A system and method for dynamically managing firewall policies for real-time communication applications

Abstract

The application discloses a kind of real-time communication application-oriented dynamic management firewall policy system and method, with real-time accurate control communication link function for dynamic data flow, by collecting and analyzing the characteristic item of communication link data packet, according to the preset rule matched by characteristic item, the security policy that firewall needs to be configured is calculated, automatically triggers the corresponding firewall policy issuing execution, according to the access demand control in the access link between multiple system service nodes in firewall security control area, according to the establishment and the requirement of opening and closing of data link, orderly dynamic opening and closing firewall data channel, prevent unauthorized business access request.By using firewall virtualization technology, a unified firewall resource control mechanism is constructed for different models of firewall, providing a unified standard firewall and its policy management interface to control different models of firewall, significantly enhancing the efficiency and security of firewall management configuration.

Description

Technical Field

[0001] This invention relates to the field of secure communication technology, specifically to a system and method for dynamically managing firewall policies for real-time communication applications. Background Technology

[0002] With the advent of 5G networks, high-bandwidth, low-latency real-time communication services such as trunked intercom, instant messaging, video conferencing, and drone video surveillance have been widely adopted in vertical industries such as water conservancy and power. Within the internal networks of these industries, different security domains are typically divided to protect user and business data and ensure compliance. To enhance network security, different firewall models may be deployed within different security domains to create multi-layered security protection, thus increasing the complexity of firewall and policy management.

[0003] Real-time communication data within an enterprise network is typically transmitted between different systems in the form of dynamic data streams. Network channels between systems are usually protected by firewalls deployed between them. In real-time communication applications, media streams are highly dynamic data streams. When one system (System A) needs to communicate with another system (System B), a channel link needs to be established between the two systems in a timely manner to enable real-time interaction of dynamic data streams. When communication between systems ends, the link channel needs to be closed promptly to achieve dynamic authorization and access control between the systems.

[0004] The existing management method for cross-system real-time communication links involves network administrators manually configuring firewall security policies on the communication links in advance based on cross-system communication needs. Once the security policies are set, the link channel remains open indefinitely, even if business needs change. This prevents timely and effective control of firewall policies to release resources and close the link channel, posing security risks. When it is necessary to close the data link channel or during system upgrades or changes, administrators still need to manually add, modify, and delete firewall security policies to ensure secure communication for dynamic data streams. Manual firewall configuration is inefficient and prone to errors and confusion, leading to policy duplication, conflicts, and failures. Existing firewall policy management technologies are inefficient and vulnerable, making it difficult to meet the needs of real-time communication applications. There is an urgent need for a more efficient and automated firewall policy configuration management solution to optimize firewall management and policy configuration, support secure and efficient transmission of dynamic data streams, and improve the network security and operational efficiency of real-time communication application systems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention aims to provide a system and method for dynamically managing firewall policies for real-time communication applications.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A system for dynamically managing firewall policies for real-time communication applications includes a user interface layer module, an access layer module, a service layer module, and a virtualization layer module.

[0008] The interface layer module is used to present a visual operation interface to users. Through the visual operation interface, users can view the information of all firewalls managed by the system and the operating status of each firewall, configure network security zones, manage the IP addresses of different types of network devices in the network, and query the security policy information on each firewall.

[0009] The access layer module is used to communicate with external clients, and it supports interaction with different external clients using multiple communication methods. The access layer module has a data collector and a data analyzer, which are used to collect and analyze bypass data packets, respectively. The access layer module also supports building request interfaces based on HTTPS or WEBSOCKETS protocols, receiving requests from various types of external clients, and parsing and responding to the requests.

[0010] The service layer module is the core processing unit, used to provide communication link authorization access support for various real-time communication services, and supports preset rule management, data packet feature matching and security zone management;

[0011] Preset rule management includes querying, adding, deleting, and modifying preset rules, as well as sending matching rule policies to the virtual firewall to execute policy control instructions; preset rules consist of two parts: feature conditions and rule policies.

[0012] Packet feature matching is the process of comparing packet features with feature conditions in preset rules. If a packet feature successfully matches a feature condition, it is associated with a rule policy related to the matched feature condition. A rule policy consists of one or more virtual firewall policy control instructions. A virtual firewall policy control instruction consists of one or more of the following: virtual firewall ID, home policy group, policy ID, source IP address, source port number, source security domain, destination IP address, destination port number, destination security domain, protocol type, operation type, and policy validity period.

