Firewall service processing method, system and equipment based on container form
The container-based firewall system dynamically adjusts processing resources and utilizes shared memory to ensure high reliability and efficient resource utilization, addressing the challenges of traditional and cloud-native firewalls by providing seamless failover and rapid deployment.
Patent Information
- Application Number
- CN202411391285.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-08
- Publication Date
- 2024-12-27
AI Technical Summary
Existing firewall technologies, including traditional hardware, virtualized, and cloud-native container firewalls, face challenges in achieving high reliability, efficient resource utilization, and managing complex cloud service environments, leading to potential session loss and network instability due to single points of failure.
A container-based firewall system that dynamically adjusts the number of processing containers and queues using load balancing, stores critical resources in shared storage, and utilizes Linux shared memory to manage session information, ensuring seamless failover and efficient resource allocation.
The system achieves high reliability by ensuring uninterrupted service continuity, efficient resource utilization, and rapid deployment through self-healing capabilities, minimizing session loss and network oscillation.
Smart Images
Figure CN119210874A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of firewalls, and in particular to a container-based firewall service processing method, system and device. Background Art
[0002] Firewalls play a key role in the level protection of information systems. With the development of cloud computing technology, firewall technology is also constantly improving, transforming from traditional hardware box firewalls to virtualization and containerization. As a business gateway, the reliability of the firewall is crucial, and it must ensure that a single point of failure will not cause the interruption of the entire network.
[0003] In traditional hardware firewalls, in order to achieve high reliability, a master-slave solution or a session solution is usually adopted to achieve mutual backup of services through traffic diversion and session backup. Traffic diversion usually relies on external hardware switches, while session backup is completed through the backup connection channel between firewalls. In actual applications, the resource allocation of traditional hardware firewalls or ECS-shaped firewalls is fixed, which is not suitable for the complexity of cloud services and the large fluctuations in performance peaks, resulting in low resource utilization. Traditional firewall session backup solutions rely on network channels, have low backup efficiency, and have the risk of session loss. When a node is restarted or a new node is added, batch backup will occur, which may cause network traffic oscillation and instability.
[0004] Virtualized firewalls inherit the high reliability solutions of traditional firewalls, but the difference is that they rely on virtual switches in the cloud infrastructure to divert traffic, and session backup is performed through the cloud virtual network without the need for additional direct channels. In actual applications, as the number of virtual machines increases, the management of virtual firewalls becomes complex, performance is limited by the virtualization environment, security challenges increase, and it depends on the stability of the virtualization platform. In addition, resource allocation, integration with traditional firewalls, and product security and controllability all require strict management specifications to ensure.
[0005] As a new form of firewall, cloud-native container firewall has the advantages of dynamic resource scheduling, self-healing of faults, and flexible start and stop. However, since firewalls are stateful services and single container instances are unstable, they cannot meet the high reliability requirements of firewall links and session services, and cannot guarantee the continuity of user long-connection services in the event of a single point of failure.
[0006] Therefore, how to improve firewall deployment efficiency, resource utilization, management convenience and reliability has become a technical problem that needs to be solved urgently. Summary of the invention
[0007] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a firewall business processing method, system and device based on a container form.
[0008] According to a first aspect of the present invention, a method for processing firewall services based on a container form is provided, the method comprising:
[0009] Configure queues for traffic load and distribute received service traffic to the configured queues through load balancing;
[0010] Create a business processing container corresponding to the queue, and store the critical resources that need to be shared in the shared storage associated with all business processing containers;
[0011] The created business processing container is used to concurrently process the business traffic in the queue, and the firewall business processing capacity is adjusted by dynamically adjusting the number of queues and the number of business processing containers.
[0012] Preferably, the firewall service processing method of the present invention is based on the container form, configures a queue for traffic load, and distributes the received service traffic to the configured queue through load balancing, including: setting the queue number by configuring the nfqueue parameter to set the queue, specifying the queue range in the queue set by the queue number by configuring the load balancing parameter, and distributing the received service traffic to the specified queue through the iptable rule.
[0013] Preferably, the present invention is based on a container-based firewall service processing method to create a service processing container corresponding to a queue, including: obtaining the number of queues participating in service traffic allocation, and creating a service processing container for each queue participating in traffic allocation on a one-to-one basis.
