A method and device for forwarding virtual system messages in a firewall device
By creating core identifiers and packet identifiers for each core of the firewall device, the problem of resource waste when the firewall device processes multiple virtual systems is solved, and the CPU execution efficiency is improved.
Patent Information
- Application Number
- CN202411314313.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2025-01-07
- Estimated Expiration
- 2044-09-20
AI Technical Summary
Firewall devices waste system resources by traversing and checking all virtual ports when handling multiple virtual systems.
Create a core identifier and a packet identifier for each core in the firewall device. By setting the identifier, determine whether there are packets to be forwarded at the outer loop, and only process packets that are identified as pending forwarding.
It improves the CPU execution efficiency of firewall devices and avoids wasting system resources.
Smart Images
Figure CN118842725B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network communication, and in particular to a method and device for forwarding virtual system messages in a firewall device. Background Art
[0002] The firewall device supports the creation of multiple virtual systems. Traffic forwarding is supported between virtual systems. Each virtual system has a virtual interface for receiving messages sent to this virtual system by other virtual systems.
[0003] When the message of other virtual systems is to be handed over to virtual system A, it will first be put into the receiving queue of the virtual port corresponding to virtual system A. The system message processing task in the firewall device will cyclically check whether there are messages to be processed in the receiving queue of the virtual port of each virtual system. When there are many virtual systems in the firewall device, it will waste system resources when the system traverses and checks all virtual ports each time. Summary of the invention
[0004] In view of this, it is necessary to provide a method and apparatus for forwarding virtual system messages in a firewall device to solve the problem of wasting system resources when the system traverses and checks all virtual ports.
[0005] In order to solve the above problem, the present invention provides a method for forwarding virtual system messages in a firewall device, comprising:
[0006] Creating, for each core in the target firewall device, a core identifier for indicating whether there is a message to be forwarded in the core, and a message identifier for indicating whether there is a message to be forwarded in the virtual system;
[0007] When a message is sent to a target virtual system in a target core, the core identifier of the target core is modified to a first identifier used to indicate that there is a message to be forwarded in the core, and the message forwarding identifier of the target virtual system is modified to a second identifier used to indicate that there is a message to be forwarded in the target virtual system;
[0008] The message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier is forwarded.
[0009] In a possible implementation manner, the core identifier and the message identifier are in a one-to-many relationship, and the core identifier and the message identifier are stored in an array.
[0010] In a possible implementation, the method further includes:
[0011] When there are no messages to be processed in the receiving queues of the virtual ports of the virtual system in the target core, the core identifier corresponding to the target core is modified to a third identifier used to characterize that there are no messages to be forwarded in the core, and the state of the message identifier corresponding to the virtual system in the target core is modified to a fourth identifier used to characterize that there are no messages to be forwarded in the virtual system.
[0012] In a possible implementation, the method further includes:
[0013] When it is detected that the state of the core forwarding flag of the target core is the third flag, the message of the virtual port of the virtual system in the target core is not forwarded.
[0014] In a possible implementation, the method further includes:
[0015] When the message in the receiving queue of the virtual port of the target virtual system in the target core has been forwarded, the state of the message identifier corresponding to the target virtual system in the target core is changed to the fourth identifier;
[0016] It is determined whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier, where the other virtual systems are virtual systems in the target core excluding the target virtual system.
[0017] In a possible implementation manner, determining whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier includes:
[0018] After determining that the message forwarding identifiers of other virtual systems in the target core are all the fourth identifier, the core identifier corresponding to the target core is modified to the third identifier.
[0019] On the other hand, the present invention also provides a device for forwarding virtual system messages in a firewall device, comprising:
[0020] An identification creation module, used to create, for each core in the target firewall device, a core identification used to indicate whether there is a message to be forwarded in the core, and a message identification used to indicate whether there is a message to be forwarded in the virtual system;
[0021] An identification state modification module, used for, when a message is sent to a target virtual system in a target core, modifying the core identification of the target core to a first identification used to characterize that there is a message to be forwarded in the core, and modifying the message forwarding identification of the target virtual system to a second identification used to characterize that there is a message to be forwarded in the target virtual system;
[0022] The message forwarding module is used to forward the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier.