[0013] Security zone management includes the configuration and management of security zones, supports querying, adding, deleting and modifying security zones, and sends them to network devices to perform corresponding operations;

[0014] The virtualization layer module includes a virtual firewall management submodule, a firewall connection management submodule, and a firewall policy control instruction adaptation submodule;

[0015] The virtual firewall management submodule is used to convert each firewall information into a virtual firewall mapping object, which can correspond to different types of firewalls; the virtual firewall management submodule provides a unified standard interface for virtual firewalls and their security policy management for the service layer module;

[0016] The firewall connection management submodule is designed to be compatible with different firewall models, supports establishing secure SSH connections with different firewall models, and supports bidirectional interactive communication sessions with firewalls.

[0017] The firewall policy control instruction adaptation submodule is used to convert the control policies defined in the metascript into specific firewall executable operation sequences.

[0018] Furthermore, the access layer module is implemented using the Yate framework and the OAT++ framework.

[0019] Furthermore, the feature conditions are used to match the features of the data packet, including one or more of the following: source IP address, destination IP address, source port number, destination port number, protocol type, and message content.

[0020] Furthermore, the single-level policy relationships between different upstream and downstream nodes form a rule policy list. The service layer module merges duplicate and invalid items based on these single-level policy relationships, and finally generates a set of virtual firewall policy control instructions.

[0021] Furthermore, a virtual firewall mapping object consists of one or more of the following: a unique virtual firewall identifier, an IP segment, a security zone, a security policy, a firewall connection handle, and the firewall's policy execution status information.

[0022] Furthermore, the virtual firewall and its security policy management interface include a virtualization management interface for firewall basic information, IP information, security domains, security policies, policy groups, routing tables, and log information.

[0023] This invention discloses a method for dynamically managing firewall policies for real-time communication applications using the above-mentioned system, comprising the following steps:

[0024] Step 1: The access layer module acquires business data packets sent by external clients through the data collector, and uses the data analyzer to perform feature analysis on the business data packets to obtain data packet feature items, thereby completing the data packet capture and analysis.

[0025] Step 2: After the access layer module completes the data packet capture and analysis, it sends the characteristics of the data packets to the service layer module. The service layer module performs real-time inspection of the data packets entering the network based on preset rules and performs feature matching on the characteristics of the data packets.

[0026] Feature matching is based on configured preset rules. The service layer module compares the features of the data packets passed from the access layer module with the feature conditions of the preset rules one by one to determine whether they meet the feature conditions. If they do, the rule policy associated with the met feature conditions is retrieved and used. If multiple feature conditions are met at the same time during the feature matching process, all associated rule policies are combined and used. The service layer module merges and organizes the retrieved rule policies to generate a set of virtual firewall policy control instructions.

[0027] Step 3: The service layer module calls the unified virtual firewall and its policy management interface of the virtualization layer module, and passes the set of virtual firewall policy control instructions to the virtualization layer module. The virtual firewall management submodule interprets each virtual firewall policy control instruction, and uses the source IP address, source port number, source security domain, target IP address, target port number, target security domain, protocol type, operation type, and policy validity period in the policy control instructions to generate a meta-script. The meta-script contains network security policies, ACL rules, and related configuration information.

[0028] The firewall policy control instruction adaptation submodule queries the corresponding real firewall information based on the unique identifier of the virtual firewall in the policy control instruction, compiles the meta-script according to the target firewall model, generates policy configuration information suitable for the target firewall, uses the firewall connection management submodule to send the policy configuration information to the target firewall to execute the policy configuration operation, and feeds back the execution result to the virtual firewall management submodule.

[0029] Furthermore, in step one, the data packet capture analysis uses a bypass traffic mirroring method to collect business data packets and extracts their characteristic items from the data packets, including one or more of the following: source IP address, destination IP address, source port number, destination port number, protocol type, and message content; preliminary analysis is performed on the application data of the message content to extract application layer protocol type characteristics and parse the application content information in the data packets according to the application protocol type.

[0030] Furthermore, the process of compiling a meta-script is as follows:

[0031] (1) Metascript parsing: The compiler parses all data items of the metascript and converts the abstract rules of the metascript into data format according to the command set syntax rules of the target firewall;

[0032] (2) Configuration generation: After completing the meta-script parsing, a policy configuration file suitable for the target firewall is generated, which includes ACL rules, address translation rules and security policies, and then an executable operation sequence is generated.

