Distributed firewall
By using hypervisor technology in containerized firewalls to encapsulate firewall functionality within lightweight virtual machines, the lack of strong isolation in containerized firewalls is resolved, achieving strong network isolation and improving system security and reliability.
Patent Information
- Application Number
- CN202411340986.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-25
- Publication Date
- 2025-01-10
AI Technical Summary
Existing containerized distributed firewalls lack strong isolation capabilities, resulting in low system security. Hackers can directly attack the host system when a zero-day vulnerability exists.
By encapsulating firewall functionality within a lightweight virtual machine using hypervisor technology, strong network isolation is achieved. Computational power scheduling is performed using container runtime interfaces and orchestration tools, and network optimization and policy updates are performed in conjunction with a lightweight Linux kernel and firewall controller.
It achieves strong network isolation in containerized firewalls, avoiding the weak isolation problem of traditional container runtimes, and improving system security and reliability.
Smart Images
Figure CN119299137A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of firewall technology, and in particular to a distributed firewall. Background Art
[0002] Distributed Firewall (DFW) is a network security technology that aims to distribute firewall functions to multiple nodes or hosts in the network instead of relying on a single centralized firewall device. It implements more flexible and sophisticated access control and traffic filtering by deploying firewall policies on each node or host, thereby enhancing the security of the entire network. Traditional distributed firewalls can be implemented through physical devices or virtual machines. In the era of cloud computing, the use of virtual machines is more common. In recent years, with the widespread application of cloud computing and microservice architecture, container technology has become the mainstream way to deploy modern applications.
[0003] Compared with distributed firewalls based on physical machines, containerized distributed firewalls effectively provide system flexibility, but they lack strong isolation. For example, Linkerd and Istio both implement the function of container firewalls by modifying the firewall rules of the host network. When the system is working normally, they do meet the designed security requirements. However, if there is a zero-day vulnerability in the system, hackers can directly attack the host system, thus putting the entire platform in danger.
[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0005] The main purpose of this application is to provide a distributed firewall, aiming to solve the technical problem that containerized firewalls in the prior art usually lack strong isolation, resulting in low system security.
[0006] To achieve the above objectives, the present application proposes a distributed firewall, which is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through hypervisor technology.
[0007] In one embodiment, the distributed firewall is provided with: a distributed firewall container unit and a container orchestration unit;
[0008] The container orchestration unit is configured to schedule computing power for the distributed firewall container unit based on a container runtime interface and a container orchestration tool.
[0009] In one embodiment, a Linux operating system kernel is provided in the distributed firewall container unit;
[0010] The distributed firewall container unit is configured to perform network interconnection through a container network interface, and the Linux operating system kernel is used to optimize the network when the network is interconnected.
[0011] In one embodiment, the distributed firewall is further provided with: a firewall controller;
[0012] The firewall controller is used to read the firewall deployment information from a preset distributed database;
[0013] The firewall controller is further configured to call the container orchestration unit to deploy and / or update the firewall based on the firewall deployment information.
[0014] In one embodiment, the firewall controller is further used to read the firewall policy from the preset distributed database;
[0015] The firewall controller is further used to update the firewall policy to the distributed firewall container unit.
[0016] In one embodiment, the firewall controller interfaces with a third-party traffic analysis system;
[0017] The firewall controller is also used to obtain the firewall policy from the third-party traffic analysis system when the connection is successful.
[0018] In one embodiment, the firewall controller is further configured to update the firewall policy online when a policy update request is detected.
[0019] In one embodiment, the container orchestration unit deploys the firewall in a cloud-native manner.
[0020] In one embodiment, the distributed firewall is further provided with: a firewall visualization interface;
[0021] The firewall visualization interface is used to visualize the firewall configuration information.
[0022] The present application provides a distributed firewall, and the present application discloses that the distributed firewall is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through the hypervisor technology; compared with the containerized distributed firewall in the prior art, which lacks strong isolation, when there is a zero-day vulnerability in the system, hackers can directly attack the host system, thereby affecting the security of the entire platform. Since the firewall function can be encapsulated into a lightweight virtual machine during container operation through the hypervisor technology in the present invention, strong network isolation is achieved, avoiding the strength problem of the traditional container when it is running, thereby solving the technical problem that the containerized firewall in the prior art usually lacks strong isolation, resulting in low system security. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0025] Figure 1 A schematic diagram of the structure provided for the distributed firewall embodiment of the present application;
[0026] Figure 2 A working principle diagram provided for the distributed firewall embodiment of this application.
[0027] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0028] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.
[0029] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.
[0030] The main solution of the embodiment of the present application is: the distributed firewall is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through hypervisor technology.
[0031] Since containerized distributed firewalls in existing technologies lack strong isolation, when there is a zero-day vulnerability in the system, hackers can directly attack the host system, affecting the security of the entire platform.
[0032] The present application provides a solution that can encapsulate the firewall function into a lightweight virtual machine during container runtime through hypervisor technology, thereby achieving strong network isolation and avoiding the strength and weakness problems of traditional container runtimes, thereby solving the technical problem that containerized firewalls in the prior art usually lack strong isolation, resulting in low system security.
