Strategy management methods, electronic devices, readable media, and program products

Abstract

This disclosure provides a policy management method, comprising: calculating the hash value of the policy ID of a reverse proxy policy; storing the policy information of the reverse proxy policy in the ID policy node of an ID hash table using the hash value of the policy ID as the key; calculating the hash value of the IP address corresponding to the reverse proxy policy; storing the pointer of the ID policy node in the IP policy node of an IP hash table using the hash value of the IP address as the key; when a data packet is received, calculating the hash value of the IP address of the data packet; matching the IP policy node in the IP hash table using the hash value of the IP address of the data packet as the key; and matching the ID policy node in the ID hash table according to the pointer of the ID policy node stored in the matched IP policy node. This disclosure also provides an electronic device, a computer-readable medium, and a computer program product. This disclosure improves the efficiency of reverse proxy policy matching and is beneficial for improving the performance of access control based on reverse proxy technology.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a policy management method, an electronic device, a computer-readable medium, and a computer program product. Background Technology

[0002] A reverse proxy is a proxy server that accepts connection requests from clients on the Internet, forwards the connection requests to servers on the internal network, and returns the results from the servers to the requesting clients via the Internet. In this case, the proxy server appears to the outside world as a reverse proxy server.

[0003] Network security devices based on reverse proxy technology must provide security for servers. Furthermore, to improve applicability, these devices need to support range-based reverse proxying. A range IP typically refers to a range of IP addresses, consisting of a series of consecutive IP addresses within the network. When performing range-based reverse proxying, the network security device's access control function needs to match the IP address of the data packet with the range IP corresponding to the reverse proxy policy. If a match is found, the data packet is allowed to continue transmission; otherwise, transmission is blocked.

[0004] However, performing reverse proxy matching based on range IPs may lead to a decrease in the performance of network security checks. Summary of the Invention

[0005] This disclosure provides a strategy management method, an electronic device, a computer-readable medium, and a computer program product.

[0006] In a first aspect, embodiments of this disclosure provide a policy management method, comprising: calculating the hash value of a policy ID of a reverse proxy policy, and storing the policy information of the reverse proxy policy in an ID policy node of an ID hash table using the hash value of the policy ID as the key; calculating the hash value of the IP corresponding to the reverse proxy policy, and storing the pointer of the ID policy node in an IP policy node of an IP hash table using the hash value of the IP as the key; when a data packet is received, calculating the hash value of the IP of the data packet, and matching an IP policy node in the IP hash table using the hash value of the IP of the data packet as the key; and matching an ID policy node in the ID hash table according to the pointer of the ID policy node stored in the matched IP policy node.

[0007] In some embodiments, calculating the hash value of the IP corresponding to the reverse proxy policy and storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key includes: when the IP corresponding to the reverse proxy policy is a non-range IP, calculating the hash value of the non-range IP and storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the non-range IP as the key; when the IP corresponding to the reverse proxy policy is a range IP, calculating the hash value of each IP within the range IP and storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of each IP within the range IP as the key.

[0008] In some embodiments, storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key includes: adding a single policy identifier to the IP policy node when the IP corresponding to the reverse proxy policy is a non-range IP; and adding a primary policy identifier to the IP policy node corresponding to the first IP within the range IP when the IP corresponding to the reverse proxy policy is a range IP, and adding a secondary policy identifier to the IP policy node corresponding to the non-first IP within the range IP.

[0009] In some embodiments, after storing the pointer of the ID policy node in the IP policy node of the IP hash table with the hash value of the IP as the key, the method further includes: linking the pointer of the IP policy node to the corresponding ID policy node.

[0010] In some embodiments, linking the pointer of the IP policy node to the corresponding ID policy node includes: when the IP corresponding to the reverse proxy policy is a range IP, using a linked list to store the pointers of the IP policy nodes corresponding to each IP within the range IP.

[0011] In some embodiments, the policy management method further includes: in response to an instruction to delete a reverse proxy policy, searching for the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table according to the policy ID of the reverse proxy policy to be deleted; deleting the IP policy node corresponding to the reverse proxy policy to be deleted in the IP hash table according to the pointer of the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be deleted; and deleting the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table.