[0023] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein:
[0024] Memory, used to store programs;
[0025] The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the method for forwarding virtual system messages in a firewall device in any one of the above implementations.
[0026] On the other hand, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instruction, which, when executed by a processor, can implement the steps in a method for forwarding virtual system messages in a firewall device in any of the above-mentioned implementation modes.
[0027] The beneficial effect of the present invention is as follows: the method for forwarding a message of a virtual system in a firewall device provided by the present invention first creates a core identifier for each core in the target firewall device to characterize whether there is a message to be forwarded in the core, and a message identifier for characterizing whether there is a message to be forwarded in the virtual system, and sets the identifier in the outer layer of the loop before forwarding the message. When a message is sent to the target virtual system in the target core, the core identifier of the target core is modified to a first identifier for characterizing the presence of a message to be forwarded in the core, and the message forwarding identifier of the target virtual system is modified to a second identifier for characterizing the presence of a message to be forwarded in the target virtual system, thereby marking the message to be processed, and forwarding the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier. In summary, the present invention sets the identifier so that when the system in the firewall device processes the message of the virtual system, it first determines whether there is a message to be processed according to the identifier, and only processes the message when there is a message to be processed, thereby avoiding the waste of system resources in the firewall device and improving the execution efficiency of the CPU of the firewall device. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1 A flowchart of an embodiment of a method for forwarding a virtual system message in a firewall device provided by the present invention;
[0029] Figure 2 This is a schematic diagram of the correspondence between the core identifier and the message identifier of the present invention;
[0030] Figure 3 A schematic structural diagram of an embodiment of a virtual system message forwarding device in a firewall device provided by the present invention;
[0031] Figure 4 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION
[0032] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.
[0033] Before presenting the embodiments, the following terms are explained.
[0034] A firewall device is a network security device that monitors and controls network flows to protect the network from unauthorized access, attacks, and malware.
[0035] Virtualization is a computer technology that allows the creation of multiple virtual logical computing environments on a single physical computer. Through virtualization, a physical computer can be divided into multiple independent virtual machines, each of which can run its own operating system and applications.
[0036] A virtual interface is a logical interface for forwarding messages between virtual systems. A virtual system has only one virtual interface. Physical interfaces can only be connected one-to-one. Unlike physical interfaces, virtual interfaces can be connected one-to-many.
[0037] The present invention provides a method and device for forwarding virtual system messages in a firewall device, which are respectively described below.
[0038] Figure 1 A flowchart of an embodiment of a method for forwarding a virtual system message in a firewall device provided by the present invention is shown as follows: Figure 1 As shown, the method for forwarding virtual system messages in a firewall device includes:
[0039] S101, creating, for each core in the target firewall device, a core identifier for indicating whether there is a message to be forwarded in the core, and a message identifier for indicating whether there is a message to be forwarded in the virtual system;
[0040] S102, when a message is sent to a target virtual system in a target core, modifying the core identifier of the target core to a first identifier used to indicate that there is a message to be forwarded in the core, and modifying the message forwarding identifier of the target virtual system to a second identifier used to indicate that there is a message to be forwarded in the target virtual system;
[0041] S103: Forward the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier.
[0042] Compared with the prior art, the present embodiment provides a method for forwarding a virtual system message in a firewall device, which first creates a core identifier for each core in the target firewall device to characterize whether there is a message to be forwarded in the core, and a message identifier for characterizing whether there is a message to be forwarded in the virtual system, and sets the identifier in the outer layer of the loop before forwarding the message. When a message is sent to the target virtual system in the target core, the core identifier of the target core is modified to a first identifier for characterizing the presence of a message to be forwarded in the core, and the message forwarding identifier of the target virtual system is modified to a second identifier for characterizing the presence of a message to be forwarded in the target virtual system, thereby marking the message to be processed, and forwarding the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier. In summary, the present invention sets the identifier so that when the system in the firewall device processes the message of the virtual system, it first determines whether there is a message to be processed according to the identifier, and only processes the message when there is a message to be processed, thereby avoiding the waste of system resources in the firewall device and improving the execution efficiency of the CPU of the firewall device.