[0033] Based on this, the embodiment of the present application provides a distributed firewall, referring to Figure 1 , Figure 1 A schematic diagram of the structure provided for the distributed firewall embodiment of the present application.
[0034] like Figure 1 As shown, in this embodiment, the distributed firewall is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through hypervisor technology.
[0035] It should be noted that the above-mentioned hypervisor technology is a virtual machine monitor (VMM). Hypervisor technology is a virtualization technology that allows multiple virtual computers to run on a physical computer and isolate them in different virtual environments. The main functions of the hypervisor include virtualized hardware resources, virtualized operating systems, resource allocation and scheduling, security isolation, and monitoring and management.
[0036] In practical applications, this solution can use the hypervisor to implement the container computing runtime and encapsulate the firewall function into a lightweight virtual machine, thereby achieving strong network isolation and avoiding the weak isolation problem of traditional container runtime. In this embodiment, the hypervisor provides a standard CRI (Container Runtime Interface, Container Runtime Interface) / CNI (Container Network Interface) scheduling interface to the outside world, so that the firewall can be containerized as a unit, thereby achieving large-scale distributed deployment.
[0037] In this embodiment, the distributed firewall is provided with: a distributed firewall container unit 10 and a container orchestration unit 20; the container orchestration unit 20 is configured to schedule computing power for the distributed firewall container unit 10 based on a container runtime interface and a container orchestration tool.
[0038] It should be noted that the above container runtime interface is the CRI (Container Runtime Interface) interface. The CRI interface is a standard interface provided by Kubernetes for integration with different container runtimes.
[0039] It is understandable that the above-mentioned container orchestration tool can be a tool for managing and coordinating a large number of containers. The container orchestration tool in this embodiment may include but is not limited to kubernetes. In practical applications, container orchestration tools enable developers and operation and maintenance personnel to efficiently manage large-scale container clusters by automating the management, deployment, scheduling and coordination of containers, ensuring the consistency and availability of applications in different environments. These tools are responsible for handling tasks such as container lifecycle management, resource allocation, network configuration, fault recovery and elastic scaling. Among them, the container orchestration tool kubernetes used in this embodiment can provide a complete set of powerful functions, including deployment management, automatic expansion, load balancing, storage orchestration, network management and fault recovery.
[0040] In this embodiment, the distributed firewall container unit 10 can be a container that complies with the OCI (Open Container Initiative) standard. By providing a standard container runtime interface, it allows the container orchestration unit to schedule its computing power through the container runtime interface to achieve large-scale flexible and agile scheduling of distributed firewalls, overcoming the clumsiness and unreliability of the old scheduling system. In addition, this solution also allows the distributed firewall to use the distributed storage in the container platform to save system configuration data, thereby greatly improving the reliability of the entire firewall platform.
[0041] Furthermore, a Linux operating system kernel is provided in the distributed firewall container unit 10; the distributed firewall container unit 10 is configured to perform network interconnection through a container network interface, and the Linux operating system kernel is used to optimize the network when the network is interconnected.
[0042] It should be noted that the distributed firewall container unit 10 in this embodiment can provide a Linux operating system kernel, which can be optimized for the network, wherein the general Linux kernel after decompression is generally in the range of several hundred MB to 1 GB. In this optimized Linux kernel, modules not related to network communication can be cut out, so that the kernel can become very lightweight, and thus can be started quickly. In addition, the streamlined system can clean up software with security vulnerabilities, thereby reducing the system attack surface and improving system security.
[0043] In this embodiment, the distributed firewall is also provided with: a firewall controller 30; the firewall controller 30 is used to read firewall deployment information from a preset distributed database; the firewall controller 30 is also used to call the container orchestration unit 20 to deploy and / or update the firewall based on the firewall deployment information.
[0044] It should be understood that the above-mentioned preset distributed database can be a distributed key-value storage-based database. In this embodiment, the preset distributed database can include but is not limited to the ETCD (Extended Distributed KeyValue) distributed database, wherein the ETCD distributed database is an open source distributed key-value storage database, which can provide shared configuration, service discovery, distributed locks and coordination functions for distributed systems, and this embodiment does not limit this.
[0045] It can be understood that the above firewall deployment information may be information required when deploying a firewall, such as: deployment location, deployment method, deployment configuration information, etc., and this embodiment does not impose any limitation on this.
[0046] In actual applications, the firewall controller 30 can read the deployment information of the firewall from the ETCD distributed database and call the container orchestration system to quickly deploy / update the firewall.
[0047] Furthermore, the firewall controller 30 is also used to read the firewall policy from the preset distributed database; the firewall controller 30 is also used to update the firewall policy to the distributed firewall container unit 10.
[0048] It should be understood that the above firewall policy can be a policy for controlling the device to forward traffic and perform integrated content security detection on the traffic, which is mainly used to control network mutual access across firewalls and control access to the device itself.
[0049] Furthermore, the firewall controller 30 is connected to a third-party traffic analysis system; the firewall controller 30 is also used to obtain a firewall policy from the third-party traffic analysis system when the connection is successful.
