Network quintuple matching method based on ordered interval list

Abstract

The invention relates to a network quintuple matching method based on an ordered interval list, and belongs to the technical field of computer network communication. Through the design of the data structure, the corresponding security policy is quickly matched through the network quintuple in the data packet, the security policy is added, deleted, modified and checked by maintaining the policy interval information list and the bitmap corresponding to each policy interval, and the flexibility of network firewall configuration is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of computer network communications, and in particular relates to a matching method for network quintuples based on an ordered interval list. Background Art

[0002] The network quintuple is used to identify the information of the sender and receiver at the transport layer during computer network communication. It is included in the packet header of the network layer and transport layer data packets. It consists of five fields: sender IP address, sender port, receiver IP address, receiver port, and protocol, so it is called a quintuple. Security policy is a control rule composed of matching conditions and actions. Matching conditions can include quintuples, users, time, etc., and actions determine how packets that meet the matching conditions will be processed.

[0003] The network quintuple includes five basic attributes of a network data packet. A network quintuple can be used to uniquely identify a session between a pair of entities in a computer network, so it is of great significance to computer networks. The quintuple matching method is widely used in the field of network security, such as the packet filtering technology of firewalls. Its essence is to determine whether a data packet can pass through the security policy pre-defined by the user or network administrator, and the matching condition of the security policy mainly depends on the scope of the limited network quintuple. For example, all packets from a certain IP address, the destination port is 80, and the protocol value is 6 (that is, TCP protocol) are prohibited from passing. In essence, this IP address is prohibited from accessing the HTTP server in the firewall. A well-configured firewall often has a large number of security policies, and judging whether a data packet is released or not requires locating the security policy associated with it based on the quintuple of the data packet. Therefore, how to quickly match the quintuple with the security policy has become the key to the throughput performance of the firewall. At the same time, the configured security policy should also be flexible, such as supporting dynamic addition, deletion, modification and query of the policy. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problems to be solved by the present invention are: how to quickly match the corresponding security policy through the network quintuple in the data packet; how to realize the dynamic addition, deletion, modification and query of the security policy.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention provides a network quintuple matching method based on an ordered interval list, which implements security policy matching of the network quintuple in the following manner:

[0008] If the sender's IP address is an IPv4 address, it is regarded as a 4-byte unsigned integer. If it is an IPv6 address, it is regarded as a 16-byte unsigned integer. The matching condition in the security policy divides an interval for the IP address. The IP address is regarded as an integer, and this interval is regarded as an integer interval. Therefore, given a policy interval and an IP address, whether the IP address is in this interval is determined by comparing the size of the integer. In the same way, each element in the network quintuple is regarded as an unsigned integer, so that the policy matching problem is converted into a problem of comparing the size of integers and determining whether a certain integer exists in a certain interval.

[0009] Furthermore, a list is designed to maintain the information of all the policy intervals of a tuple. The elements in the list are integer intervals connected from beginning to end. At the beginning, the list is initialized to have only one element, and its interval is [0, MAX]. MAX is the maximum value allowed for this element.

[0010] This list and its elements must satisfy the following three constraints:

[0011] ①The starting value of the first interval is 0, and the ending value of the last interval is MAX;

[0012] ②The end value of the same interval is greater than or equal to the starting value;

[0013] ③The starting value of the next interval in the list is the ending value of the previous interval plus 1;

[0014] The list that satisfies the above three constraints is a monotonically non-decreasing interval list. There is no intersection between different intervals, and the union of all intervals is [0, MAX];

[0015] After obtaining such a list, for an input IP address that needs to be matched, since the list has been sorted into a monotone non-decreasing order, for a list with n intervals, the binary search method is used with a time complexity of O(log n) to find which interval this input IP address exists in;

[0016] Assume that the maximum number of security policies allowed is N, and assign a policy index number in the range of [0, N-1] to each security policy; at the same time, each interval maintains a bitmap, and the bit length of this bitmap is N. If the security policy with index number x includes this interval, the x+1th bit of this interval bitmap is set to 1, otherwise it is 0; therefore, the bitmap of an interval contains the index number information of all security policies that include this interval. After locating the corresponding interval through input and obtaining this bitmap, by scanning the bitmap once, you can find out which security policies define the range that includes this input IP address;

[0017] For the case of a quintuple, five independent lists are maintained for each of the five elements. After five binary searches of the five-element list, five bitmaps of the same length can be obtained. The five bitmaps are bitwise ANDed to obtain the security policy index number that satisfies the matching conditions on the five elements at the same time, that is, the policy index number that is finally matched.

