A method and system for querying firewall rules based on a cuckoo filter

Abstract

This invention discloses a firewall rule query method based on a cuckoo filter, comprising the following steps: S1, firewall fingerprint collection; S2, firewall fingerprint comparison; S3, firewall fingerprint storage; S4, firewall fingerprint retrieval; S5, information parsing and comparison. This invention, by constructing firewall fingerprints using a novel cuckoo filter-based approach, achieves high-performance query capabilities. Furthermore, the fingerprints can be stored in minimal quantities, are reusable, and load quickly, enabling rapid statistical analysis of security rule coverage for millions of hosts in firewall management.

Description

Technical Field

[0001] This invention relates to the technical field of edge computing, and in particular to a firewall rule query method and system based on a cuckoo filter. Background Technology

[0002] In the field of edge computing, the operation and maintenance system manages tens of thousands of edge servers. Each edge server has its own firewall rules. As the number of servers grows rapidly over time, how to quickly and conveniently perform a security rule overlay query on the firewall rules of tens of thousands of edge servers, or compare the existing firewall rule files to find the firewall rules that need to be added, has become a troublesome and unavoidable problem that the operation and maintenance system needs to face.

[0003] However, the current situation and existing technology are that edge servers each have their own firewall rules locally. If the central service wants to view detailed firewall rules and check whether a certain rule exists in the firewall rule file, it can only download and pull a large number of firewall rule files from the edge to the central service for parsing, querying, and comparison.

[0004] However, the existing firewall rule query methods described above all have intractable flaws and shortcomings: First, edge servers are located at the edge nodes of the network, far from the central service, resulting in generally poor network communication quality. Retrieving a large number of firewall rule files from the edge is a very time-consuming operation and degrades overall service performance. Second, the central service needs to parse a huge number of firewall rule files to extract the rule records before querying and comparing them. While the processing speed is acceptable for small numbers, it becomes slow at larger numbers, leading to interface timeouts, long user wait times, and a poor user experience. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide a firewall rule query method based on a cuckoo filter, comprising the following steps:

[0008] S1. Firewall fingerprinting: Construct a cuckoo filter to collect data from firewall rule files;

[0009] S2. Firewall fingerprint comparison: The central service receives the message and performs integrity verification on the firewall fingerprint. If the verification fails, it does not return a confirmation command and requires the firewall rules to be collected again.

[0010] S3. Firewall fingerprint storage: The central service associates the firewall fingerprint data with the corresponding edge server, saves it as a firewall fingerprint record to non-volatile storage and builds an index file.

[0011] S4. Firewall fingerprint retrieval: When the central service needs to perform coverage statistics on the security rules of all edge servers, it first retrieves the firewall fingerprint records of all servers from the non-volatile storage.

[0012] S5. Information parsing and comparison: The security rules are parsed to calculate the fingerprint and slot position. The fingerprint and slot position are compared with the firewall fingerprints of all servers in parallel. If they exist, the counter is incremented by 1 until all records are compared. The coverage rate of the security rules is then calculated.

[0013] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, in step S1, the collection of firewall rules is achieved by the edge management machine's agent notifying the edge server of the firewall rule configuration change operation to collect the firewall rule file of the edge server to obtain the firewall fingerprint.

[0014] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, the construction of the cuckoo filter specifically includes the following steps:

[0015] S1.1 Calculate the slot array d according to the number of records c in the rule, and request a slot array with a capacity of d;

[0016] S1.2 Parse the firewall rule file, split and clean up non-critical information to obtain N-tuple information;

[0017] S1.3 Serialize the N-tuple information into a string s, obtain a 64-bit hash value h1 using the MurMurHash3 tool, perform a modulo operation on h1 to obtain the fingerprint f, and perform an AND operation on the high 32 bits of the hash value of h1 to obtain the slot position i1.

[0018] S1.4. Locate the corresponding slot based on the slot position. If the slot space is not full, compare the fingerprints stored in the slots one by one until a usable storage location is found.

[0019] S1.5 If no storage location is found in the slot, remove an element from the end of the slot, and obtain a 64-bit hash value h2 from the fingerprint f of the element using the MurMurHash3 tool. Take the high 32 bits of the hash value of h2 and perform AND and XOR operations to obtain the slot position i2, and then repeat S1.4.

[0020] S1.6 Repeat steps (1-2) to (1-5) until all firewall rule records are stored in the slot array;

[0021] S1.7 Write the slot array into the byte array in big-endian order to obtain the firewall fingerprint data.

[0022] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, wherein: the slot array d in S1.1 is specifically calculated as follows: d is the smallest power of 2 greater than or equal to c.

[0023] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, each slot in S1.1 can accommodate 10 16-bit firewall fingerprints.

[0024] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, the N-tuple information in S1.2 includes rule type identifier element, table type identifier element, source address identifier element, source port identifier element, destination address identifier element, destination port identifier element, protocol type identifier element, and action identifier element.

[0025] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, in step S1.7, the firewall fingerprint is processed by a message digest algorithm to obtain a fingerprint digest to ensure data integrity, and the message digest is written into the header of the firewall fingerprint data to finally obtain the firewall fingerprint.

