Data protection method and system for Linux system and storage medium

Abstract

The invention discloses a data protection method and system for a Linux system and a storage medium, and relates to the field of communication data security. The method comprises the following steps of: mapping each data protection rule into a unique rule bit vector; obtaining a matching item of each data protection rule, and determining a matching bit vector of the matching item; after a network data packet is acquired, acquiring a matching bit vector of each matching item; performing bit AND operation on all the matching bit vectors corresponding to the current network data packet to obtain a rule bit vector; and determining and executing a corresponding data protection rule according to the rule bit vector. According to the method, no matter how many data protection rules are, the matching time is the time for directly determining the matching bit vector corresponding to each matching item and carrying out one-time bit and operation, so that the rule matching time is remarkably shortened, and the processing time of data protection is greatly shortened accordingly.

Description

Technical Field

[0001] The present invention relates to the field of communication data security, and in particular to a data protection method, system and storage medium for a Linux system. Background Art

[0002] With the rapid development of information technology and the Internet, various network technologies emerge in an endless stream, new network threats continue to emerge, uninterrupted network scanning behavior and increasing network traffic have brought unprecedented challenges to network security. Faced with these challenges, traditional network security measures can no longer meet the needs of modern network environments. Therefore, the development and application of host firewall technology has become particularly critical. As an important part of the network security system, host firewalls can not only effectively control network access in and out of the host, but also provide comprehensive protection against internal and external network threats. Host firewalls build a line of defense for network security by implementing refined access control strategies, monitoring network traffic, and identifying and blocking potential threats.

[0003] In Linux systems, iptables (a management tool for Linux firewalls working in user space) / nftables (a tool for managing the Linux kernel network stack) is a mainstream host firewall solution. Iptables / nftables is built on the netfilter framework of the Linux kernel. Netfilter is a network packet filtering framework built into the Linux kernel that allows various network-related operations, including packet filtering, packet modification, network address translation (NAT), and load balancing. By using this framework, iptables / nftables provides a method for filtering, modifying, and redirecting network packets, thereby achieving precise control and management of network traffic.

[0004] Specifically, iptables / nftables protects data by defining a series of rules to manage network traffic. These rules match network packets based on multiple attributes such as source IP address, destination IP address, transport protocol, source and destination ports, network interface, etc. Once a match is successful, the rules will be used to decide how to handle these network packets. The rules include allowing (ACCEPT) packets to pass, rejecting (DROP) packets, redirecting (REDIRECT) network packets to another address, or modifying network packets (such as NAT through MASQUERADE).

[0005] However, iptables / nftables will encounter performance bottlenecks when processing a large number of rules, because their design principles result in a matching time complexity of O(N). This means that as the number of rules increases, the time required to process each network packet will also increase linearly, thus affecting the performance of Linux systems and businesses.

[0006] For example, for network attacks such as DDoS (Distributed Denial of Service), earlier packet loss can better alleviate the loss of system CPU. However, using iptables / nftables as a means of preventing DDOS attacks is often ineffective. This is because iptables / nftables is implemented based on the netfilter framework. Even if the attack message is discarded at the PREROUTING hook point of the netfilter framework (the earliest hook point in the packet receiving path), it has already gone through many processing processes of the Linux network protocol stack. Summary of the invention

[0007] In view of the defects existing in the prior art, the technical problem solved by the present invention is: when performing data protection, how to significantly shorten the data protection process of network data packets on the basis of reducing system resource consumption, thereby improving data protection capabilities and network traffic management performance.

[0008] To achieve the above objectives, in a first aspect, an embodiment of the present application provides a data protection method for a LINUX system, comprising the following steps:

[0009] Map each data protection rule into a unique rule bit vector;

[0010] Get the matching items of each data protection rule, including basic matching items and rule matching items:

[0011] For a rule match item and a unique basic match item, the data protection bit vector corresponding to the match item is used as a match bit vector;

[0012] For a non-unique basic matching item that appears in at least two data protection rules at the same time, each data protection bit vector corresponding to the matching item is bitwise ORed and used as the matching bit vector of the matching item;

[0013] After obtaining the network data packet, obtain the matching bit vector of each matching item; perform bitwise AND operation on all matching bit vectors corresponding to the current network data packet to obtain a rule bit vector; determine and execute the corresponding data protection rule according to the rule bit vector.