[0018] Preferably, for a single element, there may be multiple policy index numbers that contain the input value, but if there is no error in the policy definition process, there should be only one policy index number that is finally matched, otherwise it means that there are different policy index numbers with exactly the same matching conditions.

[0019] Preferably, the method also implements adding, deleting, modifying and checking security policies by maintaining a list and a bitmap corresponding to each policy interval.

[0020] Preferably, the search for security policies is implemented in the following manner: according to the input value of each element, a binary search method is applied to the list corresponding to each element to find the interval containing this input value and obtain the bitmap corresponding to this interval; bitwise AND is performed on the five bitmaps of equal length corresponding to the five elements to obtain the corresponding policy index number.

[0021] Preferably, the security policy is added in the following ways:

[0022] For the case of one-tuple, the increase strategy consists of two steps: interval splitting and bitmap updating;

[0023] Interval splitting: For the new strategy with the added strategy interval [X, Y], split the original list at X and Y respectively and split the new intervals, let X be the starting value of the new interval on the right side of the break position at X, let Y be the ending value of the new interval on the left side of the break position at Y, and make necessary adjustments to the list to meet the three constraints on the list mentioned above;

[0024] Bitmap update: The new interval formed after the split is a sub-interval of the interval before the split, so the bitmap of the new interval needs to inherit the bitmap of the interval before the split; at the same time, after the interval is split, for all new intervals in the [X, Y] range, the corresponding bits of the corresponding policy index numbers in the bitmap of the new interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this policy;

[0025] For a quintuple, interval splitting and bitmap updating can be performed on the interval list corresponding to the quintuple.

[0026] Preferably, the security policy is deleted by:

[0027] Deleting a security policy is the reverse process of adding a security policy. For the case of a tuple, there are also two steps: bitmap update and interval merging;

[0028] Bitmap update: For the deleted policy with the policy interval [A, B], set the bits corresponding to the corresponding policy index numbers in the bitmaps of all intervals in the range [A, B] to 0;

[0029] Interval merging: For the strategy whose strategy interval is [A, B], the processing method is as follows: after the bitmap is updated, for the interval with the starting value A, compare the bitmap of this interval with the previous interval. If they are exactly the same, it means that there is no other strategy with the starting value A as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval. Otherwise, the interval cannot be merged. For the interval with the ending value B, compare the bitmap of this interval with the next interval. If they are exactly the same, it means that there is no other strategy with the ending value B as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval.

[0030] For a quintuple, bitmap update and interval merging can be performed on the interval list corresponding to the quintuple.

[0031] Preferably, modifying the security policy is achieved by first deleting the security policy and then adding the security policy.

[0032] The present invention also provides a system for implementing the method.

[0033] The invention also provides a network firewall designed and implemented based on the method.

[0034] The invention also provides a network communication method implemented based on the method.

[0035] (III) Beneficial effects

[0036] The present invention realizes rapid matching of network quintuples in data packets to corresponding security policies through the design of data structures, and realizes addition, deletion, modification and query of security policies by maintaining a policy interval information list and a bitmap corresponding to each policy interval, thereby improving the flexibility of network firewall configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of the strategy interval splitting process designed for the present invention;

[0038] Figure 2 Schematic diagram of the bitmap update process designed for the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0040] With the development of network infrastructure, people have put forward higher requirements for network speed and security. A firewall is a device used to enhance network security. It mainly audits the data packets passing through through packet filtering technology and intercepts the data packets from or to untrusted peers. Packet filtering technology mainly relies on identifying the five-tuple of the data packet according to the defined security policy, and the matching conditions in the security policy divide the five-tuple into a certain range. Because each data packet needs to go through this matching process when passing through the firewall, if the matching time is too long, it will significantly affect the network throughput and latency. Therefore, how to quickly match the network five-tuple in the data packet to the corresponding security policy has become one of the core issues that the firewall needs to solve. At the same time, in order to improve the flexibility of configuration, the security policy should also support dynamic addition, deletion, modification and query of the policy.