[0033] The beneficial effects of this invention are as follows:

[0034] 1) This invention can provide precise dynamic link management between multiple system service nodes based on the business call relationship between system service nodes, realize the dynamic opening and closing of communication link channels between multi-level system service nodes, improve system security, and ensure system management efficiency.

[0035] 2) This invention performs feature analysis on the data captured from the data link layer. By analyzing the captured data in real time, it can accurately identify various types of real-time communication protocols and data streams, analyze data packet characteristics, identify service types, and dynamically control the firewall policy of the corresponding data link according to service access requirements, thereby reducing the workload of business system transformation and increasing system flexibility.

[0036] 3) This invention provides a virtualization process for dynamic management and policy adaptation of firewall information, thereby improving system management efficiency.

[0037] This invention provides a system capable of real-time, precise control of communication links for dynamic data flows. By collecting and analyzing the characteristics of data packets in the communication links, and based on preset rules for matching these characteristics, it calculates the security policies that the firewall needs to configure, automatically triggers the corresponding firewall policies for execution, and manages access links between multiple system service nodes within the firewall's security control area according to access requirements. It dynamically opens and closes firewall data channels in an orderly manner according to the establishment and disconnection needs of data links, blocking unauthorized business access requests. By using firewall virtualization technology, a unified firewall resource control mechanism is built for different firewall models, providing a unified standard firewall and its policy management interface to manage different firewall models, significantly enhancing the efficiency and security of firewall management and configuration. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the architecture of the dynamic management firewall policy system in Embodiment 1 of the present invention;

[0039] Figure 2 This is a service flow diagram of the system in Embodiment 1 of the present invention in a real-time communication application scenario;

[0040] Figure 3 This is a flowchart of the method in Embodiment 2 of the present invention;

[0041] Figure 4 This is a flowchart of the meta-script compilation process in Embodiment 2 of the present invention;

[0042] Figure 5 This is a schematic diagram of the system in Embodiment 3 of the present invention;

[0043] Figure 6 This is a flowchart of the method in Embodiment 3 of the present invention;

[0044] Figure 7 This is a schematic diagram of the system in Embodiment 4 of the present invention;

[0045] Figure 8 This is a flowchart of the method in Embodiment 4 of the present invention. Detailed Implementation

[0046] The present invention will be further described below with reference to the accompanying drawings. It should be noted that this embodiment is based on the present technical solution and provides detailed implementation methods and specific operation processes, but the protection scope of the present invention is not limited to this embodiment.

[0047] Example 1

[0048] This embodiment provides a system for dynamically managing firewall policies for real-time communication applications, such as... Figure 1 As shown, it includes a user interface layer module, an access layer module, a service layer module, and a virtualization layer module;

[0049] The interface layer module is used to present a visual operation interface to users. Through the visual operation interface, users can view information about all firewalls (including software and hardware firewalls) managed by the system, as well as the operating status of each firewall, configure network security zones, manage the IP addresses of different types of network devices in the network, and query security policy information on each firewall.

[0050] The access layer module is used to communicate with external clients, supporting various communication methods for interaction with different external clients. The access layer module includes a data collector and a data analyzer, which are used for mirroring and analyzing bypass data packets, respectively. The access layer module also supports building request interfaces based on HTTPS or WEBSOCKETS protocols, receiving requests from various types of external clients, and parsing and responding to these requests, thereby seamlessly integrating multiple interaction methods and increasing system interoperability. The access layer module adopts the lightweight, high-performance Yate and OAT++ frameworks, possessing high throughput, low latency, and excellent scalability, enabling it to handle high concurrency, high load, and large-scale communication service requirements.

[0051] The service layer module is the core processing unit, used to provide communication link authorization access support for various real-time communication services, and supports preset rule management, data packet feature matching and security zone management.

[0052] Preset rule management includes querying, adding, deleting, and modifying preset rules, as well as sending matching rule policies to the virtual firewall to execute policy control instructions. Preset rules consist of two parts: feature conditions and rule policies. Feature conditions are used to match data packet characteristics, including one or more of the following combinations: source IP address, destination IP address, source port number, destination port number, protocol type, and message content.

