Message processing method of virtual router and virtual router

Abstract

The invention provides a message processing method for a virtual router and the virtual router, and the method comprises the steps: setting an intrusion detection and defense engine in the virtual router, configuring a rule index field in a rule file of the intrusion detection and defense engine, and setting a rule mapping table in the intrusion detection and defense engine; redirecting the data message conforming to the specific destination IP to the preprocessing node in the routing stage; redirecting the data message matched with any one ACL rule and an ACL rule index number hit in the traversal process to an intrusion detection and defense engine through the preprocessing node; performing rule index field matching on the matching information through an intrusion detection and defense engine, calling a corresponding ACL rule in a rule mapping table according to the matched rule index field, and executing corresponding ACL strategy processing on the data message; and when it is determined that the ACL rule quotes the IPS rule base, the intrusion detection and defense engine executes corresponding IPS strategy processing on the data message according to the quoted IPS rule base.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method of a virtual router and a virtual router. Background Art

[0002] In the prior art, when implementing the integration of ACL (Access Control List) and IPS (Intrusion Prevention System) rules based on the session mechanism, virtual routers (Vector Packet Processing, VPP) usually have problems such as performance bottlenecks, high system overhead, and complex rule management. In particular, when it is necessary to filter and apply a large number of IPS rules for specific traffic, a large number of rules need to be manually modified or copied, which greatly increases the complexity and maintenance cost of the system. Summary of the invention

[0003] In view of this, the present application proposes a message processing method for a virtual router, a virtual router, a computing device and a storage medium. By setting an intrusion detection and defense engine in the VPP, the high-performance processing capability of the VPP and the IPS deep defense capability of the intrusion detection and defense engine are combined to achieve efficient and flexible traffic control and defense.

[0004] In a first aspect, the present application provides a method for processing a message of a virtual router, wherein an intrusion detection and defense engine is provided in the virtual router, and a rule index field is configured in a rule file of the intrusion detection and defense engine; the intrusion detection and defense engine is also provided with a rule mapping table, and the rule mapping table stores a destination IP, an ACL rule, and a referenced IPS rule base having a mapping relationship with the rule index field; the method comprises:

[0005] In the routing stage, the received data packets are screened and the data packets that meet the specific destination IP are redirected to the pre-processing node, which is configured with session-based ACL rules;

[0006] Perform ACL rule traversal on the data message through the pre-processing node, and redirect the data message matching any ACL rule and the ACL rule index number hit during the traversal process to the intrusion detection and prevention engine;

[0007] The intrusion detection and defense engine performs rule index field matching on the ACL rule index number, calls the corresponding ACL rule in the rule mapping table according to the matched rule index field, and performs corresponding ACL policy processing on the data message;

[0008] When it is determined that the ACL rule references an IPS rule base, the intrusion detection and prevention engine performs corresponding IPS policy processing on the data message according to the referenced IPS rule base, and records the session information of the data message.

[0009] From the above, the present application sets an intrusion detection and prevention engine in a virtual router, sets a rule index field in the rule file of the intrusion detection and prevention engine, sets a rule mapping table in the intrusion detection and prevention engine, and maps the ACL rules of the VPP with the IPS rule library of the intrusion detection and prevention engine by specifying the ACL index and action, so that the intrusion detection and prevention engine can quickly find and apply the corresponding security policy in the rule mapping table according to the matching rule index field. When the data packet enters the virtual router, it is filtered in the routing stage, traversed by the ACL rules of the pre-processing node, matched by the rule index field of the intrusion detection and prevention engine, ACL policy processing and IPS policy processing in turn, so as to achieve effective monitoring and defense of network traffic, and provide strong support for subsequent security analysis by recording the session information of the data packet. The present application combines the high-performance processing capability of the VPP and the IPS deep defense capability of the intrusion detection and prevention engine to achieve efficient and flexible traffic control and defense, and ensure the safe and stable operation of the network.

[0010] Optionally, the rule index field includes an ACL rule index field and an IPS rule base reference field. The intrusion detection and prevention engine searches for the corresponding ACL rule in the rule mapping table according to the ACL rule index field, and determines whether the ACL rule references the IPS rule base according to the IPS rule base reference field.