[0041] The present invention designs a fast network quintuple matching method, and the matching method can support dynamic addition, deletion, modification and query of security policies.

[0042] 1. Solution design

[0043] The present invention provides a network quintuple matching method based on an ordered interval list, the core of which lies in the design of a data structure. First, consider the case where only the sender IP address exists as a tuple in a data packet. Taking this as an example, after explaining the tuple solution, it can be easily extended to the quintuple situation.

[0044] For the sender IP address, if it is an IPv4 address, it can be regarded as a 4-byte unsigned integer, and if it is an IPv6 address, it can be regarded as a 16-byte unsigned large integer. The matching condition in the security policy divides an interval for the IP address. By considering the IP address as an integer, this interval can also be regarded as an integer interval. Therefore, given a policy interval (matching interval) and an IP address, it is possible to determine whether the IP address is in this interval by comparing the size of the integer. In this way, each element in the network quintuple can be regarded as an unsigned integer, thereby converting the policy matching problem into a problem of comparing the size of integers and determining whether a certain integer exists in a certain interval.

[0045] The present invention uses a list to maintain the information of all policy intervals of a tuple, and the elements in the list are integer intervals connected head to tail; at the beginning, the list is initialized to have only one element, and its interval is [0, MAX]; MAX is the maximum value allowed for this element, such as for an IPv4 address, because it is regarded as a 4-byte unsigned integer, so MAX = 0xFFFFFFFF.

[0046] This list and its elements must satisfy the following three constraints:

[0047] ①The starting value of the first interval is 0, and the ending value of the last interval is MAX;

[0048] ②The end value of the same interval is greater than or equal to the starting value;

[0049] ③The starting value of the next interval in the list is the ending value of the previous interval plus 1.

[0050] The list that satisfies the above three constraints is a monotonically non-decreasing interval list. There is no intersection between different intervals, and the union of all intervals is [0, MAX].

[0051] After obtaining such a list, for an input IP address that needs to be matched, because the list has been sorted into a monotone non-decreasing order, for a list with n intervals, the binary search method can be used to find which interval this input IP address exists in with a time complexity of O(log n), and the search speed is relatively fast. Assuming that the maximum number of security policies (security policies are referred to as policies) allowed is N, each security policy needs to be assigned a policy index number in the range of [0, N-1]; at the same time, each interval needs to maintain a bitmap, and the bit length of this bitmap is N. If the security policy with index number x includes this interval, the x+1th bit of this interval bitmap is set to 1, otherwise it is 0; therefore, the bitmap of an interval contains all the security policy index number information that includes this interval. After locating the corresponding interval through input and obtaining this bitmap, by scanning the bitmap once, it is possible to find which security policies define the range that includes this input IP address.

[0052] For the case of a five-tuple, five independent lists are maintained for the five elements (five fields). After five binary searches of the five-element list, five bitmaps of the same length can be obtained. The five bitmaps are bitwise ANDed to obtain the security policy index number that satisfies the matching conditions on the five elements at the same time, that is, the policy index number that is finally matched. For a single element, there may be multiple policy index numbers that contain the input value, but if there is no error in the policy definition process, there should be only one policy index number that is finally matched, otherwise it means that there are different policy index numbers with exactly the same matching conditions.

[0053] 2. Working Principle

[0054] The core of the present invention is how to maintain this list and bitmap, and how to use this list and bitmap to support the addition, deletion, modification and query of policies. This process will be described in detail below:

[0055] ①Search strategy:

[0056] The process of finding a strategy has been described above. Here is a summary again:

[0057] According to the input value of each element, the binary search method is applied to the list corresponding to each element to find the interval containing this value and obtain the bitmap corresponding to this interval; the five bitmaps of equal length corresponding to the five elements are bitwise ANDed to obtain the corresponding policy index number.

