Data flow processing method and device, equipment and storage medium

Abstract

The invention discloses a data flow processing method, a data flow processing device, data flow processing equipment and a storage medium, which are applied to the field of data forwarding, original IP (Internet Protocol) information is stored by using an IPv6 (Internet Protocol version 6) extension header, and messages are transmitted in combination with SRv6, so that a request message and a response message corresponding to the request message can be received or sent by the same WAF (Wireless Application Function) protection module; and load balancing under the WAF system can be met. Moreover, the message is transmitted by using the standard IPv6 / SRv6, so that the network environment deployed by the system does not need to be specially transformed, and the adaptability is high; and compared with a mode of acquiring a real request source IP by installing a TOA module, the method does not need to carry out invasive modification on an operating system protocol stack and a system function, and is more universal.

Description

Technical Field

[0001] The present invention relates to the field of data forwarding, and in particular to a data flow processing method, device, equipment and storage medium. Background Art

[0002] Since the load balancing function is added to the load system, there will be multiple WAF (Web Application Firewall) protection modules, and during the message transmission process, the request message and its corresponding response message must be received or sent by the same WAF protection module. Regardless of whether the WAF protection module accesses the protected service station through the load module or not, since the WAF protection module uses the forged IP (Internet Protocol) address of the original client, when the protected site sends back a response message, it cannot know which WAF protection module the message should be sent to, which will cause processing exceptions. If the load system uses a fixed IP hash algorithm to load the client and search for the target WAF protection module, such a fixed IP hash algorithm will cause load imbalance in many scenarios.

[0003] Therefore, how to meet the WAF processing characteristics that the request message and its corresponding response message must be received or sent by the same WAF protection module under a load system, and also achieve load balancing is an urgent problem that needs to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a data flow processing method, device, equipment and storage medium, which solves the problem in the prior art that request messages and their corresponding response messages cannot be received or sent by the same WAF protection module and load balanced.

[0005] In order to solve the above technical problems, the present invention provides a data flow processing method, comprising:

[0006] Read the request message sent by the client and determine the target WAF protection module;

[0007] Add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message;

[0008] Sending the SRv6 request message to the target WAF protection module so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message;

[0009] Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0010] Read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0011] Optionally, the original IP information of the request message is added to an IPv6 extension header, and the request message is encapsulated according to the target WAF protection module to obtain an SRv6 request message, including:

[0012] At least the source IP address, source port, destination address and destination port of the request message are added to the IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0013] The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

[0014] Optionally, reading a response message returned by the protected server, searching from the cache according to the response message, determining the target WAF protection module, and sending the response message to the target WAF protection module, includes:

[0015] Read the response message returned by the protected server;

[0016] Determine the IP header information in the corresponding IPv6 Payload according to the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache;

[0017] Determine the target WAF protection module according to the source IP address in the IP header information in the IPv6 Payload;

[0018] The response message is sent to the target WAF protection module.

[0019] Optionally, recording the original IP information in the IPv6 extension header and the IP header information in the IPv6Payload in the SRv6 proxy request message in a cache includes:

[0020] The source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message are recorded in the cache.

[0021] Optionally, read the request message sent by the client and determine the target WAF protection module, including:

[0022] The request message sent by the client is read, and the target WAF protection module corresponding to the request message is determined by a hash algorithm.

[0023] Optionally, modifying IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forwarding the modified message to the protected server, including:

[0024] The IP header information in the IPv6 Payload is modified according to the original IP information in the IPv6 extension header, and the modified message is forwarded to the protected server using the SRv6 tunnel technology.

[0025] Optionally, before encapsulating the request message according to the target WAF protection module to obtain the SRv6 request message, the method further includes:

[0026] The segment identifier of the target WAF protection module is used as the last node of the SRv6 segment list.

[0027] The present invention also provides a data flow processing device, which is applied to a load module of a WAF system, comprising:

[0028] The target WAF protection module determination module is used to read the request message sent by the client and determine the target WAF protection module;

[0029] An SRv6 request message acquisition module, used to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message;

[0030] An SRv6 proxy request message acquisition module, used to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message;

[0031] A message modification module, used to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0032] A response message acquisition module is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0033] The present invention also provides a data flow processing device, comprising:

[0034] Memory for storing computer programs;

[0035] A processor is used to implement the above-mentioned data flow processing method when executing the computer program.