[0012] In some embodiments, the policy management method further includes: in response to an instruction to modify a reverse proxy policy, searching the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table according to the policy ID of the reverse proxy policy to be modified; deleting the IP policy node corresponding to the reverse proxy policy to be modified in the IP hash table according to the pointer of the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be modified; deleting the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table; and adding the modified reverse proxy policy.

[0013] In some embodiments, matching an ID policy node in the ID hash table according to a pointer to an ID policy node stored in the matched IP policy node includes: matching an ID policy node in the ID hash table according to a pointer to an ID policy node stored in the matched IP policy node; matching the IP address and port of the data packet with policy information stored in the matched ID policy node; performing a reverse proxy according to the matched policy information if both the IP address and port of the data packet match successfully; and blocking the data packet if at least one of the IP address and port of the data packet fails to match the matched policy information.

[0014] In some embodiments, the policy management method further includes: matching an IP policy node in the IP hash table using the hash value of the IP address of the data packet as the key; and blocking the data packet if no IP policy node is matched.

[0015] In a second aspect, embodiments of this disclosure provide an electronic device, including: one or more processors; and a memory storing one or more programs thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the policy management method described in the first aspect of this disclosure.

[0016] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the policy management method described in the first aspect of embodiments of this disclosure.

[0017] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the policy management method described in the first aspect of this disclosure.

[0018] In this embodiment of the disclosure, the reverse proxy policy is stored in an ID hash table and an IP hash table, and non-range IP policies and range IP policies are managed in a unified manner. Matching is performed based on hash values ​​in the hash table, which can improve matching efficiency and is beneficial to improving the access control performance and network security inspection performance of network security devices based on reverse proxies. Attached Figure Description

[0019] Figure 1 This is a flowchart of a strategy management method according to an embodiment of this disclosure;

[0020] Figure 2 This is a schematic diagram of the composition of an electronic device according to an embodiment of this disclosure. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions of this disclosure will be described in detail below with reference to the accompanying drawings.

[0022] Exemplary embodiments will be described more fully below with reference to the accompanying drawings; however, these exemplary embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will enable those skilled in the art to fully understand the scope of this disclosure.

[0023] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0024] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded.

[0026] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0027] In a range-IP-based reverse proxy environment, range IPs and non-range IPs are typically managed separately. For range IPs, each IP policy within the range needs to be stored in a linked list. When matching policies, the IP address of the data packet is compared with each IP policy in the linked list. If an IP policy matching the data packet's IP address is found, the matching is successful and the matching process terminates; otherwise, the matching fails. However, when network security devices provide security services to a large number of service systems, many range IP policies need to be configured. Using linked list technology for policy matching can lead to a decrease in security check performance.

[0028] In view of this, firstly, referring to Figure 1 This disclosure provides a strategy management method, including:

[0029] S1. Calculate the hash value of the policy ID of the reverse proxy policy, and store the policy information of the reverse proxy policy in the ID policy node of the ID hash table using the hash value of the policy ID as the key.

[0030] S2. Calculate the hash value of the IP corresponding to the reverse proxy policy, and store the pointer of the ID policy node in the IP policy node of the IP hash table with the hash value of the IP as the key;

[0031] S3. When a data packet is received, calculate the hash value of the IP address of the data packet, and use the hash value of the IP address of the data packet as the key to match the IP policy node in the IP hash table;

[0032] S4. Match the ID policy node in the ID hash table according to the pointer of the ID policy node stored in the matched IP policy node.

[0033] In this embodiment of the disclosure, the key elements of the reverse proxy policy include policy ID, non-range IP or range IP, and port. For example, a reverse proxy policy for a non-range IP can be expressed as: allow port 80 of 10.0.0.2 to perform reverse proxy, with policy ID 1; a reverse proxy policy for a range IP can be expressed as: allow port 8080 of 10.0.0.2 to 10.0.0.10 to perform reverse proxy, with policy ID 2.

[0034] In this embodiment of the disclosure, a hash table is used to uniformly manage non-range IP policies and range IP policies.

[0035] In this embodiment, when a data packet is received, the hash value of the packet's IP address is matched against the IP policy nodes in the IP hash table. If a match is successful, the ID policy node is matched against the ID policy node stored in the matched IP policy node. If a match is successful, it indicates that reverse proxying of the data packet is supported, and the supported reverse proxy policy can be further determined. If a match fails, it indicates that reverse proxying of the data packet is not supported. Furthermore, matching the hash value of the data packet's IP address against the IP policy nodes in the IP hash table, and if a match fails, it indicates that reverse proxying of the data packet is not supported. In this embodiment, since the pointer to the ID policy node cannot be obtained, further matching of the ID policy node is not possible or necessary, which improves matching efficiency.