[0011] From the above, the rule index field can specifically include an ACL rule index field and an IPS rule base reference field. Based on the rule mapping table in the intrusion detection and prevention engine, the intrusion detection and prevention engine can search for the corresponding ACL rule in the rule mapping table according to the ACL rule index field, and determine whether the ACL rule references the IPS rule base according to the IPS rule base reference field. The present application can flexibly configure and update security policies by means of a rule mapping table without making major modifications to the code. As new security threats and requirements emerge, more ACL rules and IPS rule bases can be supported by expanding the rule mapping table.

[0012] Optionally, the ACL rule includes an alarm processing strategy, a discard processing strategy, or a pass processing strategy;

[0013] When the ACL rule called by the intrusion detection and defense engine according to the matched rule index field is a discard processing strategy, the intrusion detection and defense engine executes the discard processing on the data message and records the session information of the data message.

[0014] Optionally, also include:

[0015] When the ACL rule called by the intrusion detection and prevention engine according to the matched rule index field is an alarm processing strategy or a pass processing strategy, the intrusion detection and prevention engine performs an alarm or pass processing on the data message;

[0016] When it is determined that the ACL rule does not reference the IPS rule base, the intrusion detection and prevention engine executes corresponding IPS policy processing according to the pre-configured IPS rule and records the session information of the data message.

[0017] From the above, ACL rules can include alarm processing strategies, discard processing strategies or pass processing strategies, etc. When the ACL rule called by the intrusion detection and prevention engine according to the matching rule index field is a discard processing strategy, the intrusion detection and prevention engine can perform discard processing on the data message and record the session information without executing the subsequent logical processing process. When the ACL rule called by the intrusion detection and prevention engine according to the matching rule index field is an alarm processing strategy or a pass processing strategy, if the ACL rule references the IPS rule base, the intrusion detection and prevention engine will further check and process the data message according to the referenced IPS rule base. In some cases, even if the ACL rule does not directly reference the IPS rule base, the intrusion detection and prevention engine may perform corresponding IPS policy processing according to the pre-configured IPS rules, thereby providing additional security protection and ensuring that the necessary inspection and processing of network traffic can be performed even in the absence of explicit ACL rule references.

[0018] Optionally, the intrusion detection and prevention engine is configured as a dynamic library, and at least one function is configured in the dynamic library;

[0019] The intrusion detection and prevention engine performs filtering of rule files that are not configured with ACL IDs through at least one function in the dynamic library, performs matching of rule files and ACL IDs in data packets, and performs parsing of matched rule index fields to call corresponding ACL rules and determine the referenced IPS rule library.

[0020] From the above, by compiling the source code of the intrusion detection and defense engine into a dynamic library, the flexibility and scalability of the intrusion detection and defense engine are guaranteed, so as to realize the function of updating and replacing the intrusion detection and defense engine without modifying the main program, and by configuring multiple functions in the dynamic library, the intrusion detection and defense engine can efficiently process data packets and call the corresponding ACL rules and IPS rule library according to the matching rule index field.

[0021] Optionally, the dynamic library of the intrusion detection and defense engine is further configured with an external query function, and the query function is called through a virtual router to view the session information of the data message.

[0022] From the above, in order to enhance the interaction capability between VPP and the intrusion detection and prevention engine, new external function interfaces, such as ShowSession and CloseSession, can be added to the dynamic library of the intrusion detection and prevention engine. These function interfaces allow VPP to query or close specific sessions when needed, thereby providing more flexible control methods.

[0023] Optionally, before the intrusion detection and prevention engine performs rule index field matching on the ACL rule index number, the method further includes:

[0024] The intrusion detection and defense engine matches the header information of the data message with the rule header to determine whether the data message complies with at least one basic information of the specified protocol, source address or destination address in the rule file.

[0025] From the above, when the data packet is imported into the intrusion detection and prevention engine, the intrusion detection and prevention engine will perform a series of processing and matching on the data packet according to its designed process, including rule header matching, rule index field content matching, and subsequent flow processing and session management. First, the intrusion detection and prevention engine will match the rule header of the data packet, that is, check whether the data packet conforms to the basic information such as the protocol, source address, destination address, etc. specified in the rule. After matching the rule header, the subsequent content matching of the rule index field will be performed.