[0053] Packet feature matching is the process of comparing packet features with the feature conditions in preset rules. If a packet's feature matches a feature condition successfully, it is associated with a rule policy related to the matched feature condition. A rule policy consists of one or more virtual firewall policy control instructions. Each virtual firewall policy control instruction comprises data items such as virtual firewall ID, home policy group, policy ID, source IP address, source port number, source security domain, destination IP address, destination port number, destination security domain, protocol type, operation type, and policy validity period. The single-level policy relationships between different upstream and downstream nodes form a rule policy list. This list may contain duplicate or invalid policies. The service layer module merges duplicate and invalid items based on these single-level policy relationships, ultimately generating a set of virtual firewall policy control instructions.

[0054] Security zone management includes configuring and managing security zones, supporting the querying, addition, deletion, and modification of security zones, and sending corresponding operations to network devices. By using security zone management, different security zones can be defined, security policies between different security zones can be defined and managed, and data flow communication between business systems in different security zones can be authorized, ensuring that sensitive data in business systems is not accessed without authorization.

[0055] The virtualization layer module is used to abstract firewall resources in the internal network, providing a unified standard virtual firewall and its policy management interface for the service layer module. It can uniformly manage firewall resources in the network, support firewall information management and firewall policy compilation, and has flexibility and scalability to adapt to constantly changing business needs.

[0056] The virtualization layer module includes a virtual firewall management submodule, a firewall connection management submodule, and a firewall policy control instruction adaptation submodule.

[0057] The virtual firewall management submodule converts each firewall information into a virtual firewall mapping object. Each virtual firewall mapping object consists of data items such as a unique virtual firewall identifier, IP range, security zone, security policy, firewall connection handle, and firewall policy execution status information. Virtual firewall mapping objects can correspond to different firewall models. The virtual firewall management submodule provides a unified standard interface for managing virtual firewalls and their security policies to the service layer modules, simplifying firewall management. This interface includes a virtualized management interface for basic firewall information, IP information, security domains, security policies, policy groups, routing tables, and log information, improving system compatibility and scalability.

[0058] The firewall connection management submodule is designed to be compatible with different firewall models. It supports establishing secure SSH connections with different firewall models, supports bidirectional interactive communication sessions with firewalls, and flexibly connects to and manages different firewall models. This ensures the security and stability of communication between the system and network devices and improves system scalability.

[0059] The firewall policy control instruction adaptation submodule is used to convert the control policies defined in the metascript into specific executable operation sequences for the firewall. Specifically, for software firewalls, the metascript is converted into executable script code; for hardware firewalls, the metascript is converted into a corresponding XML script and its execution sequence. This ensures seamless integration and execution of the metascript to adapt to different types of firewall devices.

[0060] The service flow diagram of the system in this embodiment in a real-time communication application scenario is as follows: Figure 2 As shown in the diagram, the dynamic management firewall policy system in this embodiment is a logical forwarding device, but physically a bypass device. It acts as a "trusted system" in the control path, collecting and processing data traffic packets. By analyzing these packets, it determines whether a certain type of data traffic packet can pass through the target firewall, and, as needed, links the target firewall to open or close ports. The target firewall then allows or blocks communication requests from terminals or across systems according to the policies issued by the dynamic management firewall policy system. In this embodiment, the dynamic management firewall policy system and the target firewall interact via the SSH protocol.

[0061] Example 2

[0062] This embodiment provides a method for dynamically managing firewall policies for real-time communication applications using the system of Embodiment 1, such as... Figure 3 As shown, it includes the following steps:

[0063] Step 1: The access layer module acquires business data packets sent by external clients through the data collector, and uses the data analyzer to perform feature analysis on the business data packets to obtain data packet feature items, thereby completing the data packet capture and analysis.

[0064] In this embodiment, the data packet capture analysis employs a bypass traffic mirroring method to collect business data packets and quickly extract their characteristic items, including one or more combinations of source IP address, destination IP address, source port number, destination port number, protocol type, and message content. Preliminary analysis is then performed on the application data within the message content to extract application layer protocol type characteristics and parse the application content information within the data packets based on the application protocol type.

[0065] Step 2: After the access layer module completes the data packet capture and analysis, it sends the characteristics of the data packets to the service layer module. The service layer module performs real-time inspection of the data packets entering the network based on preset rules and performs feature matching on the characteristics of the data packets.