[0036] In some embodiments, when matching ID policy nodes, the IP and port of the data packet are compared with the IP and port of the reverse proxy policy stored in the ID policy node. When both the IP and port match, the match is successful; when at least one of the IP or port does not match, the match fails.

[0037] In this embodiment, the reverse proxy policy is stored in an ID hash table and an IP hash table, enabling unified management of non-range IP policies and range IP policies. Matching is performed based on hash values ​​in the hash table, which improves matching efficiency. In particular, matching based on hash values ​​is faster than matching based on linked lists, which is beneficial for improving the access control performance and network security inspection performance of reverse proxy-based network security devices.

[0038] In some embodiments, calculating the hash value of the IP corresponding to the reverse proxy policy, and storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key, includes:

[0039] If the IP corresponding to the reverse proxy policy is a non-range IP, calculate the hash value of the non-range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the non-range IP as the key.

[0040] When the IP corresponding to the reverse proxy policy is a range IP, calculate the hash value of each IP within the range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table with the hash value of each IP within the range IP as the key.

[0041] In this embodiment, an ID hash table and an IP hash table are used to uniformly manage non-range IP policies and range IP policies. For range IPs, the hash value of each IP within the range is calculated separately. Each IP has at least one record in the IP hash table. For example, if multiple reverse proxy policies correspond to the same IP in either the range or non-range IPs, then that IP has an IP policy node corresponding to each reverse proxy policy in the IP hash table. In this embodiment, regardless of whether the IP is range-bound or non-range-bound, each IP has an IP policy node corresponding to each reverse proxy policy in the IP hash table. This facilitates unified management of non-range IP policies and range IP policies, and makes matching easier, thereby improving matching efficiency.

[0042] In some embodiments, storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key includes:

[0043] If the IP corresponding to the reverse proxy policy is a non-range IP, add a single policy identifier to the IP policy node;

[0044] When the IP corresponding to the reverse proxy policy is a range of IPs, add a primary policy identifier to the IP policy node corresponding to the first IP within the range of IPs, and add a secondary policy identifier to the IP policy node corresponding to the non-first IP within the range of IPs.

[0045] In this embodiment, a single policy identifier is added to the IP policy node for non-range IPs, and a primary policy identifier or a secondary policy identifier is added to the IP policy node for range IPs, thereby distinguishing whether the reverse proxy policy corresponding to the IP policy node is a range IP policy or a non-range IP policy; a primary policy identifier is added to the IP policy node corresponding to the first IP within the range IPs, and a secondary policy identifier is added to the IP policy node corresponding to the non-first IP within the range IPs, which facilitates the differentiation and management of IP policy nodes with different range IP policies.

[0046] In some embodiments, after storing the pointer of the ID policy node in the IP policy node of the IP hash table with the hash value of the IP as the key, the method further includes:

[0047] Link the pointer of the IP policy node to the corresponding ID policy node.

[0048] In this embodiment of the disclosure, the pointer of the ID policy node is stored in the IP policy node, so that the ID policy node can be found by IP, which facilitates policy matching of data packets; the pointer of the IP policy node is linked to the ID policy node, so that the IP policy node can be found by policy ID, which facilitates the management of reverse proxy policies such as deletion and modification.

[0049] In some embodiments, the pointer of the IP policy node is linked to the ID policy node by storing the pointer of the IP policy node in the ID policy node.

[0050] In some embodiments, linking the pointer of the IP policy node to the corresponding ID policy node includes:

[0051] When the IP corresponding to the reverse proxy policy is a range of IPs, a linked list is used to store pointers to the IP policy nodes corresponding to each IP within the range of IPs.

[0052] In this embodiment of the disclosure, a linked list is used to store pointers to manage IP policy nodes in the ID policy node, which facilitates the management of IP policy nodes corresponding to each IP within the range of IPs.

[0053] In some embodiments, the policy management method further includes:

[0054] In response to the instruction to delete a reverse proxy policy, the ID policy node corresponding to the reverse proxy policy to be deleted is found in the ID hash table according to the policy ID of the reverse proxy policy to be deleted.