[0026] In a second aspect, the present application provides a virtual router, wherein an intrusion detection and defense engine is provided in the virtual router, a rule index field is configured in a rule file of the intrusion detection and defense engine, and a rule mapping table is further provided in the intrusion detection and defense engine, wherein a destination IP, an ACL rule, and a referenced IPS rule base having a mapping relationship with the rule index field are stored in the rule mapping table; the virtual router also includes a routing module and a preprocessing module:

[0027] The received data packets are screened by the routing module in the routing stage, and the data packets that meet the specific destination IP are redirected to the pre-processing module, in which the session-based ACL rules are configured;

[0028] The preprocessing module performs ACL rule traversal on the data message, and redirects the data message matching any ACL rule and the ACL rule index number hit during the traversal process to the intrusion detection and prevention engine;

[0029] The intrusion detection and defense engine performs rule index field matching on the ACL rule index number, calls the corresponding ACL rule in the rule mapping table according to the matched rule index field, and performs corresponding ACL policy processing on the data message;

[0030] When it is determined that the ACL rule references an IPS rule base, the intrusion detection and prevention engine performs corresponding IPS policy processing on the data message according to the referenced IPS rule base, and records the session information of the data message.

[0031] In a third aspect, the present application provides a computing device, the computing device comprising:

[0032] processor;

[0033] A memory for storing one or more programs;

[0034] When the one or more programs are executed by the processor, the processor implements the above-mentioned message processing method of a virtual router.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a computer, the computer program implements the above-mentioned method for processing packets of a virtual router.

[0036] These and other aspects of the present application will become more apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a message processing method of a virtual router provided in an embodiment of the present application;

[0038] Figure 2 A structural diagram of a virtual router provided in an embodiment of the present application;

[0039] Figure 3 A structural diagram of a computing device provided in an embodiment of the present application.

[0040] It should be understood that the size and shape of each block diagram in the above structural diagram are for reference only and should not constitute an exclusive interpretation of the embodiments of the present application. The relative positions and inclusion relationships between the blocks presented in the structural diagram are only schematic representations of the structural associations between the blocks, and do not limit the physical connection methods of the embodiments of the present application. DETAILED DESCRIPTION

[0041] The technical solution provided by the present application is further described below with reference to the accompanying drawings and examples. It should be understood that the system structure and business scenarios provided in the examples of the present application are mainly to illustrate the possible implementation methods of the technical solution of the present application and should not be interpreted as the only limitation on the technical solution of the present application. It is known to those of ordinary skill in the art that with the evolution of the system structure and the emergence of new business scenarios, the technical solution provided by the present application is also applicable to similar technical problems.

[0042] The embodiment of the present application proposes a message processing method for a virtual router, by setting an intrusion detection and defense engine in a virtual router (Vector Packet Processing, VPP), exemplary, the intrusion detection and defense engine of the embodiment of the present application can be a Suricata engine, the Suricata engine is a rule-based intrusion detection and defense engine, providing intrusion detection (Intrusion Detection System, IDS), intrusion prevention (Intrusion Prevention System, IPS) and network security monitoring functions, through reasonable configuration and rule update, the Suricata engine can effectively detect and defend against various network threats, to ensure the safe and stable operation of the network system. Based on this, the embodiment of the present application sets a rule index field in the rule file of the Suricata engine, and sets a rule mapping table in the Suricata engine, the rule mapping table stores the destination IP, ACL rules and the referenced IPS rule base that have a mapping relationship with the rule index field. After the data message enters the VPP, it is first screened in the routing stage, and the data message that meets the specific destination IP is redirected to the preprocessing node; the preprocessing node is configured with session-based ACL rules, and the preprocessing node traverses the ACL rules of the redirected data message, finds the matching data message and the ACL rule index number it hits, and redirects the data message and the ACL rule index number it hits to the Suricata engine; after the Suricata engine receives the data message sent by the preprocessing node and the ACL rule index number it hits, it will further match the rule index field of the ACL rule index number, and call the corresponding ACL rule in the rule mapping table according to the matched rule index field, and execute the corresponding ACL policy processing on the data message; if the ACL rule references the IPS rule base, the Suricata engine will further check and process the data message according to the referenced IPS rule base. While executing the IPS policy processing, the Suricata engine will also record the session information of the data message. The packet processing method of a virtual router provided by the embodiment of the present application can combine the high-performance processing capability of VPP and the IPS in-depth defense capability of the Suricata engine to achieve efficient and flexible traffic control and defense.