[0066] Feature matching is based on configured preset rules. The service layer module compares the features of the data packets passed from the access layer module with the feature conditions of the preset rules one by one to determine whether they meet the feature conditions. If they do, the rule policy associated with the met feature condition is retrieved and used. If multiple feature conditions are met simultaneously during feature matching, all associated rule policies are combined and used. The service layer module then merges and organizes the retrieved rule policies to generate a set of virtual firewall policy control instructions.

[0067] Step 3: The service layer module calls the unified virtual firewall and its policy management interface of the virtualization layer module, and passes the set of virtual firewall policy control instructions to the virtualization layer module. The virtual firewall management submodule interprets each virtual firewall policy control instruction, and uses the source IP address, source port number, source security domain, target IP address, target port number, target security domain, protocol type, operation type, and policy validity period in the policy control instructions to generate a meta-script. The meta-script contains network security policies, ACL rules, and related configuration information. The meta-script is an abstract and unified description that does not depend on the specific firewall model.

[0068] The firewall policy control instruction adaptation submodule queries the corresponding real firewall information based on the unique identifier of the virtual firewall in the policy control instruction, compiles the meta-script according to the target firewall model, generates policy configuration information suitable for the target firewall, uses the firewall connection management submodule to send the policy configuration information to the target firewall to execute the policy configuration operation, and feeds back the execution result to the virtual firewall management submodule.

[0069] The aforementioned policy compilation technology is an innovative approach. When a policy needs to be issued to a target firewall, the metascript is first compiled specifically for that firewall. This compilation process can be understood as transforming a unified, abstract metascript definition into a policy configuration file for a particular firewall model. This policy compilation method provides a unified policy management approach for different firewall models, making firewall management more efficient, flexible, and scalable. Simultaneously, the definition of the metascript makes policy writing and modification more intuitive and convenient, bringing greater convenience to firewall management.

[0070] In this embodiment, the strategy compilation process for the meta-script is as follows: Figure 4 As shown, it includes the following steps:

[0071] (1) Metascript parsing: The compiler parses all data items of the metascript and converts the abstract rules of the metascript into data format according to the command set syntax rules of the target firewall.

[0072] (2) Configuration generation: After completing the meta-script parsing, a policy configuration file suitable for the target firewall is generated, including ACL rules, address translation rules and security policies, etc., and further an executable operation sequence is generated. For software firewalls, the operation sequence corresponds to the rule commands in IPTables instructions. For hardware firewalls, the operation sequence corresponds to the operation combination such as get / getconf / set / setconf in NETCONF protocol instructions or CLIENT interface.

[0073] Example 3

[0074] This embodiment provides an application example of Embodiments 1 and 2.

[0075] like Figure 5 As shown, this embodiment establishes a secure access channel between the intercom terminal and the intercom system A, and realizes dynamic authorized access control of the communication link channel between the intercom terminal and the intercom system A.

[0076] Firewall A is located between the intercom terminal device and intercom system A. By default, insecure ports are not opened on firewall A, preventing direct interaction between the intercom terminal and intercom system A. The dynamic management firewall policy system is a logical forwarding device, but physically a bypass device. It acts as a "trusted system" in the control path, collecting and processing data traffic packets. By analyzing the characteristics of data traffic packets, it determines whether a certain type of data traffic packet can pass through the target firewall A and be forwarded to intercom system A. The policies issued by the dynamic management firewall policy system to the target firewall A trigger, opening or closing service ports on demand, allowing or blocking communication requests between the intercom terminal and intercom system A. The dynamic management firewall policy system and the target firewall A interact via the SSH protocol.

[0077] like Figure 6 As shown, the business process in this embodiment is as follows:

[0078] Step 1: Before the intercom terminal communicates with the intercom system A, the intercom terminal first initiates a single-packet authentication to port 62201 of firewall A. The authentication data packet contains the terminal IMEI, software and hardware tokens, and source address information.

[0079] Step 2: The single-packet authentication data packet arrives at the dynamic management firewall policy system via traffic mirroring. The dynamic management firewall policy system, acting as a "trusted system" in the bypass control path, first uses the data collector of the access layer module to filter and obtain the single-packet authentication data packet with the target port 62201 from the data link layer. Then, it uses the data analyzer to parse the authentication data packet to obtain the source IP address, destination IP address, source port number, destination port number, protocol type, terminal IMEI, and token of the data packet.