[0055] Based on the pointer to the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be deleted, delete the IP policy node corresponding to the reverse proxy policy to be deleted in the IP hash table.

[0056] Delete the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table.

[0057] In this embodiment of the disclosure, the pointer of the IP policy node is linked to the ID policy node, thereby enabling the IP policy node to be found by policy ID, ensuring thorough deletion.

[0058] In some embodiments, the policy management method further includes:

[0059] In response to the instruction to modify the reverse proxy policy, the ID policy node corresponding to the reverse proxy policy to be modified is found in the ID hash table according to the policy ID of the reverse proxy policy to be modified.

[0060] Based on the pointer to the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be modified, delete the IP policy node corresponding to the reverse proxy policy to be modified in the IP hash table.

[0061] Delete the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table;

[0062] Add the modified reverse proxy strategy.

[0063] In some embodiments, matching an ID policy node in the ID hash table based on a pointer to an ID policy node stored in the matched IP policy node includes:

[0064] Match the ID policy node in the ID hash table based on the pointer to the ID policy node stored in the matched IP policy node;

[0065] The IP address and port of the data packet are matched with the policy information stored in the matched ID policy node;

[0066] If the IP address and port of the data packet both match the matched policy information, then reverse proxy is executed according to the matched policy information.

[0067] If at least one of the IP address and port of the data packet fails to match the matched policy information, the data packet is blocked.

[0068] In some embodiments, when matching an ID policy node, the IP address and port of the data packet are compared with the IP address and port of the reverse proxy policy stored in the ID policy node. If both the IP address and port match, the match is successful, and other reverse proxy functions are performed on the data packet. If at least one of the IP address or port does not match, the match fails, and the data packet is blocked.

[0069] In some embodiments, the hash value of the IP address of the data packet is used as the key to match an IP policy node in the IP hash table;

[0070] If no matching IP policy node is found, the data packet is blocked.

[0071] Secondly, referring to Figure 2 This disclosure provides an electronic device, which includes:

[0072] One or more processors 101;

[0073] The memory 102 stores one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the policy management method described in the first aspect of the embodiments of this disclosure.

[0074] One or more I / O interfaces 103 are connected between the processor and the memory and configured to enable information exchange between the processor and the memory.

[0075] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, enabling information exchange between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0076] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0077] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the policy management method described in the first aspect of embodiments of this disclosure.

[0078] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the policy management method described in the first aspect of this disclosure.

[0079] Fifthly, embodiments of this disclosure provide a strategy management device, including:

[0080] The policy management module is configured to calculate the hash value of the ID of the reverse proxy policy, and store the policy information of the reverse proxy policy in the ID policy node of the ID hash table using the hash value of the ID as the key.

[0081] The IP management module is configured to calculate the hash value of the IP corresponding to the reverse proxy policy, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key;

[0082] The detection module is configured to, when a data packet is received, calculate the hash value of the IP address of the data packet, use the hash value of the IP address of the data packet as the key to match an IP policy node in the IP hash table, and match an ID policy node in the ID hash table according to the pointer of the ID policy node stored in the matched IP policy node.

[0083] In some embodiments, the IP management module is further configured to: calculate the hash value of the non-range IP when the IP corresponding to the reverse proxy policy is a non-range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the non-range IP as the key; and calculate the hash value of each IP within the range IP when the IP corresponding to the reverse proxy policy is a range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of each IP within the range IP as the key.

[0084] In some embodiments, the IP management module is further configured to add a single policy identifier to the IP policy node when the IP corresponding to the reverse proxy policy is a non-range IP; and to add a primary policy identifier to the IP policy node corresponding to the first IP within the range IP when the IP corresponding to the reverse proxy policy is a range IP, and to add a secondary policy identifier to the IP policy node corresponding to the non-first IP within the range IP.

[0085] In some embodiments, the policy management module is further configured to link the pointer of the IP policy node to the corresponding ID policy node.

[0086] In some embodiments, the policy management module is further configured to use a linked list to store pointers to IP policy nodes corresponding to each IP within the range of IPs when the IP corresponding to the reverse proxy policy is a range of IPs.

[0087] In some embodiments, the policy management module is further configured to, in response to an instruction to delete a reverse proxy policy, look up the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table according to the policy ID of the reverse proxy policy to be deleted.