[0050] Furthermore, the firewall controller 30 is also used to update the firewall policy online when a policy update request is detected.
[0051] In actual applications, the firewall controller 30 can read the firewall policy from the storage system (including but not limited to the above-mentioned preset distributed database), or re-acquire the latest firewall policy from the third-party traffic analysis system by connecting to the third-party traffic analysis system, and update the latest firewall policy to the distributed firewall unit. In this embodiment, the firewall controller 30 can persist and update the firewall policy online when a policy update request is detected.
[0052] It should be noted that, in this embodiment, the container orchestration unit 20 adopts a cloud-native approach to deploy the firewall.
[0053] It should be understood that the cloud-native approach can be a new architectural approach based on technologies such as containerization, microservices, dynamics, and automation, which aims to improve the reliability, performance, and responsiveness of applications while reducing maintenance costs and the workload of developers. In this embodiment, by adopting a cloud-native approach to deploy and manage distributed firewalls, the efficiency of firewall deployment can be greatly improved.
[0054] In this embodiment, the distributed firewall is further provided with: a firewall visualization interface 40; the firewall visualization interface 40 is used to visualize the firewall configuration information.
[0055] It should be noted that the firewall visualization interface 40 in this embodiment is mainly used to provide a user interface, which includes system configuration, policy adjustment, system monitoring, etc. The firewall visualization interface 40 can visualize this information.
[0056] In the specific implementation, refer to Figure 2 , Figure 2 This is a working principle diagram provided for the distributed firewall embodiment of this application. Figure 2As shown, the distributed firewall proposed in this solution includes: a distributed firewall container unit, a container orchestration unit, a firewall controller and a firewall visualization interface, wherein the container orchestration unit can adopt an existing mature solution, such as k8s, and the other three units are provided by this solution. In this embodiment, the distributed firewall container unit (built on the basis of the TCP / IP protocol) allows the container orchestration unit to schedule its computing power through CRI and realize network interconnection through CNI. At the same time, a network-oriented optimization kernel (i.e., the above-mentioned Linux operating system kernel) can be provided in the distributed firewall container unit, which is used to optimize the network. In addition, in this embodiment, an ETCD distributed database can be provided in the container orchestration unit, and the deployment information of the firewall can be stored in the database, so that the subsequent firewall controller can read the deployment information of the firewall from the ETCD distributed database, and call the container orchestration system to quickly deploy / update the firewall. In addition, this solution can also display the configuration information of the system through the firewall visualization interface, thereby improving the user experience.
[0057] This embodiment provides a distributed firewall, and the method discloses that the distributed firewall is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through the hypervisor technology; compared with the containerized distributed firewall in the prior art, which lacks strong isolation, when there is a zero-day vulnerability in the system, hackers can directly attack the host system, thereby affecting the security of the entire platform. Since the firewall function can be encapsulated into the lightweight virtual machine during container operation through the hypervisor technology in this embodiment, strong network isolation is achieved, avoiding the strength and weakness problem of the traditional container operation, thereby solving the technical problem that the containerized firewall in the prior art usually lacks strong isolation, resulting in low system security.
[0058] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the distributed firewall of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.
[0059] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.
Claims
1. A distributed firewall, characterized in that: The distributed firewall is a containerized distributed firewall, and the firewall function of the distributed firewall is encapsulated into a lightweight virtual machine through hypervisor technology.
2. The distributed firewall according to claim 1, characterized in that: The distributed firewall is provided with: a distributed firewall container unit and a container orchestration unit; The container orchestration unit is configured to schedule computing power for the distributed firewall container unit based on a container runtime interface and a container orchestration tool.
3. The distributed firewall according to claim 2, characterized in that: The distributed firewall container unit is provided with a Linux operating system kernel; The distributed firewall container unit is configured to perform network interconnection through a container network interface, and the Linux operating system kernel is used to optimize the network when the network is interconnected.
4. The distributed firewall according to any one of claims 1 to 3, characterized in that: The distributed firewall is also provided with: a firewall controller; The firewall controller is used to read the firewall deployment information from a preset distributed database; The firewall controller is further configured to call the container orchestration unit to deploy and / or update the firewall based on the firewall deployment information.
5. The distributed firewall according to claim 4, characterized in that: The firewall controller is further used to read the firewall policy from the preset distributed database; The firewall controller is further used to update the firewall policy to the distributed firewall container unit.
6. The distributed firewall according to claim 4, characterized in that: The firewall controller is connected to a third-party traffic analysis system; The firewall controller is also used to obtain the firewall policy from the third-party traffic analysis system when the connection is successful.
7. The distributed firewall according to any one of claims 5 to 6, characterized in that: The firewall controller is further configured to update the firewall policy online when a policy update request is detected.
8. The distributed firewall according to claim 4, characterized in that: The container orchestration unit deploys the firewall in a cloud-native manner.
9. The distributed firewall according to any one of claims 1 to 3, characterized in that: The distributed firewall is also provided with: a firewall visualization interface; The firewall visualization interface is used to visualize the firewall configuration information.