[0080] Step 3: The service layer uses the terminal IMEI, token, and the system's preset authentication rules to perform feature matching. If the match fails, the data packet is discarded, and other data packets are monitored and collected to block spoofing attacks. If the match succeeds, the associated rules and policies are obtained. After integrating the rules and policies, a virtual firewall policy control command to be issued is generated. The command includes the virtual firewall ID mapped to firewall A, the source IP address of the intercom terminal, the source security domain C, the IP address of intercom system A, the control signaling request port number, the target security domain A, the protocol type SIP, the operation to open the control signaling request port, and the policy validity period.

[0081] Step 4: The service layer module calls the unified virtual firewall and its policy management interface of the virtualization layer module, and passes the generated set of virtual firewall policy control instructions to the virtualization layer module. The virtual firewall management submodule interprets the virtual firewall policy control instructions item by item, and uses data items such as source IP address, source security domain, target IP address, target port number, target security domain, protocol type, operation type, and policy validity period in the policy control instructions to generate a metascript. The firewall policy control instruction adaptation submodule queries the information of the corresponding firewall A according to the virtual firewall ID in the policy control instructions, compiles the metascript according to the firewall A model, generates policy configuration information suitable for firewall A, and uses the firewall connection management module to send the policy configuration information to firewall A to execute the policy configuration operation.

[0082] Through the four steps described above, this embodiment provides granular authorization control for different intercom terminals, ensuring that only authorized terminals can access intercom system A within security domain A. After successful intercom terminal authentication, the control plane port of firewall A is opened. The dynamic management firewall policy system manages firewall A to allow call control signaling data between the intercom terminal and intercom system A.

[0083] Example 4

[0084] This embodiment provides an application example of Embodiments 1 and 2, specifically for building a secure access channel for inter-system intercom communication, and realizing dynamic authorized access to communication link channels between multi-level intercom communication systems. For example... Figure 7As shown, intercom system A and trunked intercom system B are located on different networks, isolated by firewall B. Under the strict control and auditing of the dynamic management firewall policy system, control plane call signaling is allowed to pass through firewall B. For intercom terminal 1 and the trunked intercom terminal to conduct cross-system real-time communication, a call session must first be established via control plane signaling. The dynamic management firewall policy system simultaneously controls firewalls A and B to open control plane signaling communication ports for call establishment. Example 3 has already explained the method and steps for opening control plane ports. After the signaling plane call session is established, intercom terminal 1 and the trunked intercom terminal transmit voice data using RTP traffic. Because the port number for RTP traffic is dynamically allocated, ranging from (1024-65534), and RTCP controls the port of the traffic to ensure that RTP traffic can randomly select ports. For voice calls between intercom terminal 1 and the trunked intercom terminal, the RTP traffic between the two terminals must pass through firewalls A and B. If a large number of UDP ports are opened in advance on firewalls A and B, this provides an opportunity for attackers and poses a risk to network security. Therefore, the dynamic firewall policy management system collects and analyzes call control plane protocol messages. Based on the information in the protocol messages, it manages the port numbers of RTP traffic on firewalls A and B in real time, dynamically opening or closing necessary firewall ports to allow RTP traffic transmission. This provides a higher level of dynamic authorized access security for media streams in cross-system converged communication service scenarios. In this embodiment, the dynamic firewall policy management system adopts Yate plug-in technology, possessing full message awareness capabilities. It can automatically configure based on specific service information and supports rapid adaptation to new network applications and protocols. Therefore, the data analyzer in this embodiment can handle more than just a single protocol.

[0085] like Figure 8 As shown, the business process in this embodiment is as follows:

[0086] Step 1: Dynamically manage firewall policies. The system controls firewalls A and B to establish open control plane signaling communication ports for calls and allow call control signaling data to pass through.

[0087] Step Two: Intercom services are initiated between the intercom terminal and the trunked intercom terminal. After logical processing by intercom system A and trunked intercom system B, a communication session is first established from the control plane. During call setup, the RTP port number for voice and data traffic transmission is negotiated, and the negotiated RTP traffic port is carried in the control signaling protocol header or payload. Intercom system A sends all signaling messages processed to the dynamic management firewall policy system via the WEBSOCKETS interface.