[0036] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the data flow processing method as described above is implemented.

[0037] It can be seen that the present invention uses the IPv6 extension header to store the original IP information, and combines it with the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing under the WAF system. In addition, the standard IPv6 / SRv6 transmission message is used, so the network environment deployed by the system does not need special modification and has strong adaptability; and compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, which is more universal.

[0038] In addition, the present invention also provides a data flow processing device, equipment and storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flowchart of a data flow processing method provided by an embodiment of the present invention;

[0041] Figure 2 A flowchart of a data flow processing method provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the data structure of an SRv6 request message provided in an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of a forwarding process of an SRv6 request message provided in an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of the data structure of an SRv6 proxy request message provided in an embodiment of the present invention;

[0045] Figure 6 A schematic diagram of a forwarding process of an SRv6 proxy request message provided in an embodiment of the present invention;

[0046] Figure 7 A schematic diagram of the structure of a data flow processing device provided by an embodiment of the present invention;

[0047] Figure 8 A schematic diagram of the structure of a data flow processing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] First, some nouns involved in this application are analyzed:

[0050] IPv6: The full name is Internet Protocol version 6. IPv6 has a larger address space and can meet the needs of more devices to access the Internet in the future. IPv6 supports automatic configuration, which enables network devices to automatically obtain IP addresses and related settings, simplifying network management and maintenance. IPv6 has been enhanced in terms of security, providing better data encryption and authentication mechanisms to protect the security of user data.

[0051] SRv6: Segment Routing IPv6, segment routing based on the IPv6 forwarding plane. Simply put, it is SR (Segment Routing) + IPv6, which is a new generation of IP bearer protocol. It uses the existing IPv6 forwarding technology and realizes network programmability through flexible IPv6 extension headers.

[0052] WAF: Web Application Firewall. Web application firewalls are usually deployed between the client and the protected web server in the form of reverse proxy, transparent proxy, transparent gateway, etc.

[0053] Transparent proxy: It is a proxy technology. Transparent proxy WAF is generally connected in series between the client and the protected Web server. The WAF system uses the protected Web server IP to establish a connection with the client, and uses the client IP address to establish a connection with the protected Web server.

[0054] Load distribution: It uses load balancing technology to distribute and forward network traffic to multiple network processing subsystems according to certain matching rules, thereby improving the processing capacity of large traffic and improving the robustness of the system.

[0055] TOA module: Time of Arrival, usually refers to a technology or tool used to record the arrival time of data packets.

[0056] In a WAF system without load balancing, it is relatively easy to modify the destination address of the message entering the WAF system to the local address through NAT (Network Address Translation), and modify the source address of the message sent out by the WAF to the address of the original client or the protected server (but the source port information is usually not modified). However, if load balancing is added to the WAF system, there will be multiple WAF protection modules. Due to the processing characteristics of WAF, the request message and the response message are required to be received or sent by the same WAF protection module. Regardless of whether the WAF protection module accesses the protected server through the load module. Because the WAF protection module uses the forged original client IP address, when the protected server sends back the response message, it is impossible to know which WAF protection module the message should be sent to, resulting in abnormal processing. At this stage, a response strategy is provided, such as the load system can use a fixed IP hash algorithm for the client to load and find the unique corresponding WAF protection module, but due to the fixed IP hash algorithm, load imbalance will occur in many scenarios.

[0057] Therefore, in the face of the above problems, the present invention provides a data flow processing method, which implements load distribution to multiple WAF protection modules through SRv6. When the WAF system sends a message outward, it passes through the load module again, and establishes an association between the original IP information retained in the IPv6 extension header and the load distribution request message, thereby solving the above problems.

[0058] Please refer to Figure 1 , Figure 1 A flowchart of a data flow processing method provided by an embodiment of the present invention. The method may include:

[0059] S101: Read the request message sent by the client and determine the target WAF protection module.

