interval, the current operating status of the second device is broadcast to multiple target processes of the second device through the HA process of the second device.

8. A control device for a network security equipment, characterized in that, include: The transmission module is used to send a first target heartbeat message issued by multiple processes and a kernel thread to a second device through the target interface of the first device, and to receive a second target heartbeat message issued by multiple processes and a kernel thread of the second device. The first device is in a primary running state, and the second device is in a standby running state. The target interface includes a kernel interface and a data plane DP interface. The multiple processes include a high availability (HA) process, a control layer process, and a forwarding layer process. The determination module is used to obtain target switching strategy and target notification information through the second device, and determine the target control strategy for the operating status of the first device and the operating status of the second device based on the target switching strategy, the target notification information and the received first target heartbeat message; The control module is used to control the operating status of the first device and the second device according to the target control strategy.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the control method of the network security device according to any one of claims 1 to 7 when it is run.

10. An electronic device, characterized in that, The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to be configured to run the programs, wherein the programs are configured to execute the control method of the network security device according to any one of claims 1 to 7.

Images