[0088] The IP management module is also configured to delete the IP policy node corresponding to the reverse proxy policy to be deleted in the IP hash table based on the pointer of the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be deleted.

[0089] The policy management module is also configured to delete the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table.

[0090] In some embodiments, the policy management module is further configured to, in response to an instruction to modify a reverse proxy policy, look up the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table according to the policy ID of the reverse proxy policy to be modified.

[0091] The IP management module is also configured to delete the IP policy node corresponding to the reverse proxy policy to be modified in the IP hash table based on the pointer of the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be modified.

[0092] The policy management module is also configured to delete the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table;

[0093] The policy management module and IP management module are also configured to add modified reverse proxy policies.

[0094] In some embodiments, the detection module is further configured to match an ID policy node in the ID hash table based on the pointer to an ID policy node stored in the matched IP policy node; match the IP and port of the data packet with the policy information stored in the matched ID policy node; if the IP and port of the data packet both match the matched policy information, perform a reverse proxy according to the matched policy information; and if at least one of the IP and port of the data packet fails to match the matched policy information, block the data packet.

[0095] In some embodiments, the detection module is further configured to match an IP policy node in the IP hash table using the hash value of the IP address of the data packet as the key; and to block the data packet if no IP policy node is matched.

[0096] To enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of this disclosure, the technical solutions provided by the embodiments of this disclosure will be described in detail below through specific embodiments:

[0097] Example 1

[0098] This embodiment stores reverse proxy strategies using a hash table, enabling unified management of range IP strategies and non-range IP strategies, and achieving rapid matching of reverse proxy strategies.

[0099] In this embodiment, the reverse proxy policy is stored in an ID hash table and an IP hash table. The key elements of the reverse proxy policy include the policy ID, non-range IP or range IP, and port.

[0100] Managing reverse proxy policies involves the following processes:

[0101] 1) Store policy information in an ID hash table using the policy ID as the key. The node storing the policy information is the ID policy node.

[0102] 2) Non-range IP policy: Calculate the hash value of non-range IPs, use the hash value of the non-range IPs as the key to store the pointer of the corresponding ID policy node in the node of the IP hash table, and set a single policy identifier for the node. The node storing the pointer of the ID policy node is the IP policy node.

[0103] 3) Range IP Policy: Calculate the hash value of the first IP within the range IP, use the hash value of the first IP within the range IP as the key to store the pointer of the corresponding ID policy node in the node of the IP hash table, and set the main policy identifier for the node;

[0104] 4) Calculate the hash values ​​of the second to last IPs (not the first IP) within the range of IPs, store the pointers of the ID policy in different nodes of the IP hash table with the hash value of each IP as the key, and set the auxiliary policy identifiers for these nodes;

[0105] 5) Link IP policy nodes belonging to the same policy ID to the corresponding ID policy node in the ID hash table. When multiple reverse proxy policies have overlapping IPs, these reverse proxy policies will be stored as primary or secondary policies in different IP policy nodes with the same key in the IP hash table, and these IP policy nodes will be managed using a linked list in the ID policy node;

[0106] 6) During policy matching, the hash value of the IP address of the data packet is matched with the IP policy node in the IP hash table. If the match is successful, the ID policy node can be matched in the ID hash table according to the pointer of the ID policy node stored in the matched IP policy node. If the match with the ID policy node is successful, it means that reverse proxying of the data packet is supported, and the supported reverse proxy policy can be further determined; if the match with the ID policy node fails, it means that reverse proxying of the data packet is not supported.

[0107] In this embodiment, during policy matching, there may be a situation where the IP address of a data packet matches multiple ID policy nodes. In this case, the port of the reverse proxy policy needs to be matched with the port of the data packet. If the match is successful, the policy matching is considered successful; otherwise, the matching fails.

[0108] Example 2

[0109] This embodiment stores reverse proxy strategies using a hash table, enabling unified management of range IP strategies and non-range IP strategies, and achieving rapid matching of reverse proxy strategies.

[0110] In this embodiment, the reverse proxy policy is stored in an ID hash table and an IP hash table. Key elements of the reverse proxy policy include the policy ID, non-range IP address or range IP address, and port. The reverse proxy policy includes:

[0111] Strategy 1: Allow reverse proxy on port 80 of 10.0.0.2, with policy ID 1;

[0112] Strategy 2: Allow reverse proxying on ports 8080 from 10.0.0.2 to 10.0.0.10, with a strategy ID of 2.