[0043] Refer to the following Figure 1The flowchart shown in the figure describes the embodiment of the present application in detail. In a message processing method for a virtual router provided in an embodiment of the present application, in the configuration stage, a Suricata engine is first set in the VPP, and the Suricata engine is compiled into a dynamic library, and then a rule index field is set in the rule file of the Suricata engine. The rule index field is an array stored in sequence, specifically including an ACL rule index field (ACL header field, action field and policy index field) and an IPS rule library reference field (ref-ips field and IPS rule field). A rule mapping table is also provided in the Suricata engine. Exemplarily, the rule mapping table is as follows:

[0044]

[0045]

[0046] The above rule mapping table stores the ACL header field, action field, policy index field, ref-ips field and IPS rule field. By configuring the ACL index, action and referenced IPS rule base in advance in the rule mapping table, the ACL rules of VPP can be mapped with the IPS rule base of the Suricata engine, so that the Suricata engine can quickly find and apply the corresponding security policy in the rule mapping table according to the matching rule index field. For example, assuming that the rule index field is "acl:1-2,2-1,3-3; ref-ips:true", the first number in the rule index field represents the corresponding VPP policy index, and the second number corresponds to the action of the VPP policy (1: alert, 2: drop, 3: pass). Here, 1-2 means that the action issued by the first ACL rule of VPP is drop, and 3-3 means that the action issued by the third ACL rule of VPP is pass. The field "ref-ips:true" indicates that the IPS rule base is being referenced by the ACL rule of VPP. The field "ref-ips:false" indicates that the ACL rules of VPP do not reference the IPS rule base. When VPP does not want to reference the IPS rule base in the command line, the only thing that needs to be done after the data packet enters the Suricata engine is to set the action in the ACL rule for the session of the data packet without any other matching. Even if the IPS rule base is not referenced when configuring ACL rules in VPP, Suricata rules need to be issued. The fundamental reason is that VPP does not store the status information of the flow. The data packet must be imported into the Suricata engine, and the flow status information session table can be obtained with the help of the Suricata engine.

[0047] The embodiment of the present application sets a rule index field in the rule file of the Suricata engine and sets a rule mapping table in the Suricata engine. The Suricata engine can search for the corresponding ACL rule in the rule mapping table according to the ACL rule index field in the rule index field to determine the action to be performed, and can also determine whether the ACL rule refers to the IPS rule base according to the Iref-ips field in the rule index field. Through the rule mapping table, the Suricata engine can flexibly configure and update security policies without major modifications to the code. With the emergence of new security threats and requirements, more ACL rules and IPS rule bases can be supported by expanding the rule mapping table.

[0048] like Figure 1 As shown, a message processing method of a virtual router provided in an embodiment of the present application includes:

[0049] S110: Filter the received data packets in the routing stage, and redirect the data packets that meet the specific destination IP to the pre-processing node, in which the session-based ACL rules are configured.

[0050] In this embodiment, after the data message enters the virtual router, it is first screened in the routing stage. In this stage, the data message is screened according to the destination IP address, and the data message that meets the specific destination IP is redirected to the pre-processing node. In this embodiment, the matching process of the destination IP is advanced to the routing stage, and the matched data message is directly redirected to the pre-processing node to perform ACL traversal, which can significantly improve the processing efficiency and reduce the pressure on other service nodes.

[0051] S120: ACL rule traversal is performed on the data message through the preprocessing node, and the data message matched with any ACL rule and the ACL rule index number hit during the traversal process are redirected to the Suricata engine.

[0052] In this step, the data traffic is initially classified by redirecting the data packets that meet the specific destination IP to the preprocessing node in the routing stage. The preprocessing node can be a special data path set in the VPP, such as DPO_ACL_SURICATA. An efficient ACL search mechanism is maintained in the node, which can be a hash table, Trie tree or other fast search data structure for storing session-based ACL rules. Through the session-based ACL rules, the node can allow or deny data packets based on the context information of the session (such as source IP, destination IP, port number, protocol type, etc.).