[0043] In some embodiments of the present invention, the core identifier and the message identifier are in a one-to-many relationship, and the core identifier and the message identifier are stored in an array.
[0044] In a specific embodiment of the present invention, a memory is created for each core in the target firewall device. The memory is used to store an identification array. The identification array includes whether the target core needs a forwarding identification, i.e., a core identification, and a bit map allocated according to the number of virtual systems. The bit map stores the message forwarding identification corresponding to the virtual system, i.e., the message identification, in the form of an array. The number of bits in the bit map corresponds to the number of virtual systems, i.e., one virtual system corresponds to one bit, which means that the identification array is a multidimensional array. In this embodiment, the identification array is a two-dimensional array. The initial state core forwarding identification is 0, indicating that forwarding is not required. The message forwarding identifications in the initial state bit map are all 0, indicating that there are no messages that need to be forwarded. Figure 2 As shown, for example, the first line of core 0 is represented by forward, which is used to mark whether the forwarding core needs to forward. The second line of core 0 is the corresponding bitmap, and each bit marks whether the virtual system with the corresponding index has a message to be forwarded. The definition of the identification array is as follows:
[0045] Struct vsys_forward{
[0046] intforward; / / Whether the current core is forwarding mark
[0047] u32* forward_map; / / vsys bit bitmap, when the specification is 1000, it points to a 1024-bit memory
[0048] }
[0049] In a specific implementation of the present invention, in step S102, when a message is to be sent to a virtual port, a bitmap corresponding to the virtual system is set according to the current forwarding core id and the virtual system id, and a forwarding mark of the current core is set at the same time;
[0050] If there is a message to be processed in forwarding core 1 of virtual system 8, the corresponding bit map will be set. The setting method is as follows:
[0051] pos = vsys_id / 32;
[0052] offset = vsys_id % 32;
[0053] g_vsys_forward[core_id]->forward_map[pos] |= (1< <offset);
[0054] g_vsys_forward[core_id]->forward = 1;
[0055] In some embodiments of the present invention, it further includes:
[0056] When there are no messages to be processed in the receiving queues of the virtual ports of the virtual system in the target core, the core identifier corresponding to the target core is modified to a third identifier used to characterize that there are no messages to be forwarded in the core, and the state of the message identifier corresponding to the virtual system in the target core is modified to a fourth identifier used to characterize that there are no messages to be forwarded in the virtual system.
[0057] In a specific embodiment of the present invention, the first flag indicates that there are unforwarded messages in the virtual system in the core, the second flag indicates that there are unforwarded messages, the third flag indicates that there are no unforwarded messages in the virtual system in the core, and the fourth flag indicates that there are no unforwarded messages. The first flag, i.e., forward, is 1, and the third flag, i.e., forward, is 0.
[0058] In some embodiments of the present invention, it further includes:
[0059] When it is detected that the state of the core forwarding flag of the target core is the third flag, the message of the virtual port of the virtual system in the target core is not forwarded.
[0060] It can be understood that when the state of the core forwarding identifier in the identifier array is the third identifier, that is, forward is 0, that is, there are no pending messages in the virtual queues of all virtual systems under the core, then when the message processing task checks that the forward of the core is 0, the next core can be checked, thereby avoiding checking the virtual port of each virtual system in the core, thereby improving the execution efficiency of the CPU of the target firewall device.
[0061] In some embodiments of the present invention, it further includes:
[0062] When the message in the receiving queue of the virtual port of the target virtual system in the target core has been forwarded, the state of the message identifier corresponding to the target virtual system in the target core is changed to the fourth identifier;
[0063] It is determined whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier, where the other virtual systems are virtual systems in the target core excluding the target virtual system.
[0064] It can be understood that when the message of the virtual port of the virtual system in the core has been processed, the status of the message identifier of the virtual system in the corresponding bit map will be modified to a state that does not require forwarding, so that when the message processing task loops through the core and detects that the bit in the bit map of the virtual system is 0, that is, the fourth forwarding state, it will directly exit the loop and check the virtual port of the next virtual system in the core.
