Data flow processing method, device, equipment and storage medium

Abstract

The present invention discloses a data flow processing method, device, equipment and storage medium, which are applied to the field of data forwarding. The present invention uses the IPv6 extension header to store the original IP information, and combines it with the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing requirements under the WAF system. In addition, the standard IPv6 / SRv6 transmission message is used, so the network environment deployed by the system does not require special modification and has strong adaptability. In addition, compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, which makes it more universal.

Description

Technical Field

[0001] The present invention relates to the field of data forwarding, and in particular to a data flow processing method, device, equipment and storage medium. Background Art

[0002] The addition of load balancing to the load balancing system results in multiple WAF (Web Application Firewall) protection modules. During packet transmission, both the request and its corresponding response must be received or sent by the same WAF protection module. Regardless of whether the WAF protection module accesses the protected service station through the load balancing module, since the WAF protection module uses a spoofed IP address of the original client, when the protected station sends back a response, it cannot determine which WAF protection module the message should be sent to, resulting in processing anomalies. If the load balancing system uses a fixed IP hashing algorithm to load balance the client and search for the target WAF protection module, this fixed IP hashing algorithm can lead to load imbalance in various scenarios.

[0003] Therefore, how to meet the WAF processing characteristics that request messages and their corresponding response messages must be received or sent by the same WAF protection module under a loaded system while also achieving load balancing is an urgent problem that needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a data flow processing method, device, equipment and storage medium, which solves the problem in the prior art that request messages and their corresponding response messages cannot be received or sent by the same WAF protection module and load balanced.

[0005] To solve the above technical problems, the present invention provides a data flow processing method, comprising:

[0006] Read the request message sent by the client and determine the target WAF protection module;

[0007] Adding the original IP information of the request message to the IPv6 extension header, and encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message;

[0008] Sending the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message;

[0009] Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0010] Read the response message returned by the protected server, search the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0011] Optionally, the original IP information of the request message is added to an IPv6 extension header, and the request message is encapsulated according to the target WAF protection module to obtain an SRv6 request message, including:

[0012] Adding at least the source IP address, source port, destination address, and destination port of the request message to an IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0013] The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

[0014] Optionally, reading a response message returned by the protected server, searching the cache according to the response message to determine the target WAF protection module, and sending the response message to the target WAF protection module includes:

[0015] Read the response message returned by the protected server;

[0016] Determine the IP header information in the corresponding IPv6 Payload based on the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache;

[0017] Determine the target WAF protection module based on the source IP address in the IP header information in the IPv6 Payload;

[0018] The response message is sent to the target WAF protection module.

[0019] Optionally, recording the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in a cache includes:

[0020] The source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message are recorded in the cache.

[0021] Optionally, read the request message sent by the client and determine the target WAF protection module, including:

[0022] The request message sent by the client is read, and the target WAF protection module corresponding to the request message is determined by a hash algorithm.

[0023] Optionally, modifying IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forwarding the modified message to the protected server, includes:

[0024] The IP header information in the IPv6 Payload is modified according to the original IP information in the IPv6 extension header, and the modified message is forwarded to the protected server using SRv6 tunnel technology.

[0025] Optionally, before encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message, the method further includes:

[0026] The segment identifier of the target WAF protection module is used as the last node of the SRv6 segment list.

[0027] The present invention also provides a data flow processing device, which is applied to a load module of a WAF system, comprising:

[0028] The target WAF protection module determination module is used to read the request message sent by the client and determine the target WAF protection module;

[0029] An SRv6 request message acquisition module, configured to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message;

[0030] An SRv6 proxy request message acquisition module is configured to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message;

[0031] a message modification module, configured to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in a cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0032] A response message acquisition module is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0033] The present invention also provides a data flow processing device, comprising:

[0034] memory for storing computer programs;

[0035] A processor is used to implement the above-mentioned data flow processing method when executing the computer program.

[0036] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the data flow processing method as described above is implemented.

[0037] As can be seen, the present invention uses the IPv6 extension header to store the original IP information and combines it with SRv6 transmission messages, allowing the request message and its corresponding response message to be received or sent by the same WAF protection module, and can also meet the load balancing requirements of the WAF system. In addition, the use of standard IPv6 / SRv6 transmission messages means that the network environment in which the system is deployed does not require special modification, and its adaptability is strong. Compared with the method of obtaining the true request source IP by installing the TOA module, it does not require invasive modifications to the operating system protocol stack and system functions, making it more universal.