[0058] Because the number of executions of the search operation is much greater than the number of executions of the addition, deletion and modification operations in actual application scenarios, how to improve the execution speed of the search operation becomes the key. According to the method of the present invention, considering the worst case, that is, the addition of each new strategy will introduce 2 new intervals into each element, assuming that the maximum number of strategies allowed is N, the time complexity of the binary search method is 5*O(log N)=O(log N), the time complexity of the bitmap scan is O(N), and the total time complexity is O(N)+O(log N). Among them, the binary search method part itself is already an efficient O(log N) time complexity, and the bitmap scan part uses efficient bit operations, and the constant factor is extremely low after special optimization, so the method of the present invention has a higher search efficiency. According to actual tests, in a typical scenario where 3000 strategies exist, the present invention, as a pure software implementation, can take microseconds to find strategies.

[0059] ②Add strategies:

[0060] For the case of one-tuples, the increase strategy consists of two steps: interval splitting and bitmap updating.

[0061] Interval splitting: For the new strategy with the added strategy interval [X, Y], split the original list at X and Y respectively and split the new interval, let X be the starting value of the new interval on the right side of the break position at X, let Y be the ending value of the new interval on the left side of the break position at Y, and make necessary adjustments to the list to meet the three constraints on the list mentioned above, such as Figure 1 shown.

[0062] After the interval splitting is completed, each interval will completely meet the matching conditions of one or some strategies. There is no situation where part of the values ​​in a certain interval meet the matching conditions of a certain strategy while the other part does not.

[0063] Bitmap update: The interval splitting should not affect the matching process of other intervals and strategies, and the new interval formed after the splitting is a sub-interval of the interval before the splitting, so the bitmap of the new interval needs to inherit the bitmap of the interval before the splitting; at the same time, after the interval splitting, for all new intervals in the range [X, Y], the corresponding bits of the strategy index number in the bitmap of the new interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this strategy, such as Figure 2 shown.

[0064] For a quintuple, the above process can be performed separately on the interval list corresponding to the quintuple.

[0065] ③Deletion strategy:

[0066] The deletion strategy can be understood as the reverse process of the addition strategy. For the case of a tuple, there are also two steps: bitmap update and interval merging.

[0067] Bitmap update: For the deleted policy with the policy interval [A, B], set the bits corresponding to the policy index number in the bitmap of all intervals in the range [A, B] to 0.

[0068] Interval merging: For strategies with conditional intervals of [A, B], after deletion, it is necessary to consider whether to merge the intervals on both sides of the starting value A and the ending value B into a larger interval; however, because there may be other strategies with the starting value A or the ending value B as the boundary value, the intervals cannot be merged in this case. Therefore, the specific processing method is: after the bitmap is updated, for the interval with the starting value A, compare the bitmap of this interval with the previous interval. If they are exactly the same, it means that there is no other strategy with the starting value A as the boundary value, so the two intervals can be merged into a larger interval, otherwise the intervals cannot be merged. For the interval with the ending value B, compare the bitmap of this interval with the bitmap of the next interval, and the processing flow is the same as above.

[0069] For a quintuple, the above process can be performed separately on the interval list corresponding to the quintuple.

[0070] ④Modification strategy:

[0071] To modify the policy, first delete the policy and then add the policy.