[0014] In combination with the first aspect, in one embodiment, after the matching bit vector is determined, the following steps are also included: storing the values ​​of matching items of the same type and the corresponding matching bit vectors into the same database; the process of obtaining the matching bit vector of each matching item includes: obtaining the matching bit vector corresponding to the value of the current matching item from the database corresponding to the type of the current matching item.

[0015] In conjunction with the first aspect, in one implementation, the process of executing the data protection rule includes: determining an execution operation of the data protection rule:

[0016] If the execution operation is accept or empty, it is determined that the network data packet does not need protection;

[0017] If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

[0018] In combination with the first aspect, in one implementation, the basic matching items of the data protection rule include: source address, destination address, destination port and protocol, and the rule matching items include execution operations.

[0019] In combination with the first aspect, in one implementation, the length of each protection rule bit vector is the same, and the upper limit of the length is 8192.

[0020] In a second aspect, an embodiment of the present application provides a computer-readable storage medium, on which a data protection program for a LINUX system is stored, and when the computer program is executed, the method provided in the first aspect is implemented.

[0021] In a third aspect, an embodiment of the present application provides a data protection system for a LINUX system, the system comprising a bit vector preset module, a traffic capture module and a data protection module;

[0022] The bit vector preset module is used to: map each data protection rule into a unique rule bit vector;

[0023] Get the matching items of each data protection rule, including basic matching items and rule matching items:

[0024] For a rule match item and a unique basic match item, the data protection bit vector corresponding to the match item is used as a match bit vector;

[0025] For a non-unique basic matching item that appears in at least two data protection rules at the same time, each data protection bit vector corresponding to the matching item is bitwise ORed and used as the matching bit vector of the matching item;

[0026] The traffic capture module is used to: capture network data packets and send them to the data protection module;

[0027] The data protection module is used to: obtain the matching bit vector of each matching item; perform bitwise AND operation on all matching bit vectors corresponding to the current network data packet to obtain a rule bit vector; and determine and execute the corresponding data protection rule according to the rule bit vector.

[0028] In conjunction with the third aspect, in one embodiment, the system further includes a data storage module, which is used to: create an alarm database and a matching item database corresponding to each type of matching item;

[0029] The bit vector preset module is further used to: store the value of the matching item and the matching bit vector into the corresponding matching item database according to the type of the matching item;

[0030] The process of the data protection module obtaining the matching bit vector of each matching item includes: obtaining the matching bit vector of each matching item from a database of each matching item type;

[0031] The process of the data protection module executing the corresponding data protection rules includes:

[0032] Determine the execution action of the data protection rule:

[0033] If the execution operation is accept or empty, it is determined that the network data packet does not need protection and is released;

[0034] If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

[0035] In conjunction with the third aspect, in one implementation, the traffic capture module includes:

[0036] Inbound traffic capture module, which is used to: capture inbound network data packets and send them to the data protection module;

[0037] The outbound traffic capture module is used to capture outbound network data packets and send them to the data protection module.

[0038] In combination with the third aspect, in one implementation, the data protection module uses eBPF; the database is an eBPF map; the inbound traffic capture module is implemented through XDP; and the outbound traffic capture module is implemented through TC.

[0039] Compared with the prior art, the advantages of the present invention are:

[0040] The present invention processes the data protection rules through linear bit vectors. After that, the matching rules only need to parse the matching items and determine their matching bit vectors. Then, the matching bit vectors can be operated and the rule bit vectors can be obtained. According to the rule bit vectors, the data protection rules can be directly determined and executed.

[0041] Therefore, compared with the O(N) time complexity of the matching in the prior art, the matching time of the present invention is the time to directly determine the matching bit vector corresponding to each matching item and perform a bitwise AND operation, regardless of the number of data protection rules, which significantly shortens the rule matching time, and thus greatly shortens the data protection processing time. At the same time, while shortening the rule matching time, it also greatly reduces the system resource consumption, thereby improving the processing capacity of the host firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 This is a schematic diagram of the working process of the data protection system for Linux system in an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of the hardware structure of a data protection device for a LINUX system involved in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0046] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0047] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0048] In a first aspect, an embodiment of the present application provides a data protection method for a LINUX system, the method comprising the steps of:

[0049] (1) Obtain data protection rules and map each data protection rule into a unique rule bit vector.