[0088] Step 3: The call message arrives at the dynamic management firewall policy system. As a "trusted system" in the bypass control path, the dynamic management firewall policy system first uses a data collector to filter protocol messages carrying RTP traffic port information. Then, using a data analyzer, the dynamic management firewall policy system uses the data collector in the access layer module to filter data packets and obtain control signaling data packets. It employs "RFC compliance detection" to inspect the protocol content, analyzes application layer protocols, and identifies them based on protocol behavior templates. This process parses the dynamically opened UDP port numbers that RTP traffic needs to open through firewalls A and B, as well as the source IP address, destination IP address, source port number, and protocol type.

[0089] Step 4: The service layer module uses the feature items to perform feature matching with the feature conditions of the system's preset RTP traffic rules. If the match fails, the data packet is discarded directly. If the match succeeds, the associated rule policy is obtained. After integrating the rule policies, a set of virtual firewall policy control instructions to be issued is generated. The instructions contain the negotiated source / destination address, source / destination port, and other RTP traffic port opening authorization information.

[0090] Step 5: The service layer module calls the unified virtual firewall and its policy management interface of the virtualization layer module, and passes the generated set of virtual firewall policy control instructions to the virtualization layer module. The virtual firewall management submodule interprets the virtual firewall policy control instructions item by item, and uses data items such as source IP address, source security domain, destination IP address, destination port number, destination security domain, protocol type, operation type, and policy validity period in the policy control instructions to generate metascripts. The firewall policy control instruction adaptation submodule queries the information of the corresponding firewall A and firewall B according to the virtual firewall ID in the policy control instructions, compiles the metascripts according to the models of firewall A and firewall B, and generates policy configuration information applicable to firewall A and firewall B respectively. The firewall connection management module uses the firewall configuration information to send the policy configuration information to the corresponding firewalls to execute the policy configuration operation, and opens the RTP traffic forwarding ports on firewall A and firewall B respectively, determining that RTP traffic can flow through firewall A and firewall B.

[0091] Step 6: After the call session is established, RTP traffic using the dynamic UDP port can be transmitted bidirectionally on the opened communication link.

[0092] Step 7: After the call session ends, the system of this invention receives the session end protocol signaling message. After analyzing the message content, compiling the meta-script, issuing instructions, etc., the system promptly closes the RTP traffic ports opened in this communication session to prevent attackers from launching UDP Flood attacks using these open ports.

[0093] After the above seven steps, the dynamic management firewall policy system of this embodiment can protect each step of cross-system communication. The dynamic management firewall policy system and the firewall work together to realize dynamic authorization access control of RTP traffic communication link channel, opening the RTP traffic port when the session is established and closing the RTP traffic port in a timely manner after the session ends.

[0094] For those skilled in the art, various corresponding changes and modifications can be made based on the above technical solutions and concepts, and all such changes and modifications should be included within the protection scope of the claims of this invention.

Claims

1. A system for dynamically managing firewall policies for real-time communication applications, characterized in that, It includes a user interface layer module, an access layer module, a service layer module, and a virtualization layer module; The interface layer module is used to present a visual operation interface to users. Through the visual operation interface, users can view the information of all firewalls managed by the system and the operating status of each firewall, configure network security zones, manage the IP addresses of different types of network devices in the network, and query the security policy information on each firewall. The access layer module is used to communicate with external clients, and it supports interaction with different external clients using multiple communication methods. The access layer module has a data collector and a data analyzer, which are used to collect and analyze bypass data packets, respectively. The access layer module also supports building request interfaces based on HTTPS or WEBSOCKETS protocols, receiving requests from various types of external clients, and parsing and responding to the requests. The service layer module is the core processing unit, used to provide communication link authorization access support for various real-time communication services, and supports preset rule management, data packet feature matching and security zone management; Preset rule management includes querying, adding, deleting, and modifying preset rules, as well as sending matching rule policies to the virtual firewall to execute policy control instructions; preset rules consist of two parts: feature conditions and rule policies. Packet feature matching is the process of comparing packet features with feature conditions in preset rules. If a packet feature successfully matches a feature condition, it is associated with a rule policy related to the matched feature condition. A rule policy consists of one or more virtual firewall policy control instructions. A virtual firewall policy control instruction consists of one or more of the following: virtual firewall ID, home policy group, policy ID, source IP address, source port number, source security domain, destination IP address, destination port number, destination security domain, protocol type, operation type, and policy validity period. Security zone management includes the configuration and management of security zones, supports querying, adding, deleting and modifying security zones, and sends them to network devices to perform corresponding operations; The virtualization layer module includes a virtual firewall management submodule, a firewall connection management submodule, and a firewall policy control instruction adaptation submodule; The virtual firewall management submodule is used to convert each firewall information into a virtual firewall mapping object, which can correspond to different types of firewalls; the virtual firewall management submodule provides a unified standard interface for virtual firewalls and their security policy management for the service layer module; The firewall connection management submodule is designed to be compatible with different firewall models, supports establishing secure SSH connections with different firewall models, and supports bidirectional interactive communication sessions with firewalls. The firewall policy control instruction adaptation submodule is used to convert the control policies defined in the metascript into specific firewall executable operation sequences.