[0026] As a preferred embodiment of the firewall rule query method based on the cuckoo filter described in this invention, wherein: the integrity verification of the firewall fingerprint in S2 is performed by comparing the firewall fingerprint data after message digesting with the firewall fingerprint digest.

[0027] Secondly, embodiments of the present invention provide a firewall rule query system based on a cuckoo filter, specifically including:

[0028] Central Management Module: Responsible for overall planning, management, and storage of data;

[0029] Edge proxy module: responsible for collecting, parsing, and reporting firewall fingerprints;

[0030] Firewall fingerprint module: responsible for querying, counting, and compressing fingerprints.

[0031] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the firewall rule query method based on the cuckoo filter described in the first aspect.

[0032] The beneficial effects of this invention are:

[0033] 1. A novel method for constructing firewall fingerprints based on the Cuckoo Filter is adopted, which enables high-performance query capabilities, and the fingerprints can be stored in a minimal amount of space, reused, and loaded quickly. In firewall management, the coverage of security rules for millions of hosts can be quickly calculated.

[0034] 2. By associating firewall fingerprints, which occupy very little space, with other feature attributes as records, saving them to non-volatile storage, and building an index file with other features, we can improve the speed of retrieval and reduce network transmission bandwidth. This allows us to avoid repeatedly fetching specific firewall rule files for operations, thus reducing waiting time.

[0035] 3. Improved the ability to incrementally update firewall rules. This includes applications such as detecting whether a host already contains a certain rule, detecting duplicate task distributions, and incremental update filtering. Attached Figure Description

[0036] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0037] Figure 1 This is a flowchart of a firewall rule query method based on a cuckoo filter proposed in this invention;

[0038] Figure 2 for Figure 1 An architecture diagram of a firewall rule query system based on the Cuckoo Filter. Detailed Implementation

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0040] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0041] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0042] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0043] Reference Figure 1-2 This invention provides a firewall rule query method based on a cuckoo filter, comprising the following steps:

[0044] S1. Firewall fingerprinting: Construct a cuckoo filter to collect data from firewall rule files;

[0045] S2. Firewall fingerprint comparison: The central service receives the message and performs integrity verification on the firewall fingerprint. If the verification fails, it does not return a confirmation command and requires the firewall rules to be collected again.

[0046] S3. Firewall fingerprint storage: The central service associates the firewall fingerprint data with the corresponding edge server, saves it as a firewall fingerprint record to non-volatile storage and builds an index file.

[0047] S4. Firewall fingerprint retrieval: When the central service needs to perform coverage statistics on the security rules of all edge servers, it first retrieves the firewall fingerprint records of all servers from the non-volatile storage.

[0048] S5. Information parsing and comparison: The security rules are parsed to calculate the fingerprint and slot position. The fingerprint and slot position are compared with the firewall fingerprints of all servers in parallel. If they exist, the counter is incremented by 1 until all records are compared. The coverage rate of the security rules is then calculated.

[0049] In S1, the collection of firewall rules involves the edge management machine's agent notifying the edge server of any changes to the firewall rule configuration to collect the firewall rule file of that edge server and obtain the firewall fingerprint.

[0050] Furthermore, the construction of the cuckoo filter specifically includes the following steps:

[0051] S1.1 Calculate the slot array d according to the number of records c in the rule, and request a slot array with a capacity of d;

[0052] S1.2 Parse the firewall rule file, split and clean up non-critical information to obtain N-tuple information;

[0053] S1.3 Serialize the N-tuple information into a string s, obtain a 64-bit hash value h1 using the MurMurHash3 tool, perform a modulo operation on h1 to obtain the fingerprint f, and perform an AND operation on the high 32 bits of the hash value of h1 to obtain the slot position i1.

[0054] S1.4. Locate the corresponding slot based on the slot position. If the slot space is not full, compare the fingerprints stored in the slots one by one until a usable storage location is found.

[0055] S1.5 If no storage location is found in the slot, remove an element from the end of the slot, and obtain a 64-bit hash value h2 from the fingerprint f of the element using the MurMurHash3 tool. Take the high 32 bits of the hash value of h2 and perform AND and XOR operations to obtain the slot position i2, and then repeat S1.4.

[0056] S1.6 Repeat steps (1-2) to (1-5) until all firewall rule records are stored in the slot array;

[0057] S1.7 Write the slot array into the byte array in big-endian order to obtain the firewall fingerprint data.

[0058] Furthermore, in S1.1, the specific calculation method for the slot array d is that d is the smallest power of 2 greater than or equal to c, and the slot array d is calculated quickly.

[0059] Furthermore, each slot in S1.1 can accommodate 10 16-bit firewall fingerprints, increasing the number of slots that can be accommodated.

[0060] Furthermore, the N-tuple information in S1.2 includes rule type identifier element, table type identifier element, source address identifier element, source port identifier element, destination address identifier element, destination port identifier element, protocol type identifier element, and action identifier element.