[0038] In addition, the present invention also provides a data flow processing device, equipment and storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A flowchart of a data flow processing method provided by an embodiment of the present invention;

[0041] Figure 2 A flowchart illustrating a data flow processing method provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the data structure of an SRv6 request message provided in an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of the forwarding process of an SRv6 request message provided in an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of the data structure of an SRv6 proxy request message provided in an embodiment of the present invention;

[0045] Figure 6 A schematic diagram of the forwarding process of an SRv6 proxy request message provided in an embodiment of the present invention;

[0046] Figure 7 A schematic structural diagram of a data flow processing device provided by an embodiment of the present invention;

[0047] Figure 8 A schematic diagram of the structure of a data flow processing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0049] First, let’s analyze some of the terms used in this application:

[0050] IPv6: The full name is Internet Protocol version 6. IPv6 has a larger address space and can meet the needs of more devices to access the Internet in the future. IPv6 supports automatic configuration, which enables network devices to automatically obtain IP addresses and related settings, simplifying network management and maintenance. IPv6 has been enhanced in terms of security, providing better data encryption and authentication mechanisms to protect the security of user data.

[0051] SRv6 (Segment Routing IPv6) is a next-generation IP transport protocol that combines segment routing (SR) with IPv6. It leverages existing IPv6 forwarding technology and enables network programmability through flexible IPv6 extension headers.

[0052] WAF: Web Application Firewall. Web application firewalls are usually deployed between the client and the protected web server in the form of reverse proxy, transparent proxy, or transparent gateway.

[0053] Transparent proxy: It is a proxy technology. Transparent proxy WAF is generally connected in series between the client and the protected Web server. The WAF system uses the protected Web server IP address to establish a connection with the client, and uses the client IP address to establish a connection with the protected Web server.

[0054] Load distribution: It uses load balancing technology to distribute and forward network traffic to multiple network processing subsystems according to certain matching rules, thereby improving the processing capacity of large traffic and enhancing the robustness of the system.

[0055] TOA module: Time of Arrival, usually refers to a technology or tool used to record the arrival time of data packets.

[0056] In a WAF system without load balancing, it's relatively easy to use NAT (Network Address Translation) to modify the destination address of incoming packets to the local address and the source address of outgoing packets to the address of the original client or protected server (but the source port information is typically not modified). However, if a load balancer is added to the WAF system, multiple WAF protection modules will exist. Due to the nature of WAF processing, request and response packets must be received or sent by the same WAF protection module. This applies regardless of whether the WAF protection module accesses the protected server through a load module. Because the WAF protection module uses a spoofed original client IP address, when the protected server sends back a response packet, it has no way of knowing which WAF protection module the packet should be sent to, resulting in processing anomalies. Currently, a workaround is available, such as using a fixed IP hashing algorithm for the client to load balance and find the corresponding WAF protection module. However, the fixed nature of the IP hashing algorithm can lead to load imbalance in various scenarios.

[0057] Therefore, to address the above issues, the present invention provides a data flow processing method that uses SRv6 to achieve load distribution to multiple WAF protection modules. When the WAF system sends outbound messages, it passes through the load module again and establishes an association between the original IP information retained in the IPv6 extension header and the load distribution request message, thereby solving the above problems.

[0058] Please refer to Figure 1 , Figure 1 This is a flow chart of a data flow processing method provided by an embodiment of the present invention. The method may include:

[0059] S101: Read the request message sent by the client and determine the target WAF protection module.

[0060] The execution subject of this embodiment is the load module of the WAF system. The request message in this embodiment can be an IPv4 message or an IPv6 message. Figure 2 . Figure 2 The WAF system includes a client, a traffic diversion network device, a protected server, and a WAF system. The WAF system includes a load module and multiple WAF protection modules. The load module is used to implement load distribution and load balancing of the WAF system. Through the traffic diversion network device, the traffic (which can also be called data or messages) from the client and the protected server is pulled to the WAF system using methods such as policy routing, and the source address and destination address of the message remain unchanged. First, the load module reads the request message sent by the client, and determines the target WAF protection module corresponding to the request message based on the load distribution requirements set by itself, and sends the request message to the target WAF protection module. This embodiment does not limit the load distribution requirements. For example, the request message can be assigned to one of the multiple WAF protection modules through a hash algorithm or by searching local cache information (if its cache information exists).