[0053] When a data packet arrives at DPO_ACL_SURICATA, it is first checked based on the packet's five-tuple (source IP, destination IP, source port, destination port, protocol type) or at least the destination IP in its configured ACL rules to determine whether it matches any ACL rule. Once any ACL rule is matched, DPO_ACL_SURICATA will perform the corresponding action, such as allowing, denying or redirecting to the Suricata engine. Before redirecting to the Suricata engine, DPO_ACL_SURICATA can also attach additional matching information to the data packet, such as the hit ACL rule index number and other required information (such as log level, alarm type, etc.), and redirect the data packet and the additional matching information to the Suricata engine.

[0054] S130: performing rule index field matching on the ACL rule index number through the Suricata engine, calling the corresponding ACL rule in the rule mapping table according to the matched rule index field, and executing the corresponding ACL policy processing on the data message.

[0055] In this step, after the Suricata engine receives the data message and additional matching information from DPO_ACL_SURICATA, the Suricata engine will perform a series of processing and matching on the data packet according to its designed process, including rule header matching, content matching of rule index fields, and subsequent stream processing and session management, etc. The Suricata engine dynamic library is configured with a pre-filtering function (PrefilterAclIsPrefilterable), an ACL matching function (DetectAclMatch) and a rule index field parsing function (DetectAclSetup), wherein the pre-filtering function is used to filter the rule file that is not configured with an ACL ID. In a network environment, there may be a large number of rule files that are not configured with an ACL ID, and these files may not be suitable for the current data message processing flow. These files can be excluded in advance by the pre-filtering function, and the processing efficiency of subsequent ACL matching is improved. The ACL matching function is responsible for executing the matching of the ACLID in the rule file and the data message. When the data message arrives at the Suricata engine, the ACL matching function will traverse the rule file and search for the entry that matches the ACL ID in the data message. The ACL matching function may use a hash table, binary search tree, or other efficient data structures to speed up the matching process. The rule index field parsing function is used to parse the matching rule index field to call the corresponding ACL rule and determine whether the IPS rule base is referenced. The function will parse the policy index, IPS rule base reference, and other information in the rule index field and execute the corresponding processing flow based on this information.

[0056] According to the above configured functions, after receiving the data message and matching information, the Suricata engine can directly match the rule header of the data message without reading the specific content of the data message, that is, check whether the data message meets the basic information such as the protocol, source address, and destination address specified in the rule. After matching the rule header, the Suricata engine will further parse the rule index field in the matching information, extract the ACL rule index field and the ref-ips field, and according to the ACL rule index field, the Suricata engine will find the corresponding ACL rule in the rule mapping table, and perform the corresponding action processing on the data message according to the ACL rule. Regardless of the execution result of the ACL rule, the Suricata engine will record the session information of the data message. This information is crucial for subsequent security analysis, auditing, and response. Through the session information, administrators can understand the key information such as the source, destination, protocol type, and amount of data transmitted of the data message, so as to better understand the behavior pattern of network traffic and potential security threats.

[0057] In this embodiment, the ACL rule includes an alert processing strategy, a drop processing strategy or a pass processing strategy. If the ACL rule that the Suricata engine searches for according to the ACL rule index field is a drop processing strategy, the Suricata engine performs a drop processing on the data message, and the data message will not be further forwarded or processed, but directly discarded. At the same time, the Suricata engine will record the session information of the data message for subsequent security analysis, auditing and possible response measures. If the ACL rule that the Suricata engine searches for according to the ACL rule index field is an alert processing strategy, the Suricata engine will generate an alert event, indicating that the data message triggers the security policy, and the alert event may be recorded in the log file. Although the data message triggers the alert, it may still be processed or forwarded by the Suricata engine, depending on the configuration of the IPS rule. If the ACL rule that the Suricata engine searches for according to the ACL rule index field is a pass processing strategy, the Suricata engine will also perform further security checks and processing on the data message according to the configured IPS rule.