[0060] The execution subject of this embodiment is the load module of the WAF system. The request message in this embodiment can be an IPv4 message or an IPv6 message. Figure 2 . Figure 2 The WAF system includes a client, a drainage network device, a protected server and a WAF system. Among them, the WAF system includes a load module and multiple WAF protection modules. The load module is used to implement load distribution and load balancing of the WAF system. Through the drainage network device, the traffic (which can also be called data or messages) from the client and the access to the protected server is pulled to the WAF system by means of policy routing and the like, and the source address and destination address of the message are kept unchanged. First, the load module reads the request message sent by the client, and determines the target WAF protection module corresponding to the request message according to the load distribution requirements set by itself, and sends the request message to the target WAF protection module. This embodiment does not limit the load distribution requirements. For example, the request message can be assigned to one of the multiple WAF protection modules by a hash algorithm or by searching the local cache information (if its cache information exists).

[0061] S102: Add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message.

[0062] This embodiment does not limit the original IP information, as long as the original identity of the request message can be determined.

[0063] Further, the above adding the original IP information of the request message to the IPv6 extension header and encapsulating the request message according to the target WAF protection module to obtain the SRv6 request message may include the following steps:

[0064] At least the source IP address, source port, destination address and destination port of the request message are added to the IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0065] The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

[0066] For details, please refer to Figure 3 . Figure 3 A data structure diagram of an SRv6 request message provided in an embodiment of the present invention. The SID (segment identifier) ​​of the target WAF protection module is used as the last node in the SRv6 transmission SL (Segments Left). The original IP information, such as the source address, source port, destination address, destination port, etc., is added to the IPv6 extension header. The source address of the message is modified to the IP address of the load module, and the destination address is the IP address of the target WAF module. The modified message is used as the IPv6 Payload of the SRv6 request message.

[0067] Depend on Figure 3 It can be seen that the SRv6 request message is an IPv6 message forwarded by SR routing. IPv6 includes IPv6 Header (IPv6 Header is the beginning of the IPv6 data packet) and IPv6 Payload (IPv6 Payload is the actual data part contained in the IPv6 data packet); IPv6 Header includes two IPv6 extension headers: SRH (Segment Routing Header) extension header and added extension header. The SRH extension header contains a list called Segment List, which stores path information in the form of IPv6 addresses. The main function of SRH is to guide data packets to be forwarded along a predefined path. When the data packet reaches the intermediate node, these nodes will determine the forwarding path of the next hop based on the information in the SRH. The added extension header is used to record the original IP information, such as the source IP address, source port, destination address, and destination port of the request message. IPv6 Payload also includes IP Header (IP header information), specifically including the source address and destination address.

[0068] S103: Send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message.

[0069] This embodiment sends the SRv6 request message to the target WAF protection module. For details, please refer to Figure 4It should be noted that the SRv6 request message is an IPv6 message forwarded by SR routing, so the message forwarding uses the SRv6 tunnel technology. When the target WAF protection module receives the SRv6 request message, it processes the SRv6 request message to obtain an SRv6 proxy request message. Specifically, the target WAF protection module processes the SRv6 request message, which may include the following steps:

[0070] The target WAF protection module receives the SRv6 request message and completes the decapsulation, and retains the original IP information recorded in the IPv6 extension header, such as the source IP address, source port, destination address, and destination port of the request message. The target WAF protection module processes the SRv6 request message and sends a proxy request to the protected server. The target WAF protection module forwards the SRv6 proxy request message to the load module through the SRv6 tunnel technology. The data structure diagram of the SRv6 proxy request message is as follows: Figure 5 As shown in the figure, the SID of the payload module is used as the last node in the SRv6 transmission SL. The saved original IP information, such as the source address, source port, destination address, destination port, etc., is added to the IPv6 extension header. The source address of the SRv6 proxy request message sent by the target WAF protection module is modified to the IP address of the current target WAF protection module, and the destination address is modified to the IP address of the payload module. The modified message is used as the IPv6 Payload of the SRv6 proxy request message.

[0071] S104: Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the payload in the cache, modify the IP header information in the payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server.