[0072] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network quintuple matching method based on an ordered interval list, characterized in that: The security policy matching of the network quintuple is implemented as follows: If the sender's IP address is an IPv4 address, it is considered a 4-byte unsigned integer. If it is an IPv6 address, it is considered a 16-byte unsigned integer. The matching condition in the security policy divides the IP address into an interval. The IP address is considered an integer, and this interval is considered an integer interval. Therefore, given a policy interval and an IP address, it is determined whether the IP address is in this interval by comparing the integer size. In the same way, each element in the network quintuple is regarded as an unsigned integer, so that the policy matching problem is converted into the problem of comparing the size of integers and judging whether an integer exists in a certain interval; Furthermore, a list is designed to maintain the information of all the strategy intervals of a tuple, and the elements in the list are integer intervals connected from beginning to end; Initially, the list is initialized to have only one element, and its range is [0, MAX]; MAX is the maximum value allowed for this element; This list and its elements must satisfy the following three constraints: 1 The starting value of the first interval is 0, and the ending value of the last interval is MAX; 2 The end value of the same interval is greater than or equal to the starting value; 3 The starting value of the next interval in the list is the ending value of the previous interval plus 1; The list that satisfies the above three constraints is a monotonically non-decreasing interval list. There is no intersection between different intervals, and the union of all intervals is [0, MAX]; After obtaining such a list, for an input IP address that needs to be matched, since the list has been sorted into a monotone non-decreasing order, for a list with n intervals, the binary search method is used with a time complexity of O(logn) to find which interval this input IP address exists in; Assume that the maximum number of security policies allowed is N, and assign a policy index number in the range of [0, N-1] to each security policy; at the same time, each interval maintains a bitmap, and the bit length of this bitmap is N. If the security policy with index number x includes this interval, the x+1th bit of this interval bitmap is set to 1, otherwise it is 0; therefore, the bitmap of an interval contains the index number information of all security policies that include this interval. After locating the corresponding interval through input and obtaining this bitmap, by scanning the bitmap once, you can find out which security policies define the range that includes this input IP address; For the case of a quintuple, five independent lists are maintained for each of the five elements. After five binary searches of the five-element list, five bitmaps of the same length can be obtained. The five bitmaps are bitwise ANDed to obtain the security policy index number that satisfies the matching conditions on the five elements at the same time, that is, the policy index number that is finally matched.

2. The method according to claim 1, characterized in that For a single element, there may be multiple policy index numbers that contain the input value. However, if there is no error in the policy definition process, only one policy index number should be finally matched. Otherwise, it means that the matching conditions of different policy index numbers are exactly the same.

3. The method according to claim 1, characterized in that The method also implements adding, deleting, modifying and checking security policies by maintaining a list and a bitmap corresponding to each policy interval.

4. The method according to claim 3, characterized in that The search for security policies is implemented in the following way: according to the input value of each element, a binary search method is applied to the list corresponding to each element to find the interval containing this input value, and obtain the bitmap corresponding to this interval; Perform bitwise AND on the five bitmaps of equal length corresponding to the five elements to obtain the corresponding policy index number.

5. The method according to claim 3, characterized in that The security policy can be added in the following ways: For the case of one-tuple, the increase strategy consists of two steps: interval splitting and bitmap updating; Interval splitting: For the new strategy with the added strategy interval [X, Y], split the original list at X and Y respectively and split the new intervals, let X be the starting value of the new interval on the right side of the break position at X, let Y be the ending value of the new interval on the left side of the break position at Y, and make necessary adjustments to the list to meet the three constraints on the list mentioned above; Bitmap update: The new interval formed after the split is a sub-interval of the interval before the split, so the bitmap of the new interval needs to inherit the bitmap of the interval before the split; at the same time, after the interval is split, for all new intervals in the [X, Y] range, the corresponding bits of the corresponding policy index numbers in the bitmap of the new interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this policy; For a quintuple, interval splitting and bitmap updating can be performed on the interval list corresponding to the quintuple.

6. The method according to claim 5, characterized in that To delete a security policy, use the following methods: Deleting a security policy is the reverse process of adding a security policy. For the case of a tuple, there are also two steps: bitmap update and interval merging; Bitmap update: For the deleted policy with the policy interval [A, B], set the bits corresponding to the corresponding policy index numbers in the bitmaps of all intervals in the range [A, B] to 0; Interval merging: For the strategy whose strategy interval is [A, B], the processing method is as follows: after the bitmap is updated, for the interval with the starting value A, compare the bitmap of this interval with the previous interval. If they are exactly the same, it means that there is no other strategy with the starting value A as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval. Otherwise, the interval cannot be merged. For the interval with the ending value B, compare the bitmap of this interval with the next interval. If they are exactly the same, it means that there is no other strategy with the ending value B as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval. For a quintuple, bitmap update and interval merging can be performed on the interval list corresponding to the quintuple.

7. The method according to claim 6, characterized in that To modify a security policy, first delete the security policy and then add the security policy.

8. A system for implementing the method according to any one of claims 1 to 7.

9. A network firewall designed and implemented based on the method as claimed in any one of claims 1 to 7.

10. A network communication method implemented based on the method according to any one of claims 1 to 7.

Images