[0050] (2) Obtain the matching items of each data protection rule, including basic matching items and rule matching items:

[0051] For a rule match item and a unique basic match item, the data protection bit vector corresponding to the match item is used as a match bit vector;

[0052] For a non-unique basic matching item that appears in at least two data protection rules at the same time, each data protection bit vector corresponding to the matching item is bitwise ORed and used as the matching bit vector of the matching item;

[0053] (3) After obtaining the network data packet (inbound traffic and outbound traffic), the network data packet is parsed into matching items, and the matching bit vector of each matching item is obtained; after performing a bitwise AND operation on all matching bit vectors corresponding to the current network data packet, a rule bit vector is obtained; and the corresponding data protection rule is determined and executed according to the rule bit vector.

[0054] It can be seen that the present invention processes the data protection rules through linear bit vectors. After that, the matching rules only need to parse the matching items and determine their matching bit vectors. The matching bit vectors can be bit-ANDed to obtain the rule bit vectors. According to the rule bit vectors, the data protection rules can be directly determined and executed.

[0055] Therefore, compared with the O(N) time complexity of the matching in the prior art, the matching time of the present invention is the time to directly determine the matching bit vector corresponding to each matching item and perform a bitwise AND operation, regardless of the number of data protection rules, which significantly shortens the rule matching time, and thus greatly shortens the data protection processing time. At the same time, while shortening the rule matching time, it also greatly reduces the system resource consumption, thereby improving the processing capacity of the host firewall.

[0056] In summary, the present invention improves the performance of network traffic management and enhances the defense capability against DDoS attacks through efficient network data packet processing and rule matching mechanism.

[0057] In one embodiment, the length of each protection rule bit vector in the above method is the same, and the upper limit of the length is 8192.

[0058] In one embodiment, the basic matching items of the data protection rules in the above method include: source address (src ip), destination address (dst ip), destination port (dst port) and protocol (protocol, tcp / udp / icmp), that is, a network quintuple (which may not have a source port), and the rule matching items include execution operations (action, such as DROP or ACCEPT). For example, the above non-unique basic matching items: if the source addresses in the two data protection rules are the same, both are 192.168.1.1, then 192.168.1.1 is a non-unique basic matching item.

[0059] The following is a specific example to illustrate the process of "linear bit vector" in (1) to (3) above.

[0060] It is defined that there are 4 data security protection rules, and the corresponding rule bit vector length is 4:

[0061] Rule1: SourceIP = 192.168.1.1, DestinationIP = 8.8.8.8, DestinationPort = 80, Protocol = TCP, Action = DROP, the rule bit vector of Rule1 is 0001;

[0062] Rule2: SourceIP = 192.168.1.1, DestinationIP = 1.1.1.1, DestinationPort = 443, Protocol = TCP, Action = ACCEPT, the rule bit vector of Rule2 is 0010;

[0063] Rule3: SourceIP = 192.168.2.1, DestinationIP = 8.8.8.8, DestinationPort = 53, Protocol = UDP, Action = ACCEPT, the rule bit vector of Rule3 is 0100;

[0064] Rule4: SourceIP=192.168.2.1, DestinationIP=1.1.1.1, DestinationPort=53, Protocol=UDP, Action=DROP. The rule bit vector of Rule4 is 1000.

[0065] Split each data security protection rule into matching items: SourceIP, DestinationIP, DestinationPort, Protocol, Action);

[0066] Create a match bit vector for each match:

[0067] If multiple rules use the same source IP, perform a bitwise OR operation on the IDs of these rules:

[0068] For SourceIP:

[0069] 192.168.1.1->0011(0001|0010)

[0070] 192.168.2.1->1100(0100|1000)

[0071] For DestinationIP:

[0072] 8.8.8.8->0101(0001|0100)

[0073] 1.1.1.1->1010(0010|1000)

[0074] For DestinationPort:

[0075] 80->0001

[0076] 443->0010

[0077] 53->1100(0100|1000), 80 and 443 are the only base matches;

[0078] For Protocol:

[0079] TCP->0011(0001|0010)

[0080] UDP->1100(0100|1000)

[0081] For action:

[0082] 0001=>DROP

[0083] 0010=>ACCEPT

[0084] 0100=>ACCEPT

[0085] 1000=>DROP.