[0065] In a specific embodiment of the present invention, when the forwarding core message processing task detects that the forwarding mark of the current core is set, it will enter the forwarding process, obtain the virtual port packet sending queue of the corresponding virtual system through the bit map of the virtual system, and process a certain number of messages to be sent. This task is executed cyclically. Figure 2 As shown, if forwarding core 1 detects that g_vsys_forward[1]->forward is 1, the forwarding task is executed, and in the forwarding task, the to-be-processed message in the virtual interface of the virtual system with the corresponding index can be processed according to the bit that is 1 in g_vsys_forward[1]->forward_map.
[0066] In some embodiments of the present invention, determining whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier includes:
[0067] After determining that the message forwarding identifiers of other virtual systems in the target core are all the fourth identifier, the core identifier corresponding to the target core is modified to the third identifier.
[0068] In a specific embodiment of the present invention, when the packet sending queue of a certain virtual system is empty, the bit on the bitmap of the corresponding virtual system is cleared according to the forwarding core ID and the virtual system ID. At the same time, it is checked whether the current forwarding core bitmap is all 0. If all are 0, the forwarding mark of the current forwarding core is cleared synchronously.
[0069] If the number of pending packets processed by the virtual port of forwarding core 1 is empty, the corresponding bit in g_vsys_forward[1]->forward_map is set to 0. At the same time, check whether all bits in g_vsys_forward[1]->forward_map are 0. If so, set g_vsys_forward[1]->forward to 0 synchronously.
[0070] When the forwarding core message processing task detects that the forwarding mark of the core is cleared, the message forwarding will not be started. When a new message is sent to the virtual port of the virtual system, the mark is reset to start the forwarding task.
[0071] In order to better implement a method for forwarding a virtual system message in a firewall device in an embodiment of the present invention, based on a method for forwarding a virtual system message in a firewall device, correspondingly, as follows Figure 3 As shown, an embodiment of the present invention further provides a device for forwarding a virtual system message in a firewall device. A device 300 for forwarding a virtual system message in a firewall device includes:
[0072] The identification creation module 301 is used to create, for each core in the target firewall device, a core identification used to indicate whether there is a message to be forwarded in the core, and a message identification used to indicate whether there is a message to be forwarded in the virtual system;
[0073] The identification state modification module 302 is used to modify the core identification of the target core to a first identification used to indicate that there is a message to be forwarded in the core, and modify the message forwarding identification of the target virtual system to a second identification used to indicate that there is a message to be forwarded in the target virtual system when a message is sent to the target virtual system in the target core;
[0074] The message forwarding module 303 is used to forward the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier.
[0075] The apparatus 300 for forwarding a virtual system message in a firewall device provided in the above embodiment can implement the technical solution described in the above embodiment of a method for forwarding a virtual system message in a firewall device. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above embodiment of a method for forwarding a virtual system message in a firewall device, which will not be repeated here.
[0076] like Figure 4 As shown, the present invention also provides an electronic device 400. The electronic device 400 includes a processor 401, a memory 402 and a display 403. Figure 4 Only some components of the electronic device 400 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.
[0077] In some embodiments, the processor 401 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 402, such as a method for forwarding virtual system messages in a firewall device in the present invention.
[0078] In some embodiments, processor 401 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, processor 401 may be local or remote. In some embodiments, processor 401 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.
[0079] In some embodiments, the memory 402 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. In other embodiments, the memory 402 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 400.
[0080] Furthermore, the memory 402 may include both an internal storage unit of the electronic device 400 and an external storage device. The memory 402 is used to store application software installed in the electronic device 400 and various data.
[0081] In some embodiments, the display 403 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 403 is used to display information on the electronic device 400 and to display a visual user interface. The components 401-403 of the electronic device 400 communicate with each other via a system bus.
[0082] In one embodiment, when the processor 401 executes a program for forwarding virtual system messages in a firewall device in the memory 402, the following steps may be implemented:
[0083] Creating an identification array for each core in the target firewall device, the identification array including a core forwarding identification and a message forwarding identification of a virtual system in the core;
[0084] When a message is sent to a virtual port of a target virtual system in a target core, the state of a core forwarding identifier in a target identifier array corresponding to the target core is modified to a first forwarding state, and the message forwarding identifier of the target virtual system in the target identifier array is modified to a second forwarding state;
[0085] The message of the virtual system virtual port whose core forwarding identifier in the identifier array is in the first forwarding state and whose message forwarding identifier is in the second state is forwarded.