[0113] In this embodiment, the access control module with access control function receives and manages the reverse proxy policy, and the process of storing the reverse proxy policy includes:

[0114] 1) Use the policy ID of policy one as the key to store the policy in the ID hash table. The stored ID policy node is referred to as "ID-1 node";

[0115] 2) Calculate the hash value of the non-range IP 10.0.0.2 under strategy 1. Use this hash value as the key to store the pointer of the corresponding ID strategy node "ID-1 node" in the IP strategy node of the IP hash table. This IP strategy node is identified as a single strategy and is referred to as "IP-1 node". Store the pointer of this IP strategy node in the "ID-1 node" in a linked list.

[0116] 3) Use the strategy ID of strategy 2 as the key to store the strategy in the ID hash table. The stored ID strategy node is referred to as "ID-2 node";

[0117] 4) Calculate the hash value of the first IP within the range of Strategy 2: 10.0.0.2. Use this hash value as the key to store the pointer of the corresponding ID policy node "ID-2 node" in the IP policy node of the IP hash table. This IP policy node is identified as the main policy, referred to as "IP-2-1 node". Link this IP policy node after "IP-1 node" and finally store the pointer of this IP policy node in "ID-2 node" in a linked list.

[0118] 5) Calculate the hash values ​​of the non-first IPs within the range of Strategy 2: 10.0.0.3 to 10.0.0.10 respectively, store the "ID-2 node" pointers in the IP policy nodes of the IP hash table, identify these IP policy nodes as auxiliary policies, and name the nodes "IP-2-2", "IP-2-3", "IP-2-4"... respectively. Finally, store the pointers of these IP policy nodes in the "ID-2 node" in a linked list.

[0119] Example 3

[0120] This embodiment performs policy matching based on the reverse proxy policy stored in Embodiment 2, including:

[0121] 1) Data packet IP: 10.0.0.2 Port: 80

[0122] The access control module queries the IP hash table based on the hash value of the data packet IP: 10.0.0.2 to find the nodes "IP-1 node" and "IP-2-1 node". It obtains the "ID-1 node" pointer from the "IP-1 node", matches the data packet with the IP and port of the reverse proxy policy corresponding to the pointer, and if the match is successful, it continues to execute other functions of the reverse proxy.

[0123] 2) Data packet IP: 10.0.0.2 Port: 8080

[0124] The access control module looks up the nodes "IP-1" and "IP-2-1" in the IP hash table based on the hash value of the packet's IP: 10.0.0.2. It then retrieves the pointer to "ID-1" from "IP-1" and matches the packet with the IP address and port of the corresponding reverse proxy policy. If the match fails, it continues to retrieve the pointer to "ID-2" from "IP-2-1" and matches the packet with the IP address and port of the corresponding reverse proxy policy. If the match succeeds, it continues executing other reverse proxy functions.

[0125] 3) Data packet IP: 10.0.0.3 Port: 8080

[0126] The access control module queries the IP hash table based on the hash value of the data packet IP: 10.0.0.3 to find the node "IP-2-2 node". It then obtains the pointer to the "ID-2 node" from the "IP-2-2 node" and matches the data packet with the IP and port of the reverse proxy policy corresponding to the pointer. If the match is successful, it continues to execute other functions of the reverse proxy.

[0127] 4) Data packet IP: 10.0.0.4 Port: 21

[0128] The access control module looks up the node "IP-2-3" in the IP hash table based on the hash value of the data packet IP: 10.0.0.4, obtains the pointer of "ID-2 node" in "IP-2-3 node", matches the data packet with the IP and port of the reverse proxy policy corresponding to the pointer, and blocks the data packet if the match fails.

[0129] 5) Data packet IP: 10.0.1.2 Port: 21

[0130] The access control module did not find an IP policy node in the IP hash table based on the hash value of the data packet IP: 10.0.1.2, so the match failed and the data packet was blocked.

[0131] Example 4

[0132] This embodiment manages the reverse proxy policy based on the reverse proxy policy stored in Embodiment 2, including:

[0133] 1) When deleting a policy, first search for the ID policy node to be deleted in the ID hash table based on the policy ID; after finding the ID policy node to be deleted, find the pointer of the IP policy node in the linked list of the ID policy node to be deleted; delete the IP policy node in the IP hash table based on the pointer, and finally delete the above-mentioned ID policy node to be deleted in the ID hash table.