[0072] In this embodiment, the target WAF protection module sends the SRv6 proxy request message to the load module. For details, please refer to Figure 6. When the load module receives the SRv6 proxy request message sent by the target WAF protection module, it performs SRv6 decapsulation on the SRv6 proxy request message, and records the original IP information in the IPv6 extension header of the message and the IP header information in the payload in the cache. After modifying the IP header information in the payload with the original IP information in the IPv6 extension header, the modified message is forwarded to the protected server. The SRv6 proxy request message and the SRv6 request message are associated through the original IP information in the IPv6 extension header. By recording the original IP information in the IPv6 extension header and the IP header information in the payload in the cache, each message can be associated with the target WAF protection module. It should be noted that the forwarding between messages uses the SRv6 tunnel technology. That is, the modified message is forwarded to the protected server using the SRv6 tunnel technology.

[0073] It should be noted that the above-mentioned recording of the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the payload in the cache may include the following steps:

[0074] The source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the payload of the SRv6 proxy request message are recorded in the cache.

[0075] The content recorded in the cache in this embodiment may include original IP information, such as the source IP address, source port, destination address and destination port of the request message; and the source IP address, source port, destination address and destination port recorded in the payload of the current SRv6 proxy request message. In this way, the load module can know which SRv6 request message the SRv6 proxy request message corresponds to, and when the protected server returns a response message later, which SRv6 request message and / or SRv6 proxy request message corresponds to it, as well as the corresponding WAF protection module.

[0076] S105: Read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module, so that the target WAF protection module returns the response message to the client.

[0077] When the load module sends the SRv6 proxy request message to the protected server, the protected server processes the proxy request and returns a response message. Specifically, the response message returned by the protected server can be pulled to the WAF system by using a network device and a policy routing method, and the source address and destination address of the request response message remain unchanged. When the load module reads the response message returned by the protected server, it searches the cache according to the response message, determines the corresponding WAF protection module, and sends the response message to the WAF protection module. Specifically, the load module reads the response message, searches the local cache information and obtains the specified WAF protection module, that is, the target WAF protection module. The SID of the specified WAF protection module is used as the last node in the SRv6 transmission SL. The original IP information, such as the source address, source port, destination address, destination port, etc., is added to the IPv6 extension header. The source address of the message is modified to the IP address of the load module, and the destination address is modified to the IP address of the specified WAF module. The modified message is used as the IPv6 payload of the first return message. The first return message here refers to the first return message obtained by processing the response message. The first return message is the message sent by the load module to the specified WAF protection module.

[0078] Further, the above-mentioned reading of the response message returned by the protected server, searching from the cache according to the response message, and determining the target WAF protection module may include the following steps:

[0079] Read the response message returned by the protected server, determine the IP header information in the corresponding IPv6 payload based on the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache; determine the target WAF protection module based on the source IP address in the IP header information in the IPv6 payload; send the response message to the target WAF protection module.

[0080] Specifically, first search the information in the load module cache according to the information in the IPv6 extension header in the response message. If the information is the same, the response message corresponds to the original request message. Then, the target WAF protection module to which the response message needs to be sent can be determined according to the IP header information in the corresponding IPv6 payload. This is because the source address and destination address of the SRv6 proxy request message are recorded in the IP header information in the IPv6 payload. In this way, the SRv6 proxy request message, response message, SRv6 request message, and the specified target WAF protection module are associated and bound, so that the request message and its corresponding response message are received or sent by the same WAF protection module. The above method can also be used for other request messages, thus achieving load balancing.

[0081] The specific process of sending the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client is similar to the above process. For details, please refer to the following content:

[0082] The target WAF protection module receives the first return message sent by the load module and completes the decapsulation, while retaining the original IP information. The target WAF protection module processes the first return message and returns it to the client. The target WAF protection module forwards the second return message to the load module through SRv6 tunnel technology. Specifically, the load module SID is used as the last node in the SRv6 transmission SL. The saved original IP information, such as source address, source port, destination address, destination port, etc., is added to the IPv6 extension header. Modify the source address of the message sent by the target WAF protection module to the IP address of the current target WAF protection module, and the destination address to the IP address of the load module. Use the modified message as the IPv6 payload of the second return message.

[0083] When the load module receives the second return message, it decapsulates it and can also record the original IP information in the IPv6 extension header and the IP header information in the IPv4 payload in the cache. The load module performs SRv6 decapsulation and modifies the IP header in the message payload with the original IP information in the IPv6 extension header and forwards the modified third return message to the client.