[0086] The present invention sets an identification array, sets a bit map of a virtual system in the identification array, and then loops the outermost layer to know whether it is necessary to enter a forwarding task, thereby improving the execution efficiency of the CPU.
[0087] It should be understood that: when the processor 401 executes a program for forwarding virtual system messages in a firewall device in the memory 402, in addition to the above functions, other functions may also be implemented. For details, please refer to the description of the corresponding method embodiment above.
[0088] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 400 mentioned, and the electronic device 400 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 400 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).
[0089] Those skilled in the art can understand that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.
[0090] The above are only preferred specific implementations of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.
Claims
1. A method for forwarding virtual system messages in a firewall device, characterized in that: include: Creating, for each core in the target firewall device, a core identifier for indicating whether there is a message to be forwarded in the core, and a message identifier for indicating whether there is a message to be forwarded in the virtual system, wherein the core identifier and the message identifier are in a one-to-many relationship, and the core identifier and the message identifier are stored in an array; When a message is sent to a target virtual system in a target core, the core identifier of the target core is modified to a first identifier used to indicate that there is a message to be forwarded in the core, and the message forwarding identifier of the target virtual system is modified to a second identifier used to indicate that there is a message to be forwarded in the target virtual system; The message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier is forwarded.
2. The method for forwarding virtual system messages in a firewall device according to claim 1, characterized in that: Also includes: When there are no messages to be processed in the receiving queues of the virtual ports of the virtual system in the target core, the core identifier corresponding to the target core is modified to a third identifier used to characterize that there are no messages to be forwarded in the core, and the state of the message identifier corresponding to the virtual system in the target core is modified to a fourth identifier used to characterize that there are no messages to be forwarded in the virtual system.
3. The method for forwarding virtual system messages in a firewall device according to claim 2, characterized in that: Also includes: When it is detected that the state of the core forwarding flag of the target core is the third flag, the message of the virtual port of the virtual system in the target core is not forwarded.
4. The method for forwarding virtual system messages in a firewall device according to claim 2, characterized in that: Also includes: When the message in the receiving queue of the virtual port of the target virtual system in the target core has been forwarded, the state of the message identifier corresponding to the target virtual system in the target core is changed to a fourth identifier; It is determined whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier, where the other virtual systems are virtual systems in the target core excluding the target virtual system.
5. The method for forwarding virtual system messages in a firewall device according to claim 4, characterized in that: Determining whether the message forwarding identifier of other virtual systems in the target core is the fourth identifier includes: After determining that the message forwarding identifiers of other virtual systems in the target core are all the fourth identifier, the core identifier corresponding to the target core is modified to the third identifier.
6. A device for forwarding virtual system messages in a firewall device, characterized in that: include: an identification creation module, used to create, for each core in the target firewall device, a core identification used to indicate whether there is a message to be forwarded in the core, and a message identification used to indicate whether there is a message to be forwarded in the virtual system, wherein the core identification and the message identification are in a one-to-many relationship, and the core identification and the message identification are stored in an array; An identification state modification module, used for, when a message is sent to a target virtual system in a target core, modifying the core identification of the target core to a first identification used to characterize that there is a message to be forwarded in the core, and modifying the message forwarding identification of the target virtual system to a second identification used to characterize that there is a message to be forwarded in the target virtual system; The message forwarding module is used to forward the message in the virtual system whose core identifier is the first identifier and whose message identifier is the second identifier.
7. An electronic device, characterized in that: comprising a memory and a processor, wherein: Memory, used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the method for forwarding virtual system messages in a firewall device according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that: Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps in the method for forwarding virtual system messages in a firewall device of any one of claims 1 to 5 above.
Citation Information
Patent Citations
Cross-firewall message fast forwarding method and device
CN107483341A
Message statistics method and device
CN109962861A