[0014] Preferably, the container-based firewall business processing method of the present invention stores critical resources that require shared access in shared storage associated with all business processing containers, including: by mounting a virtual memory directory, storing critical resources associated with each created business processing container in shared storage, and the shared storage is used to read and write critical resources associated with the business processing container.
[0015] Preferably, the container-based firewall business processing method of the present invention uses a created business processing container to concurrently process business traffic in a queue, including: each business processing container processes business traffic in a queue, and each business processing container concurrently and independently processes business traffic in the queue.
[0016] Preferably, the firewall business processing method based on the container form of the present invention adjusts the firewall business processing capacity by dynamically adjusting the number of queues and the number of business processing containers, including: when the received business traffic increases, increasing the number of queues, updating the queues for allocating business traffic, allocating the increased business traffic to the increased queues through load balancing, creating additional business processing containers for the increased queues, and using the increased business processing containers to process the increased business traffic.
[0017] Preferably, the firewall service processing method based on the container form of the present invention adjusts the firewall service processing capacity by dynamically adjusting the number of queues and the number of service processing containers, including: when the received service traffic decreases, reducing the number of queues, updating the queues for allocating service traffic, allocating the reduced service traffic to the updated queues through load balancing, closing the service processing containers associated with the reduced queues, and using the remaining service processing containers to process the reduced service traffic.
[0018] Preferably, the firewall service processing method based on the container form of the present invention adjusts the firewall service processing capacity by dynamically adjusting the number of queues and the number of service processing containers, including: when there is a faulty service processing container, updating the number of queues, the updated number of queues is equal to the number of normal service processing containers, distributing service traffic to the updated queues through load balancing, and using normal service processing containers to concurrently process service traffic in the updated queues.
[0019] According to a second aspect of the present invention, there is provided a firewall business processing system based on a container form, the system comprising a firewall business processing server, the firewall business processing server being used to: configure queues for traffic loads, and distribute received business traffic to the configured queues through load balancing; create business processing containers corresponding to the queues, and store critical resources that require shared access in a shared storage associated with all business processing containers; use the created business processing containers to concurrently process business traffic in the queues, and adjust the firewall business processing capacity by dynamically adjusting the number of queues and the number of business processing containers.
[0020] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.
[0021] The container-based firewall service processing method, system and device of the present invention have the following beneficial technical effects:
[0022] 1. The business processing container is deployed using a containerized multi-copy deployment strategy, which can dynamically adjust the number of business processing containers and their corresponding NetFilter queues according to actual business traffic, thereby achieving reasonable resource allocation and improving resource utilization;
[0023] 2. Business processing containers based on containerized deployment can quickly respond to the needs of cloud services and have cloud-native features such as rapid deployment, easy management, and self-healing.
[0024] 3. Evenly distribute the business traffic that needs firewall protection to the corresponding Netfilter queues. The business traffic in each queue is received and processed by a firewall container instance to achieve traffic load sharing. This ensures that when a single firewall instance fails, other instances can immediately take over the business needs and ensure high reliability of the link.
[0025] 4. Use Linux shared memory to store the public session table, so that multiple container instances can jointly manage session information. This does not rely on network channels to back up sessions, which is highly efficient and does not involve the risk of information loss during the backup process, thereby improving performance and reliability.
[0026] 5. When a single firewall instance fails, the subsequent traffic of the session is processed by other business processing container instances. These instances can access the session table status through shared memory to ensure that business processing is not interrupted and user business is not affected. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0028] Figure 1 This is an example diagram of the architecture of a firewall service processing system based on a container form according to an embodiment of the present invention;
[0029] Figure 2 A flowchart of a method for processing firewall services based on a container form according to an embodiment of the present invention;
[0030] Figure 3 A technical principle diagram of a firewall service processing method based on a container form according to an embodiment of the present invention;
[0031] Figure 4 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION
[0032] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0033] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.
[0034] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.
[0035] Figure 1 FIG. 1 is an example diagram of the architecture of a firewall service processing system based on a container form according to an embodiment of the present invention. Figure 1 As shown, the system may include a firewall service processing server 101, a communication network 102 and / or one or more firewall service processing clients 103. Figure 1 The example shown is a plurality of firewall service processing clients 103 .