[0134] 2) When modifying a strategy, first delete the strategy being modified, and then add the new strategy. Deleting a modified strategy follows the same procedure as deleting a strategy.

[0135] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0136] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A strategy management method, comprising: Calculate the hash value of the policy ID of the reverse proxy policy, and store the policy information of the reverse proxy policy in the ID policy node of the ID hash table using the hash value of the policy ID as the key; Calculate the hash value of the IP corresponding to the reverse proxy policy, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key; When a data packet is received, the hash value of the IP address of the data packet is calculated, and the IP policy node is matched in the IP hash table using the hash value of the IP address of the data packet as the key. Match the ID policy node in the ID hash table based on the pointer to the ID policy node stored in the matched IP policy node; The process includes calculating the hash value of the IP corresponding to the reverse proxy policy, and storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key. If the IP corresponding to the reverse proxy policy is a non-range IP, calculate the hash value of the non-range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the non-range IP as the key. When the IP corresponding to the reverse proxy policy is a range IP, calculate the hash value of each IP within the range IP, and store the pointer of the ID policy node in the IP policy node of the IP hash table with the hash value of each IP within the range IP as the key. Specifically, storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key includes: If the IP corresponding to the reverse proxy policy is a non-range IP, add a single policy identifier to the IP policy node; When the IP corresponding to the reverse proxy policy is a range of IPs, add a primary policy identifier to the IP policy node corresponding to the first IP within the range of IPs, and add a secondary policy identifier to the IP policy node corresponding to the non-first IP within the range of IPs.

2. The strategy management method according to claim 1, wherein, After storing the pointer of the ID policy node in the IP policy node of the IP hash table using the hash value of the IP as the key, the method further includes: Link the pointer of the IP policy node to the corresponding ID policy node.

3. The strategy management method according to claim 2, wherein, Linking the pointer of the IP policy node to the corresponding ID policy node includes: When the IP corresponding to the reverse proxy policy is a range of IPs, a linked list is used to store pointers to the IP policy nodes corresponding to each IP within the range of IPs.

4. The strategy management method according to claim 2, wherein, The strategy management method also includes: In response to the instruction to delete a reverse proxy policy, the ID policy node corresponding to the reverse proxy policy to be deleted is found in the ID hash table according to the policy ID of the reverse proxy policy to be deleted. Based on the pointer to the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be deleted, delete the IP policy node corresponding to the reverse proxy policy to be deleted in the IP hash table. Delete the ID policy node corresponding to the reverse proxy policy to be deleted in the ID hash table.

5. The strategy management method according to claim 2, wherein, The strategy management method also includes: In response to the instruction to modify the reverse proxy policy, the ID policy node corresponding to the reverse proxy policy to be modified is found in the ID hash table according to the policy ID of the reverse proxy policy to be modified. Based on the pointer to the IP policy node stored in the ID policy node corresponding to the reverse proxy policy to be modified, delete the IP policy node corresponding to the reverse proxy policy to be modified in the IP hash table. Delete the ID policy node corresponding to the reverse proxy policy to be modified in the ID hash table; Add the modified reverse proxy strategy.

6. The strategy management method according to any one of claims 1 to 5, wherein, Based on the pointers to ID policy nodes stored in the matched IP policy nodes, match the ID policy nodes in the ID hash table, including: Match the ID policy node in the ID hash table based on the pointer to the ID policy node stored in the matched IP policy node; The IP address and port of the data packet are matched with the policy information stored in the matched ID policy node; If the IP address and port of the data packet both match the matched policy information, then reverse proxy is executed according to the matched policy information. If at least one of the IP address and port of the data packet fails to match the matched policy information, the data packet is blocked.

7. The strategy management method according to any one of claims 1 to 5, wherein, The strategy management method also includes: The IP policy node is matched in the IP hash table using the hash value of the IP address of the data packet as the key. If no matching IP policy node is found, the data packet is blocked.

8. An electronic device, comprising: One or more processors; A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to implement the policy management method according to any one of claims 1 to 7.

9. A computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the policy management method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions that, when executed by a processor, implement the policy management method according to any one of claims 1 to 7.

Images