[0061] S102: Add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message.

[0062] This embodiment does not limit the original IP information, as long as the original identity of the request message can be determined.

[0063] Furthermore, the above-mentioned adding the original IP information of the request message to the IPv6 extension header and encapsulating the request message according to the target WAF protection module to obtain the SRv6 request message may include the following steps:

[0064] At least the source IP address, source port, destination address, and destination port of the request message are added to the IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0065] The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

[0066] For details, please refer to Figure 3 . Figure 3 This diagram illustrates the data structure of an SRv6 request message provided by an embodiment of the present invention. The target WAF protection module's SID (segment identifier) ​​is used as the last node in the SRv6 transmission Segments Left (SL). Original IP information, such as the source address, source port, destination address, and destination port, is added to the IPv6 extension header. The message's source address is modified to the payload module's IP address, and the destination address is modified to the target WAF module's IP address. This modified message serves as the IPv6 payload of the SRv6 request message.

[0067] Depend on Figure 3 As can be seen, an SRv6 request message is an IPv6 message forwarded by SR routing. The IPv6 header includes an IPv6 header (the beginning of an IPv6 packet) and an IPv6 payload (the actual data portion of the IPv6 packet). The IPv6 header includes two IPv6 extension headers: the Segment Routing Header (SRH) and the Added Extension Header. The SRH extension header contains a segment list, which stores path information in the form of IPv6 addresses. The primary function of the SRH is to guide packet forwarding along a predefined path. When a packet reaches an intermediate node, it determines the next-hop forwarding path based on the information in the SRH. The Added Extension Header records the original IP information, such as the request packet's source IP address, source port, destination address, and destination port. The IPv6 payload also includes the IP header, specifically the source and destination addresses.

[0068] S103: Send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message.

[0069] This embodiment sends the SRv6 request message to the target WAF protection module. For details, please refer to Figure 4It should be noted that the SRv6 request message is an IPv6 message forwarded by SR routing, so the message forwarding uses SRv6 tunneling technology. When the target WAF protection module receives the SRv6 request message, it processes the SRv6 request message to obtain an SRv6 proxy request message. Specifically, the target WAF protection module's processing of the SRv6 request message may include the following steps:

[0070] The target WAF protection module receives the SRv6 request message and completes the decapsulation, and retains the original IP information recorded in the IPv6 extension header, such as the source IP address, source port, destination address, and destination port of the request message. The target WAF protection module processes the SRv6 request message and sends a proxy request to the protected server. The target WAF protection module forwards the SRv6 proxy request message to the load module through the SRv6 tunnel technology. The data structure diagram of the SRv6 proxy request message is as follows Figure 5 As shown, the payload module's SID is used as the last node in the SRv6 transmission SL. The saved original IP information, such as the source address, source port, destination address, and destination port, is added to the IPv6 extension header. The source address of the SRv6 proxy request message sent by the target WAF protection module is modified to the IP address of the current target WAF protection module, and the destination address is modified to the IP address of the payload module. The modified message is used as the IPv6 payload of the SRv6 proxy request message.

[0071] S104: Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the payload in the cache, modify the IP header information in the payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server.

[0072] In this embodiment, the target WAF protection module sends the SRv6 proxy request message to the load module. For details, please refer to Figure 6. When the load module receives the SRv6 proxy request message sent by the target WAF protection module, it performs SRv6 decapsulation on the SRv6 proxy request message and records the original IP information in the IPv6 extension header of the message and the IP header information in the payload in the cache. After modifying the IP header information in the payload with the original IP information in the IPv6 extension header, the modified message is forwarded to the protected server. The SRv6 proxy request message and the SRv6 request message are associated through the original IP information in the IPv6 extension header. By recording the original IP information in the IPv6 extension header and the IP header information in the payload in the cache, each message can be associated with the target WAF protection module. It should be noted that the forwarding between messages uses SRv6 tunnel technology. That is, the modified message is forwarded to the protected server using SRv6 tunnel technology.

[0073] It should be noted that the above-mentioned recording of the original IP information in the IPv6 extension header in the SRv6 proxy request message and the IP header information in the payload in the cache may include the following steps:

[0074] The source IP address, source port, destination address, and destination port in the request message and the source IP address, source port, destination address, and destination port in the payload of the SRv6 proxy request message are recorded in the cache.