[0036] The firewall business processing server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the firewall business processing server 101 can perform appropriate functions. For example, in some embodiments, the firewall business processing server 101 can be used for firewall processing business traffic based on container form. As an optional example, in some embodiments, the firewall business processing server 101 can be used to: configure queues for traffic loads, distribute received business traffic to configured queues through load balancing; create business processing containers corresponding to queues, and store critical resources that require shared access in shared storage associated with all business processing containers; use the created business processing containers to concurrently process business traffic in queues, and adjust the firewall business processing capacity by dynamically adjusting the number of queues and the number of business processing containers.
[0037] As another example, in some embodiments, the firewall service processing server 101 may send a container-based firewall service processing method to the firewall service processing client 103 for user use based on a request of the firewall service processing client 103 .
[0038] As an optional example, in some embodiments, the firewall business processing client 103 is used to provide a visual processing interface, which is used to receive a user's selection input operation for processing business traffic in a container-based firewall form, and, in response to the selection input operation, obtain a processing interface corresponding to the option selected by the selection input operation from the firewall business processing server 101 and display the processing interface, wherein the processing interface at least displays information on the business traffic processed by the container-based firewall form and operation options for the information on the business traffic processed by the container-based firewall form.
[0039] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The firewall service processing client 103 can be connected to the communication network 102 through one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the firewall service processing server 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the firewall service processing client 103 and the firewall service processing server 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.
[0040] The firewall service processing client 103 may include any one or more clients that present an interface related to high-speed access to an ORC external table in an appropriate form for use and operation by a user. In some embodiments, the firewall service processing client 103 may include any suitable type of device. For example, in some embodiments, the firewall service processing client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.
[0041] Although the firewall service processing server 101 is illustrated as one device, in some embodiments, any appropriate number of devices may be used to perform the functions performed by the firewall service processing server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the firewall service processing server 101. Alternatively, a cloud service may be used to implement the functions of the firewall service processing server 101.
[0042] Based on the above system, an embodiment of the present invention provides a firewall service processing method based on a container form, which is described below through the following embodiments.
[0043] Figure 2 This is a flowchart of a method for processing firewall services based on a container form according to an embodiment of the present invention. Figure 3 FIG. 1 is a technical principle diagram of a container-based firewall service processing method according to an embodiment of the present invention. Figure 2 and Figure 3 As shown, the firewall service processing method based on the container form of this embodiment can be executed on the firewall service processing server. The firewall service processing method based on the container form includes the following steps:
[0044] Step S201: configure a queue for traffic load, and distribute the received service traffic to the configured queue through load balancing.
[0045] As an optional example, in this embodiment, the queue number is set by configuring the nfqueue parameter setting for the queue, the queue range is specified in the queue set by the queue number by configuring the load balancing parameter, and the received service traffic is distributed to the specified queue through the iptable rule. For example, in this embodiment, when the container-based firewall service processing system receives the service traffic sent from the outside, the Linux NetFilter Queue (hereinafter referred to as nfqueue) multi-queue mechanism is used to evenly distribute the traffic to different traffic queues to achieve traffic load sharing, wherein the diversion method uses the iptable rule to cooperate with the nfqueue parameter and the queue-balance parameter to set the number of queues.
[0046] In this embodiment, Linux NetFilter Queue is a framework for intercepting and modifying network packets in the Linux system. It allows user space programs to check, modify or intercept packet flows. nfqueue supports multiple queues, each queue has a unique digital identifier, called a queue number, and qualified packets can be sent to a specified queue by configuring iptable rules. Load balancing can load balance service traffic to multiple queues.
[0047] Step S202: Create a business processing container corresponding to the queue, and store the critical resources that need to be shared and accessed in the shared storage associated with all business processing containers.
[0048] As an optional example, in this embodiment, the number of queues participating in the business traffic allocation is obtained, and a business processing container is created for each queue participating in the traffic allocation. By mounting the virtual memory directory, the critical resources associated with each created business processing container are stored in the shared storage, and the shared storage is used to read and write the associated critical resources by the business processing container. For example, in this embodiment, the container-based firewall business processing system creates corresponding business processing containers according to the number of queues participating in load sharing, and each business processing container processes the business traffic in a queue. Each business processing container independently processes the business traffic without interfering with each other, and multiple business processing containers can process business traffic concurrently.