[0086] After receiving the network data packet and splitting it into matching items, first determine the matching bit vector of the specific matching item, and then perform a bitwise AND operation (AND) on all matching bit vectors of the network data packet to obtain the rule bit vector of the network data packet, that is, find the corresponding data protection rule.

[0087] In one embodiment, after obtaining the matching bit vector in the above method, the following steps are also included: storing the values ​​of matching items of the same type and the corresponding matching bit vectors into the same database; on this basis, the process of obtaining the matching bit vector of each matching item in the above method includes: obtaining the matching bit vector corresponding to the value of the current matching item from the database corresponding to the type of the current matching item.

[0088] In this way, the matching bit vector can be quickly searched according to the matching item type, thereby further shortening the matching time of the data protection rule.

[0089] In one embodiment, the process of executing the data protection rule in the above method includes: determining the execution operation of the data protection rule:

[0090] If the execution operation is accept or empty, it is determined that the network data packet does not need protection and is released;

[0091] If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

[0092] In a second aspect, an embodiment of the present application further provides a data protection system for a LINUX system, the system comprising a bit vector preset module, a data storage module, an inbound traffic capture module, an outbound traffic capture module and a data protection module.

[0093] The bit vector preset module is used to: map each data protection rule into a unique rule bit vector according to the method mentioned in the first aspect, and determine the matching bit vector corresponding to the matching item of the data protection rule; according to the type of the matching item, store the value of the matching item and the matching bit vector into the corresponding matching item database.

[0094] The data storage module is used to create an alarm database and a matching item database corresponding to each type of matching item.

[0095] The inbound traffic capture module is used to capture inbound network data packets and send them to the data protection module.

[0096] The outbound traffic capture module is used to capture outbound network data packets and send them to the data protection module.

[0097] The data protection module is used to: parse the network data packet into matching items, obtain the matching bit vector of each matching item from the database of each matching item type; perform bitwise AND operation on all matching bit vectors corresponding to the current network data packet to obtain the rule bit vector; determine and execute the corresponding data protection rule according to the rule bit vector; the execution process is as follows:

[0098] Determine the execution action of the data protection rule:

[0099] If the execution operation is accept or empty, it is determined that the network data packet does not need protection and is released;

[0100] If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

[0101] The implementation of some of the above modules is as follows:

[0102] The data protection module uses eBPF (extended Berkeley Packet Filter, a lightweight virtual machine based on the kernel); the database is eBPF map (a general data structure that stores different types of data, providing functions such as user-mode and kernel-mode data interaction, data storage, and multi-program data sharing);

[0103] The inbound traffic capture module is implemented through XDP (eXpress Data Path, a kernel technology); XDP is used in conjunction with eBPF to perform high-performance data packet processing in the Linux system kernel. XDP allows users to quickly process data packets during the data packet reception phase, achieving zero-copy data packet processing, data packet filtering, DDoS defense and other functions, thereby improving system performance and network security.

[0104] The outbound traffic capture module is implemented through TC (Traffic Control), which is used to manage and schedule network traffic in Linux systems. In eBPF TC, users can classify, schedule and filter network packets by writing eBPF programs, thereby achieving more refined traffic control and management.

[0105] By processing inbound traffic at the XDP level, processing outbound traffic at the TC (Traffic Control) level, and using linear bit vector search (LinearBitVectorSearch) technology to optimize the rule matching process, the present invention can significantly reduce network latency, reduce system resource consumption, and improve the processing capability of the host firewall.

[0106] See below Figure 1 As shown, the workflow of the above system is explained through a specific example.

[0107] Deployment process: Deploy the firewall probe agent on the Linux server (Linux host), including the user-state agent and the kernel-state agent. The user-state agent attaches the kernel-state agent to the server's designated network card and injects the kernel-state agent into the XDP and TCegress processing flow in the kernel, that is, hooks XDP and TC egress.

[0108] Bit vector mapping process: The user-state agent receives the firewall rules (i.e., data protection rules) issued by the control layer, determines the rule bit vector and match bit vector of each firewall rule according to the relevant process above, and stores the match value and match bit vector in the corresponding match database (eBPF map, rule map in the figure).