[0058] In this embodiment, by setting the rule index field at a front position in the data structure of the rule file of the Suricata engine, the Suricata engine can give priority to performing content matching of the rule index field after completing the matching of the header rule. When the matched ACL rule is to discard, the data packet can be directly discarded without executing subsequent logical processing procedures, thereby reducing system overhead and improving processing efficiency.

[0059] S140: When it is determined that the ACL rule references an IPS rule base, the Suricata engine performs corresponding IPS policy processing on the data message according to the referenced IPS rule base, and records session information of the data message.

[0060] When the ACL rule searched by the Suricata engine according to the ACL rule index field is an alert or a pass, the Suricata engine will further determine whether the ACL rule references the IPS rule base according to the ref-ips field. If the ACL rule references the IPS rule base, the Suricata engine will perform corresponding IPS policy processing on the data packet according to the referenced IPS rule base, including deep inspection of the data packet, attack detection, response generation, etc.

[0061] In some cases, even if the ACL rule does not directly reference the IPS rule base according to the ref-ips field, the Suricata engine may still perform the corresponding IPS policy processing according to the pre-configured IPS rules, thereby providing additional security protection and ensuring that the necessary inspection and processing of network traffic can be performed even in the absence of explicit ACL rule references.

[0062] In some embodiments, in order to enhance the interaction between VPP and Suricata engine, new external function interfaces, such as ShowSession, CloseSession and other function interfaces, can be added to the dynamic library of Suricata engine. These function interfaces allow VPP to query or close specific sessions when needed, thereby providing more flexible control means. Specifically, through the ShowSession function interface, VPP can request to view detailed information of a specific session, such as the source / destination address, port, duration, amount of data transmitted, etc. of the session, which is very useful for diagnosing network problems, monitoring network traffic and other scenarios; through the CloseSession function interface, VPP can request Suricata engine to terminate a session and release related resources in certain circumstances (for example, when abnormal behavior is detected).

[0063] In some embodiments, for data packets of dynamically negotiated port protocols such as FTP, special interactions need to be performed between the VPP and the Suricata engine. The Suricata engine provides a function interface to the VPP so that the VPP can query whether a link already has a self-connection, thereby correctly processing the data traffic of the FTP protocol and avoiding misjudgment or missed detection.

[0064] In summary, the embodiment of the present application not only improves the processing efficiency and security of the system by setting the Suricata engine in the virtual router, and by optimizing the data structure in the Suricata engine, adjusting the data packet processing flow and adding a new function interface, but also enhances the interaction between the VPP and the Suricata engine. When the data message enters the virtual router, it is screened in the routing stage, traversed by the ACL rules of the pre-processing node, matched by the rule index field of the Suricata engine, processed by the ACL policy and processed by the IPS policy, so as to achieve effective monitoring and defense of the network traffic, and provide strong support for subsequent security analysis by recording the session information of the data message. The embodiment of the present application combines the high-performance processing capability of the VPP and the IPS deep defense capability of the Suricata engine, and can achieve efficient and flexible traffic control and defense, and ensure the safe and stable operation of the network.

[0065] like Figure 2 As shown, the embodiment of the present application provides a virtual router, which can be used to implement the above Figure 1 Any of the steps shown and their optional embodiments. Figure 2 As shown, the virtual router is provided with a Suricata engine 230, a rule index field is configured in the rule file of the Suricata engine 230, and a rule mapping table is also provided in the Suricata engine 230, which stores the destination IP, ACL rules and the referenced IPS rule base having a mapping relationship with the rule index field; the virtual router also includes a routing module 210 and a preprocessing module 220:

[0066] Among them, when the data message enters the virtual router, the received data message is screened in the routing stage by the routing module 210, and the data message that meets the specific destination IP is redirected to the preprocessing module 220, and the preprocessing module 220 is configured with a session-based ACL rule; the ACL rule traversal is performed on the data message by the preprocessing module 220, and the data message matching any ACL rule and the ACL rule index number hit during the traversal process are redirected to the Suricata engine 230; the ACL rule index number is matched by the Suricata engine 230, and the corresponding ACL rule is called in the rule mapping table according to the matched rule index field and the corresponding ACL policy processing is performed on the data message; when it is determined that the ACL rule references the IPS rule library, the Suricata engine 230 also performs the corresponding IPS policy processing on the data message according to the referenced IPS rule library, and records the session information of the data message.