[0049] It should be noted that in actual applications, if each firewall container instance processes business traffic independently, when subsequent messages of the business connection are dispersed to different containers for processing, the problem of session state error will occur. This embodiment uses a global session method to allow all firewall containers to access a unified set of session lists to ensure the continuity of business processing; at the same time, this method can ensure that when a single container instance fails, other containers can continue to process subsequent traffic of the session according to the public session table state. For example, Linux provides a variety of resource sharing methods. This embodiment adopts the shm shared memory method. All business processing containers mount hostos's / dev / shm, and use Linux shared memory space to build a shared session table, so that each container instance can access the session table content in real time.
[0050] In this embodiment, when multiple business processing containers concurrently process business traffic, critical resources that require shared access, such as session table information, are stored in shared storage that can be accessed by all business processing containers. For example, this embodiment implements shared storage through the Linux shm mechanism. By mounting the / dev / shm virtual memory directory, each business processing container stores the global session table in a shared space, and all business processing containers can read and write data in this shared space. When the firewall system distributes business traffic to different business processing containers for processing due to business processing container failure, capacity reduction, capacity expansion, etc., the global session information can still be read and written normally to ensure that the business traffic can be processed correctly.
[0051] Step S203: using the created service processing container to concurrently process the service traffic in the queue, and adjusting the firewall service processing capability by dynamically adjusting the number of queues and the number of service processing containers.
[0052] As an optional example, in this embodiment, each service processing container processes the service traffic in a queue, and each service processing container processes the service traffic in the queue concurrently and independently. This embodiment pulls up multiple service processing container instances by containerizing multiple instances, jointly undertakes the processing of firewall services, and can dynamically expand or shrink capacity according to the size of the service traffic to meet the needs of different service scenarios.
[0053] When the received business traffic increases, the number of queues is increased, the queues for allocating business traffic are updated, the increased business traffic is allocated to the increased queues through load balancing, additional business processing containers are created for the increased queues, and the increased business processing containers are used to process the increased business traffic. For example, when the container-based firewall business processing system of this embodiment recognizes that the processing capacity of the current business processing container cannot meet the increased business traffic, it can increase the processing capacity through dynamic expansion.
[0054] In the business scenario that needs to be expanded, the container-based firewall business processing system of this embodiment increases the number of queues according to demand, adds the increased queues to the load-sharing traffic queues, pulls up new business processing containers, and connects to the newly added queues to process the business traffic in the new queues. The newly expanded business processing container can also access the shared global session table, so it can smoothly process historical business traffic and new traffic, and realize smooth expansion of the firewall.
[0055] When the received business traffic decreases, the number of queues is reduced, the queues to which the business traffic is allocated are updated, the reduced business traffic is allocated to the updated queues through load balancing, the business processing containers associated with the reduced queues are closed, and the remaining business processing containers are used to process the reduced business traffic.
[0056] When there is a faulty business processing container, the number of queues is updated. The updated number of queues is equal to the number of normal business processing containers. The business traffic is distributed to the updated queues through load balancing, and the normal business processing containers are used to concurrently process the business traffic in the updated queues.
[0057] In this embodiment, the traffic is distributed to multiple business processing containers for processing through nfqueue multi-queue load sharing. When a single business processing container fails, it does not affect the normal operation of other business processing containers. By sharing access to the global session table, when a single business processing container fails, other normal firewall business containers can promptly assume the business of the failed container to ensure smooth and uninterrupted business operation. The business processing container in this embodiment is managed in a cloud-native containerized manner, supporting high-reliability guarantees such as self-monitoring and automatic restart of failures, further improving the reliability of the firewall business processing system based on the container form.
[0058] The container-based firewall service processing method and system according to this embodiment have the following beneficial technical effects:
[0059] 1. The business processing container is deployed using a containerized multi-copy deployment strategy, which can dynamically adjust the number of business processing containers and their corresponding NetFilter queues according to actual business traffic, thereby achieving reasonable resource allocation and improving resource utilization;
[0060] 2. Business processing containers based on containerized deployment can quickly respond to the needs of cloud services and have cloud-native features such as rapid deployment, easy management, and self-healing.