[0061] Furthermore, in S1.7, the firewall fingerprint is processed using a message digest algorithm to obtain a fingerprint digest to ensure data integrity. The message digest is written into the header of the firewall fingerprint data, and finally the firewall fingerprint is obtained, thus ensuring data integrity.

[0062] Furthermore, in S2, the integrity verification of the firewall fingerprint is performed by comparing the firewall fingerprint data with the firewall fingerprint digest after the firewall fingerprint data is digested, thus ensuring the accuracy of the verification.

[0063] This embodiment also provides a firewall rule query system based on the cuckoo filter, specifically including:

[0064] Central Management Module: Responsible for overall planning, management, and storage of data;

[0065] Edge proxy module: responsible for collecting, parsing, and reporting firewall fingerprints;

[0066] Firewall fingerprint module: Responsible for querying, analyzing, and compressing fingerprints.

[0067] This embodiment also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements a firewall rule query method based on a cuckoo filter as proposed in the above embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0068] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A firewall rule query method based on a cuckoo filter, characterized in that: Includes the following steps: S1. Firewall fingerprinting: Construct a cuckoo filter to collect data from firewall rule files; S2. Firewall fingerprint comparison: The central service receives the message and performs integrity verification on the firewall fingerprint. If the verification fails, it does not return a confirmation command and requires the firewall rules to be collected again. S3. Firewall fingerprint storage: The central service associates the firewall fingerprint data with the corresponding edge server, saves it as a firewall fingerprint record to non-volatile storage and builds an index file. S4. Firewall fingerprint retrieval: When the central service needs to perform coverage statistics on the security rules of all edge servers, it first retrieves the firewall fingerprint records of all servers from the non-volatile storage. S5. Information parsing and comparison: The security rules are parsed to calculate the fingerprint and slot position. The fingerprint and slot position are compared with the firewall fingerprints of all servers in parallel. If they exist, the counter is incremented by 1 until all records are compared. The coverage rate of the security rules is then calculated.

2. The firewall rule query method based on the cuckoo filter according to claim 1, characterized in that: In S1, the collection of firewall rules involves the edge server that has undergone a change in its firewall rule configuration notifying the agent of the edge management machine to collect the firewall rule file of that edge server to obtain the firewall fingerprint.

3. The firewall rule query method based on the cuckoo filter according to claim 2, characterized in that: The construction of the cuckoo filter specifically includes the following steps: S1.1 Calculate the slot array d according to the number of records c in the rule, and request a slot array with a capacity of d; S1.2 Parse the firewall rule file, split and clean up non-critical information to obtain N-tuple information; S1.3 Serialize the N-tuple information into a string s, obtain a 64-bit hash value h1 using the MurMurHash3 tool, perform a modulo operation on h1 to obtain the fingerprint f, and perform an AND operation on the high 32 bits of the hash value of h1 to obtain the slot position i1. S1.

4. Locate the corresponding slot based on the slot position. If the slot space is not full, compare the fingerprints stored in the slots one by one until a usable storage location is found. S1.5 If no storage location is found in the slot, remove an element from the end of the slot, and obtain a 64-bit hash value h2 from the fingerprint f of the element using the MurMurHash3 tool. Take the high 32 bits of the hash value of h2 and perform AND and XOR operations to obtain the slot position i2, and then repeat S1.

4. S1.6 Repeat steps (1.2) to (1.5) until all firewall rule records are stored in the slot array; S1.7 Write the slot array into the byte array in big-endian order to obtain the firewall fingerprint data.

4. The firewall rule query method based on the cuckoo filter according to claim 3, characterized in that: The specific calculation method for the slot array d in S1.1 is that d is the smallest power of 2 greater than or equal to c.

5. A firewall rule query method based on a cuckoo filter according to claim 4, characterized in that: Each slot in S1.1 can accommodate 10 16-bit firewall fingerprints.

6. The firewall rule query method based on the cuckoo filter according to claim 5, characterized in that: The N-tuple information in S1.2 includes rule type identifier element, table type identifier element, source address identifier element, source port identifier element, destination address identifier element, destination port identifier element, protocol type identifier element, and action identifier element.

7. A firewall rule query method based on a cuckoo filter according to claim 6, characterized in that: In step S1.7, the firewall fingerprint is processed using a message digest algorithm to obtain a fingerprint digest to ensure data integrity. The message digest is then written into the header of the firewall fingerprint data to finally obtain the firewall fingerprint.

8. A firewall rule query method based on a cuckoo filter according to claim 7, characterized in that: In step S2, the integrity verification of the firewall fingerprint is performed by comparing the firewall fingerprint data with the firewall fingerprint digest after the firewall fingerprint data has been digested.

9. A firewall rule query system based on a cuckoo filter, as described in any one of claims 1-8, characterized in that: Specifically, it includes: Central Management Module: Responsible for overall planning, management, and storage of data; Edge proxy module: responsible for collecting, parsing, and reporting firewall fingerprints; Firewall fingerprint module: responsible for querying, counting, and compressing fingerprints.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the firewall rule query method based on the cuckoo filter as described in any one of claims 1-8.

Images