[0067] It should be understood that each module in the embodiment of the present application can be implemented by software, for example, it can be implemented by a computer program or instruction having the above functions, and the corresponding computer program or instruction can be stored in a memory inside the terminal, and the processor reads the corresponding computer program or instruction inside the memory to implement the above functions. Alternatively, each module in the embodiment of the present application can also be implemented by hardware. Alternatively, each module in the embodiment of the present application can also be implemented by a combination of a processor and a software module.

[0068] It should be understood that the processing details of each module in the embodiment of the present application can be referred to Figure 1 The related descriptions of the illustrated embodiment and related extended embodiments will not be repeated in the embodiments of the present application.

[0069] Figure 3 5 is a structural diagram of a computing device 500 provided in an embodiment of the present application. The computing device 500 includes: a processor 510 , a memory 520 , a communication interface 530 , and a bus 540 .

[0070] It should be understood that Figure 3 The communication interface 530 in the computing device 500 shown may be used to communicate with other devices.

[0071] The processor 510 may be connected to a memory 520. The memory 520 may be used to store the program code and data. Therefore, the memory 520 may be a storage unit inside the processor 510, or an external storage unit independent of the processor 510, or a component including a storage unit inside the processor 510 and an external storage unit independent of the processor 510.

[0072] Optionally, the computing device 500 may further include a bus 540. The memory 520 and the communication interface 530 may be connected to the processor 510 via the bus 540. The bus 540 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus 540 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0073] It should be understood that in the embodiment of the present application, the processor 510 may adopt a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. Alternatively, the processor 510 may adopt one or more integrated circuits to execute relevant programs to implement the technical solutions provided in the embodiment of the present application.

[0074] The memory 520 may include a read-only memory and a random access memory, and provides instructions and data to the processor 510. A portion of the processor 510 may also include a nonvolatile random access memory. For example, the processor 510 may also store information on the device type.

[0075] When the computing device 500 is running, the processor 510 executes the computer-executable instructions in the memory 520 to perform the operating steps of the above method.

[0076] It should be understood that the computing device 500 according to the embodiment of the present application can correspond to the corresponding subjects in the methods according to the embodiments of the present application, and the above-mentioned other operations and / or functions of each module in the computing device 500 are respectively for realizing the corresponding processes of each method of the present embodiment. For the sake of brevity, they will not be repeated here.

[0077] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0079] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0082] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0083] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it is used to execute the above method, which includes at least one of the solutions described in the above embodiments.

[0084] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive lists) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing programs, which can be used by instruction execution systems, devices or devices or used in combination with them.

[0085] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0086] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0087] Computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0088] It should be noted that the embodiments described in the present application are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application usually described and shown in the drawings can be arranged and designed in various different configurations. Therefore, the above detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0089] The words "first, second, third, etc." or module A, module B, module C and other similar terms in the specification and claims are only used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that the specific order or sequence can be interchanged where permitted so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0090] In the above description, the numbers representing the steps involved do not necessarily mean that the steps will be executed. Intermediate steps may be included or replaced by other steps. The order of the previous and next steps may be interchanged or executed simultaneously if permitted.

[0091] The term "comprising" as used in the description and claims should not be interpreted as being limited to what is listed thereafter; it does not exclude other elements or steps. Therefore, it should be interpreted as specifying the presence of the features, integers, steps or components mentioned, but does not exclude the presence or addition of one or more other features, integers, steps or components and groups thereof. Therefore, the expression "a device comprising means A and B" should not be limited to a device consisting of components A and B only.

[0092] The "one embodiment" or "embodiment" mentioned in this specification means that the specific features, structures or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present application. Therefore, the terms "in one embodiment" or "in an embodiment" appearing in various places in this specification do not necessarily refer to the same embodiment, but may refer to the same embodiment. In addition, in the various embodiments of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form a new embodiment according to their inherent logical relationship.

[0093] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present application is described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may also include more other equivalent embodiments without departing from the concept of the present invention, all of which belong to the protection scope of the present invention.