[0061] 3. Evenly distribute the business traffic that needs firewall protection to the corresponding Netfilter queues. The business traffic in each queue is received and processed by a firewall container instance to achieve traffic load sharing. This ensures that when a single firewall instance fails, other instances can immediately take over the business needs and ensure high reliability of the link.
[0062] 4. Use Linux shared memory to store the public session table, so that multiple container instances can jointly manage session information. This does not rely on network channels to back up sessions, which is highly efficient and does not involve the risk of information loss during the backup process, thereby improving performance and reliability.
[0063] 5. When a single firewall instance fails, the subsequent traffic of the session is processed by other business processing container instances. These instances can access the session table status through shared memory to ensure that business processing is not interrupted and user business is not affected.
[0064] like Figure 4 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned container-based firewall service processing method by running the executable computer program.
[0065] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0066] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.
[0067] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.
[0068] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims
1. A container-based firewall service processing method, characterized in that: The method comprises: Configure queues for traffic load and distribute received service traffic to the configured queues through load balancing; Create a business processing container corresponding to the queue, and store the critical resources that need to be shared in the shared storage associated with all business processing containers; The created business processing container is used to concurrently process the business traffic in the queue, and the firewall business processing capacity is adjusted by dynamically adjusting the number of queues and the number of business processing containers.
2. The container-based firewall service processing method according to claim 1 is characterized in that: Configure queues for traffic load, and distribute the received business traffic to the configured queues through load balancing, including: setting the queue number for the queue by configuring nfqueue parameters, specifying the queue range in the queue set by the queue number by configuring load balancing parameters, and distributing the received business traffic to the specified queue through iptable rules.
3. The container-based firewall service processing method according to claim 1 is characterized in that: Creating a service processing container corresponding to the queue includes: obtaining the number of queues participating in service traffic allocation, and creating a service processing container for each queue participating in traffic allocation in a one-to-one correspondence.
4. The container-based firewall service processing method according to claim 1 is characterized in that: The critical resources that need to be shared and accessed are stored in the shared storage associated with all business processing containers, including: by mounting the virtual memory directory, the critical resources associated with each created business processing container are stored in the shared storage, and the shared storage is used to read and write the associated critical resources by the business processing container.
5. The container-based firewall service processing method according to claim 1 is characterized in that: The created business processing container is used to concurrently process the business traffic in the queue, including: each business processing container processes the business traffic in one queue, and each business processing container concurrently and independently processes the business traffic in the queue.
6. The method for processing firewall services based on container form according to claim 1, characterized in that: The firewall business processing capacity is adjusted by dynamically adjusting the number of queues and the number of business processing containers, including: when the received business traffic increases, the number of queues is increased, the queues for allocating business traffic are updated, the increased business traffic is allocated to the increased queues through load balancing, additional business processing containers are created for the increased queues, and the increased business processing containers are used to process the increased business traffic.
7. The container-based firewall service processing method according to claim 1 is characterized in that: The firewall business processing capacity is adjusted by dynamically adjusting the number of queues and the number of business processing containers, including: when the received business traffic decreases, the number of queues is reduced, the queues for allocating business traffic are updated, the reduced business traffic is allocated to the updated queues through load balancing, the business processing containers associated with the reduced queues are closed, and the remaining business processing containers are used to process the reduced business traffic.
8. The container-based firewall service processing method according to claim 1, characterized in that: The firewall service processing capacity is adjusted by dynamically adjusting the number of queues and the number of service processing containers, including: when there is a faulty service processing container, the number of queues is updated, the updated number of queues is equal to the number of normal service processing containers, the service traffic is distributed to the updated queues through load balancing, and the normal service processing containers are used to concurrently process the service traffic in the updated queues.
9. A firewall service processing system based on container form, characterized in that: The system includes a firewall business processing server, which is used to: configure queues for traffic loads, and distribute received business traffic to the configured queues through load balancing; create business processing containers corresponding to the queues, and store critical resources that need shared access in shared storage associated with all business processing containers; use the created business processing containers to concurrently process business traffic in the queues, and adjust the firewall business processing capacity by dynamically adjusting the number of queues and the number of business processing containers.
10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.