[0084] It should be noted that the actual transmission data in the request message, SRv6 request message, SRv6 proxy request message and modified message in this embodiment are the same, except that the destination address and source address may differ depending on the sender and the receiver. Similarly, the actual transmission data in the response message, the first return message, the second return message and the third return message are the same, except that the destination address and source address may differ depending on the sender and the receiver.

[0085] The data flow processing method provided in the embodiment of the present invention is applied, by reading the request message sent by the client and determining the target WAF protection module; adding the original IP information of the request message to the IPv6 extension header, and encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message; sending the SRv6 request message to the target WAF protection module so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message; reading the SRv6 proxy request message sent by the target WAF protection module, recording the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, and modifying the IPv6 according to the original IP information in the IPv6 extension header. The IP header information in the payload is used to forward the modified message to the protected server; the response message returned by the protected server is read, and the target WAF protection module is determined by searching the cache according to the response message, and the response message is sent to the target WAF protection module, so that the target WAF protection module returns the response message to the client. The present invention uses the IPv6 extension header to store the original IP information, and combines it with the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing under the WAF system. In addition, standard IPv6 / SRv6 transmission messages are used, so the network environment deployed by the system does not require special modification and has strong adaptability; and compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, so it is more universal.

[0086] The data flow processing device provided in an embodiment of the present invention is introduced below. The data flow processing device described below and the data flow processing method described above can be referenced to each other.

[0087] Please refer to Figure 7 , Figure 7 A structural diagram of a data flow processing device provided by an embodiment of the present invention may include:

[0088] The target WAF protection module determination module 100 is used to read the request message sent by the client and determine the target WAF protection module;

[0089] The SRv6 request message acquisition module 200 is used to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain the SRv6 request message;

[0090] The SRv6 proxy request message acquisition module 300 is used to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message;

[0091] The message modification module 400 is used to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0092] The response message acquisition module 500 is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0093] Based on the above embodiment, the SRv6 request message acquisition module 200 may include:

[0094] An extension header adding unit, configured to add at least the source IP address, source port, destination address and destination port of the request message to the IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0095] The address modification unit is used to use the IP address of the target WAF protection module as the destination address of the SRv6 request message and the IP address of the load module as the source address of the SRv6 request message.

[0096] Based on the above embodiment, the response message acquisition module 500 may include:

[0097] A response message reading unit, used to read the response message returned by the protected server;

[0098] A search unit, configured to determine the IP header information in the corresponding IPv6 Payload according to the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache;

[0099] A determination unit, configured to determine the target WAF protection module according to the source IP address in the IP header information in the IPv6 Payload;

[0100] The sending unit is used to send the response message to the target WAF protection module.

[0101] Based on the above embodiment, the message modification module 400 may include:

[0102] A recording unit is used to record the source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message in the cache.

[0103] Based on the above embodiment, the target WAF protection module determination module 100 may include:

[0104] The protection module determination unit is used to read the request message sent by the client and determine the target WAF protection module corresponding to the request message through a hash algorithm.

[0105] Based on any of the above embodiments, the data flow processing device may further include:

[0106] The forwarding module is used to modify the IP header information in the IPv6 Payload by using the original IP information in the IPv6 extension header, and forward the modified message to the protected server using the SRv6 tunnel technology.

[0107] It should be noted that the order of the modules and units in the above-mentioned data flow processing device can be changed without affecting the logic.

[0108] The data flow processing device provided by the embodiment of the present invention is applied, through the target WAF protection module determination module 100, used to read the request message sent by the client and determine the target WAF protection module; the SRv6 request message acquisition module 200 is used to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain the SRv6 request message; the SRv6 proxy request message acquisition module 300 is used to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message; the message modification module 400 is used to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, and modify the IPv6 according to the original IP information in the IPv6 extension header The IP header information in the payload is used to forward the modified message to the protected server; the response message acquisition module 500 is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module, so that the target WAF protection module returns the response message to the client. This device uses the IPv6 extension header to store the original IP information, and combines the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing under the WAF system. In addition, the standard IPv6 / SRv6 transmission message is used, so the network environment deployed by the system does not require special modification and has strong adaptability; and compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, which is more universal.