[0109] Rule matching process:

[0110] Get network traffic data packets. Specifically, when inbound traffic arrives at the network card, the XDP hook is triggered; when outbound traffic arrives at the network card, the TC egress hook is triggered.

[0111] XDP hook or TC egress hook extracts and parses the matching items from the network data packet, and determines the matching bit vector and rule bit vector of the parsed matching items according to the above process, and obtains the data protection rules of the current network data packet (rule matching in the figure). Look up the execution operation (DROP or ACCEPT) corresponding to the data protection rule in the eBPFMap of the execution operation, and decide whether the traffic is DROP or ACCEPT according to the execution operation. If the ruleid does not exist in the eBPF map of the execution operation, the data packet is released by default. If the traffic is DROP, XDPhook generates an alarm for the DROP traffic information and writes it to the alarm eBPF map.

[0112] Rule modification process: The control layer adds, deletes, modifies and checks firewall rules, and sends the firewall rules to the user-state agent, which executes the above bit vector mapping process.

[0113] Alarm display process: The user-state agent reads the alarm log from the alarm eBPF map, writes the alarm log to the presentation layer, and the presentation layer displays the alarm log.

[0114] In summary, the advantages of the above system include:

[0115] (1) Improving the network packet processing rate: By intercepting and processing network packets at the earliest stage of entering the network stack through eBPF XDP, and controlling outbound traffic through eBPF TC, the present invention greatly reduces the time delay of network packet processing and significantly improves the network packet processing rate.

[0116] (2) Efficient rule matching mechanism: The rule matching mechanism implemented using linear bit vector search technology greatly improves the matching efficiency compared to traditional sequential search or tree search, especially when the rule set is large, it can significantly reduce the time required for rule matching.

[0117] (3) Improved DDoS defense capabilities: Combined with the fast processing of eBPF XDP and the optimized rule matching mechanism, this solution can effectively identify and filter DDoS attack traffic, reduce the consumption of host resources by malicious traffic, and enhance the system's ability to resist large-scale DDoS attacks.

[0118] (4) Reduce resource consumption: By utilizing the efficient programming model of eBPF, the present invention reduces the pressure on the CPU and memory. Compared with traditional solutions, it can more economically utilize system resources to process large amounts of network traffic.

[0119] (5) High versatility and scalability: It can be applied to a variety of network environments. Due to the high flexibility and powerful functions of eBPF technology, the present invention is not only suitable for traditional data center or enterprise network environments, but can also easily meet the needs of complex network architectures such as cloud computing and edge computing. Easy to expand and customize: Using the eBPF programming model, this solution is easy to modify and expand on the existing basis, enabling network administrators to customize and update firewall rules according to changing network threats and policy requirements to meet personalized security needs.

[0120] In a third aspect, an embodiment of the present application provides a data protection device for a LINUX system. The data protection device for a LINUX system may be a personal computer (PC), a laptop computer, a server, or other device having a data processing function.

[0121] Reference Figure 2 , Figure 2 The hardware structure diagram of the data protection device for LINUX system involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the data protection device for LINUX system may include a processor, a memory, a communication interface and a communication bus.

[0122] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0123] The communication interface includes input / output (I / O) interface, physical interface and logical interface, etc., which are used to realize the interconnection of devices inside the data protection device for LINUX system, and the interface used to realize the interconnection between the data protection device for LINUX system and other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0124] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0125] The processor may be a general-purpose processor, and the general-purpose processor may call the data protection program for the LINUX system stored in the memory, and execute the data protection method for the LINUX system provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the data protection program for the LINUX system is called may refer to the various embodiments of the data protection method for the LINUX system of the present application, which will not be repeated here.

[0126] Those skilled in the art will understand that Figure 2 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0127] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.

[0128] The computer-readable storage medium of the present application stores a data protection program for a LINUX system, wherein when the data protection program for a LINUX system is executed by a processor, the steps of the data protection method for a LINUX system as described above are implemented.

[0129] Among them, the method implemented when the data protection program for the LINUX system is executed can refer to the various embodiments of the data protection method for the LINUX system of the present application, and will not be repeated here.