Claims

1. A method for processing a message of a virtual router, characterized in that: The virtual router is provided with an intrusion detection and defense engine, and a rule index field is configured in a rule file of the intrusion detection and defense engine; the intrusion detection and defense engine is also provided with a rule mapping table, and the rule mapping table stores a destination IP, an ACL rule and a referenced IPS rule base having a mapping relationship with the rule index field; the method comprises: In the routing stage, the received data packets are screened and the data packets that meet the specific destination IP are redirected to the pre-processing node, which is configured with session-based ACL rules; Perform ACL rule traversal on the data message through the pre-processing node, and redirect the data message matching any ACL rule and the ACL rule index number hit during the traversal process to the intrusion detection and prevention engine; The intrusion detection and defense engine performs rule index field matching on the ACL rule index number, calls the corresponding ACL rule in the rule mapping table according to the matched rule index field, and performs corresponding ACL policy processing on the data message; When it is determined that the ACL rule references an IPS rule base, the intrusion detection and prevention engine performs corresponding IPS policy processing on the data message according to the referenced IPS rule base, and records the session information of the data message.

2. The method according to claim 1, characterized in that The rule index field includes an ACL rule index field and an IPS rule base reference field. The intrusion detection and defense engine searches for the corresponding ACL rule in the rule mapping table according to the ACL rule index field, and determines whether the ACL rule references the IPS rule base according to the IPS rule base reference field.

3. The method according to claim 1, characterized in that The ACL rule includes an alarm processing strategy, a discard processing strategy or a pass processing strategy; When the ACL rule called by the intrusion detection and defense engine according to the matched rule index field is a discard processing strategy, the intrusion detection and defense engine executes the discard processing on the data message and records the session information of the data message.

4. The method according to claim 3, characterized in that Also includes: When the ACL rule called by the intrusion detection and prevention engine according to the matched rule index field is an alarm processing strategy or a pass processing strategy, the intrusion detection and prevention engine performs an alarm or pass processing on the data message; When it is determined that the ACL rule does not reference the IPS rule base, the intrusion detection and prevention engine executes corresponding IPS policy processing according to the pre-configured IPS rule and records the session information of the data message.

5. The method according to claim 1, characterized in that: The intrusion detection and prevention engine is configured as a dynamic library, and at least one function is configured in the dynamic library; The intrusion detection and prevention engine performs filtering of rule files that are not configured with ACL IDs through at least one function in the dynamic library, performs matching of rule files and ACL IDs in data packets, and performs parsing of matched rule index fields to call corresponding ACL rules and determine the referenced IPS rule library.

6. The method according to claim 5, characterized in that The dynamic library of the intrusion detection and defense engine is also configured with an external query function, which is called through a virtual router to view the session information of the data message.

7. The method according to claim 1, characterized in that Before the intrusion detection and defense engine performs rule index field matching on the ACL rule index number, the method further includes: The intrusion detection and defense engine matches the header information of the data message with the rule header to determine whether the data message complies with at least one basic information of the specified protocol, source address or destination address in the rule file.

8. A virtual router, characterized in that: The virtual router is provided with an intrusion detection and defense engine, a rule index field is configured in the rule file of the intrusion detection and defense engine, and a rule mapping table is also provided in the intrusion detection and defense engine, and the destination IP, ACL rules and referenced IPS rule base having a mapping relationship with the rule index field are stored in the rule mapping table; the virtual router also includes a routing module and a preprocessing module: The received data packets are screened by the routing module in the routing stage, and the data packets that meet the specific destination IP are redirected to the pre-processing module, in which the session-based ACL rules are configured; The preprocessing module performs ACL rule traversal on the data message, and redirects the data message matching any ACL rule and the ACL rule index number hit during the traversal process to the intrusion detection and prevention engine; The intrusion detection and defense engine performs rule index field matching on the ACL rule index number, calls the corresponding ACL rule in the rule mapping table according to the matched rule index field, and performs corresponding ACL policy processing on the data message; When it is determined that the ACL rule references an IPS rule base, the intrusion detection and prevention engine performs corresponding IPS policy processing on the data message according to the referenced IPS rule base, and records the session information of the data message.

9. A computing device, characterized in that include: processor; A memory for storing one or more programs; When the one or more programs are executed by the processor, the processor implements the message processing method of a virtual router as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a computer, the message processing method of a virtual router as claimed in any one of claims 1 to 7 is implemented.

Images