[0109] The data flow processing device provided in an embodiment of the present invention is introduced below. The data flow processing device described below and the data flow processing method described above can be referenced to each other.

[0110] Please refer to Figure 8 , Figure 8 A structural diagram of a data flow processing device provided in an embodiment of the present invention may include:

[0111] A memory 10, used for storing computer programs;

[0112] The processor 20 is used to execute a computer program to implement the above-mentioned data flow processing method.

[0113] The memory 10 , the processor 20 , and the communication interface 31 all communicate with each other via the communication bus 32 .

[0114] In the embodiment of the present invention, the memory 10 is used to store one or more programs, and the program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0115] Read the request message sent by the client and determine the target WAF protection module;

[0116] The original IP information of the request message is added to the IPv6 extension header, and the request message is encapsulated according to the target WAF protection module to obtain an SRv6 request message;

[0117] Send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message;

[0118] Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0119] Read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0120] In a possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0121] In addition, the memory 10 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include an NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0122] The processor 20 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, a microprocessor or any conventional processor, etc. The processor 20 may call a program stored in the memory 10 .

[0123] The communication interface 31 may be an interface of a communication module, and is used to connect to other devices or systems.

[0124] Of course, it should be noted that Figure 8 The structure shown does not constitute a limitation on the data flow processing device in the embodiment of the present invention. In actual applications, the data flow processing device may include Figure 8 More or fewer components than shown, or combinations of certain components.

[0125] The computer-readable storage medium provided in an embodiment of the present invention is introduced below. The computer-readable storage medium described below and the data flow processing method described above can be referenced to each other.

[0126] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data flow processing method are implemented.

[0127] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0128] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0129] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0130] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0131] The above is a detailed introduction to a data flow processing method, device, equipment and computer-readable storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data flow processing method, characterized in that: The load modules used in the WAF system include: Read the request message sent by the client and determine the target WAF protection module; Add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message; Sending the SRv6 request message to the target WAF protection module so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message; Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server; Read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

2. The data flow processing method according to claim 1, characterized in that: The original IP information of the request message is added to the IPv6 extension header, and the request message is encapsulated according to the target WAF protection module to obtain an SRv6 request message, including: At least the source IP address, source port, destination address and destination port of the request message are added to the IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header; The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

3. The data flow processing method according to claim 1, characterized in that: Reading the response message returned by the protected server, searching from the cache according to the response message, determining the target WAF protection module, and sending the response message to the target WAF protection module, including: Read the response message returned by the protected server; Determine the IP header information in the corresponding IPv6 Payload according to the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache; Determine the target WAF protection module according to the source IP address in the IP header information in the IPv6 Payload; The response message is sent to the target WAF protection module.

4. The data flow processing method according to claim 1, characterized in that: Recording the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache includes: The source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message are recorded in the cache.

5. The data flow processing method according to claim 1, characterized in that: Read the request message sent by the client and determine the target WAF protection module, including: The request message sent by the client is read, and the target WAF protection module corresponding to the request message is determined by a hash algorithm.

6. The data flow processing method according to any one of claims 1 to 5, characterized in that: Modifying the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forwarding the modified message to the protected server, including: The original IP information in the IPv6 extension header is modified into the IP header information in the IPv6 Payload, and the modified message is forwarded to the protected server using the SRv6 tunnel technology.

7. The data flow processing method according to claim 1, characterized in that: Before encapsulating the request message according to the target WAF protection module to obtain the SRv6 request message, the method further includes: The segment identifier of the target WAF protection module is used as the last node of the SRv6 segment list.

8. A data flow processing device, characterized in that: The load modules used in the WAF system include: The target WAF protection module determination module is used to read the request message sent by the client and determine the target WAF protection module; An SRv6 request message acquisition module, used to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message; An SRv6 proxy request message acquisition module, used to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message; A message modification module, used to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server; A response message acquisition module is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

9. A data flow processing device, characterized in that: include: Memory for storing computer programs; A processor, used to implement the data flow processing method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the data flow processing method according to any one of claims 1 to 7 is implemented.

Images