[0130] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0131] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0132] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0133] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0134] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0135] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0136] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0137] The above are only specific implementations of the embodiments of the present invention, but the protection scope of the embodiments of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the embodiments of the present invention, and these modifications or replacements should be included in the protection scope of the embodiments of the present invention. Therefore, the protection scope of the embodiments of the present invention shall be based on the protection scope of the claims.

Claims

1. A data protection method for a LINUX system, characterized in that: The method comprises the following steps: Map each data protection rule into a unique rule bit vector; Get the matching items of each data protection rule, including basic matching items and rule matching items: For a rule match item and a unique basic match item, the data protection bit vector corresponding to the match item is used as a match bit vector; For a non-unique basic matching item that appears in at least two data protection rules at the same time, each data protection bit vector corresponding to the matching item is bitwise ORed and used as the matching bit vector of the matching item; After obtaining the network data packet, obtain the matching bit vector of each matching item; perform bitwise AND operation on all matching bit vectors corresponding to the current network data packet to obtain a rule bit vector; determine and execute the corresponding data protection rule according to the rule bit vector.

2. The data protection method for LINUX system according to claim 1, characterized in that: After the matching bit vector is determined, the following steps are also included: the values ​​of matching items of the same type and the corresponding matching bit vectors are stored in the same database; the process of obtaining the matching bit vector of each matching item includes: obtaining the matching bit vector corresponding to the value of the current matching item from the database corresponding to the type of the current matching item.

3. The data protection method for LINUX system according to claim 2, characterized in that: The process of executing the data protection rule includes: determining the execution operation of the data protection rule: If the execution operation is accept or empty, it is determined that the network data packet does not need protection; If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

4. The data protection method for a LINUX system according to any one of claims 1 to 3, characterized in that: The basic matching items of the data protection rule include: source address, destination address, destination port and protocol, and the rule matching items include execution operation.

5. The data protection method for LINUX system according to any one of claims 1 to 3, characterized in that: The length of each protection rule bit vector is the same, and the upper limit of the length is 8192.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a data protection program for a LINUX system, wherein when the data protection program for a LINUX system is executed, the steps of the data protection method for a LINUX system as described in any one of claims 1 to 5 are implemented.

7. A data protection system for a LINUX system, characterized in that: The system includes a bit vector preset module, a traffic capture module and a data protection module; The bit vector preset module is used to: map each data protection rule into a unique rule bit vector; Get the matching items of each data protection rule, including basic matching items and rule matching items: For a rule match item and a unique basic match item, the data protection bit vector corresponding to the match item is used as a match bit vector; For a non-unique basic matching item that appears in at least two data protection rules at the same time, each data protection bit vector corresponding to the matching item is bitwise ORed and used as the matching bit vector of the matching item; The traffic capture module is used to: capture network data packets and send them to the data protection module; The data protection module is used to: obtain the matching bit vector of each matching item; perform bitwise AND operation on all matching bit vectors corresponding to the current network data packet to obtain a rule bit vector; and determine and execute the corresponding data protection rule according to the rule bit vector.

8. The data protection system for LINUX system according to claim 7, characterized in that: The system also includes a data storage module, which is used to: create an alarm database and a matching item database corresponding to each type of matching item; The bit vector preset module is further used to: store the value of the matching item and the matching bit vector into the corresponding matching item database according to the type of the matching item; The process of the data protection module obtaining the matching bit vector of each matching item includes: obtaining the matching bit vector of each matching item from a database of each matching item type; The process of the data protection module executing the corresponding data protection rules includes: Determine the execution action of the data protection rule: If the execution operation is accept or empty, it is determined that the network data packet does not need protection and is released; If the execution operation is to reject, it is determined that the network data packet needs to be protected, the reception of the network data packet is prohibited, and an alarm message is generated based on the information of the network data packet and stored in the alarm database.

9. The data protection system for LINUX system according to claim 8, characterized in that: The traffic capture module includes: Inbound traffic capture module, which is used to: capture inbound network data packets and send them to the data protection module; The outbound traffic capture module is used to capture outbound network data packets and send them to the data protection module.

10. The data protection system for LINUX system according to claim 9, characterized in that: The data protection module uses eBPF; the database is eBPF map; the inbound traffic capture module uses XDP; and the outbound traffic capture module is implemented through TC.

Images