2. The system according to claim 1, characterized in that, The access layer module is implemented using the Yate framework and the OAT++ framework.

3. The system according to claim 1, characterized in that, Feature conditions are used to match the features of data packets, including one or more of the following: source IP address, destination IP address, source port number, destination port number, protocol type, and message content.

4. The system according to claim 1, characterized in that, The single-level policy relationships between different upstream and downstream nodes form a list of rules and policies. The service layer module merges duplicate and invalid items based on these single-level policy relationships, and finally generates a set of virtual firewall policy control instructions.

5. The system according to claim 1, characterized in that, A virtual firewall mapping object consists of one or more of the following: a unique virtual firewall identifier, an IP range, a security zone, a security policy, a firewall connection handle, and firewall policy execution status information.

6. The system according to claim 1, characterized in that, The virtual firewall and its security policy management interface include a virtualization management interface for basic firewall information, IP information, security domains, security policies, policy groups, routing tables, and log information.

7. A method for dynamically managing firewall policies for real-time communication applications using the system described in any one of claims 1-6, characterized in that, Includes the following steps: Step 1: The access layer module acquires business data packets sent by external clients through the data collector, and uses the data analyzer to perform feature analysis on the business data packets to obtain data packet feature items, thereby completing the data packet capture and analysis. Step 2: After the access layer module completes the data packet capture and analysis, it sends the characteristics of the data packets to the service layer module. The service layer module performs real-time inspection of the data packets entering the network based on preset rules and performs feature matching on the characteristics of the data packets. Feature matching is based on configured preset rules. The service layer module compares the features of the data packets passed from the access layer module with the feature conditions of the preset rules one by one to determine whether they meet the feature conditions. If they do, the rule policy associated with the met feature conditions is retrieved and used. If multiple feature conditions are met at the same time during the feature matching process, all associated rule policies are combined and used. The service layer module merges and organizes the retrieved rule policies to generate a set of virtual firewall policy control instructions. Step 3: The service layer module calls the unified virtual firewall and its policy management interface of the virtualization layer module, and passes the set of virtual firewall policy control instructions to the virtualization layer module. The virtual firewall management submodule interprets each virtual firewall policy control instruction, and uses the source IP address, source port number, source security domain, target IP address, target port number, target security domain, protocol type, operation type, and policy validity period in the policy control instructions to generate a meta-script. The meta-script contains network security policies, ACL rules, and related configuration information. The firewall policy control instruction adaptation submodule queries the corresponding real firewall information based on the unique identifier of the virtual firewall in the policy control instruction, compiles the meta-script according to the target firewall model, generates policy configuration information suitable for the target firewall, uses the firewall connection management submodule to send the policy configuration information to the target firewall to execute the policy configuration operation, and feeds back the execution result to the virtual firewall management submodule.

8. The method according to claim 7, characterized in that, In step one, the data packet capture analysis uses a bypass traffic mirroring method to collect business data packets and extracts their characteristic items from the data packets, including one or more of the following: source IP address, destination IP address, source port number, destination port number, protocol type, and message content. A preliminary analysis is then performed on the application data in the message content to extract application layer protocol type characteristics and parse the application content information in the data packets according to the application protocol type.

9. The method according to claim 7, characterized in that, The process of compiling a meta-script is as follows: (1) Metascript parsing: The compiler parses all data items of the metascript and converts the abstract rules of the metascript into data format according to the command set syntax rules of the target firewall; (2) Configuration generation: After completing the meta-script parsing, a policy configuration file suitable for the target firewall is generated, which includes ACL rules, address translation rules and security policies, and then an executable operation sequence is generated.

Images