[0075] In this embodiment, the content recorded in the cache may include original IP information, such as the source IP address, source port, destination address, and destination port of the request message; as well as the source IP address, source port, destination address, and destination port recorded in the payload of the current SRv6 proxy request message. This allows the payload module to know which SRv6 request message the SRv6 proxy request message corresponds to, and when the protected server later returns a response message, which SRv6 request message and / or SRv6 proxy request message corresponds to it, as well as the corresponding WAF protection module.

[0076] S105: Read the response message returned by the protected server, search the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0077] When the load module sends an SRv6 proxy request message to the protected server, the protected server processes the proxy request and returns a response message. Specifically, the response message returned by the protected server can be directed to the WAF system through a network diversion device, using methods such as policy routing, while maintaining the source and destination addresses of the request-response message. When the load module reads the response message returned by the protected server, it searches its cache based on the response message, identifies the corresponding WAF protection module, and sends the response message to that WAF protection module. Specifically, the load module reads the response message, searches its local cache for the designated WAF protection module, and obtains the target WAF protection module. The SID of the designated WAF protection module is used as the last node in the SRv6 transmission SL. The original IP information, such as the source address, source port, destination address, and destination port, is added to the IPv6 extension header. The source address of the message is modified to the IP address of the load module, and the destination address is modified to the IP address of the designated WAF module. The modified message is used as the IPv6 payload of the first return message. The first return message here refers to the first return message obtained by processing the response message. The first return message is the message sent by the payload module to the specified WAF protection module.

[0078] Furthermore, the above-mentioned reading of the response message returned by the protected server and searching from the cache according to the response message to determine the target WAF protection module may include the following steps:

[0079] Read the response message returned by the protected server, determine the IP header information in the corresponding IPv6 payload based on the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache; determine the target WAF protection module based on the source IP address in the IP header information in the IPv6 payload; and send the response message to the target WAF protection module.

[0080] Specifically, the information in the IPv6 extension header of the response message is first searched in the information in the payload module cache. If the information is the same, the response message corresponds to the original request message. Then, based on the IP header information in the corresponding IPv6 payload, the target WAF protection module to which the response message needs to be sent can be determined. This is because the source address and destination address of the SRv6 proxy request message are recorded in the IP header information in the IPv6 payload. In this way, the SRv6 proxy request message, response message, SRv6 request message, and the specified target WAF protection module are associated and bound, so that the request message and its corresponding response message are received or sent by the same WAF protection module. The above method can also be used for other request messages, thus achieving load balancing.

[0081] The specific process of sending the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client is similar to the above process. For details, please refer to the following:

[0082] The target WAF protection module receives the first return message sent by the load module and completes the decapsulation, while retaining the original IP information. The target WAF protection module processes the first return message and returns it to the client. The target WAF protection module forwards the second return message to the load module through SRv6 tunnel technology. Specifically, the load module SID is used as the last node in the SRv6 transmission SL. The saved original IP information, such as source address, source port, destination address, destination port, etc., is added to the IPv6 extension header. The source address of the message sent by the target WAF protection module is modified to the IP address of the current target WAF protection module, and the destination address is the IP address of the load module. The modified message is used as the IPv6 payload of the second return message.

[0083] When the payload module receives the second return message, it decapsulates it and optionally stores the original IP information in the IPv6 extension header and the IP header information in the IPv4 payload in the second return message in a cache. The payload module then performs SRv6 decapsulation, modifies the IP header in the message payload with the original IP information in the IPv6 extension header, and forwards the modified third return message to the client.

[0084] It should be noted that the actual data transmitted in the request message, SRv6 request message, SRv6 proxy request message, and modified message in this embodiment is the same, except that the destination address and source address may differ depending on the sender and receiver. Similarly, the actual data transmitted in the response message, first return message, second return message, and third return message is the same, except that the destination address and source address may differ depending on the sender and receiver.

[0085] The data flow processing method provided by the embodiment of the present invention is applied, by reading the request message sent by the client and determining the target WAF protection module; adding the original IP information of the request message to the IPv6 extension header, and encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message; sending the SRv6 request message to the target WAF protection module so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message; reading the SRv6 proxy request message sent by the target WAF protection module, recording the original IP information in the IPv6 extension header of the SRv6 proxy request message and the IP header information in the IPv6 Payload in the cache, and modifying the IPv6 according to the original IP information in the IPv6 extension header. The IP header information in the Payload is used to forward the modified message to the protected server; the response message returned by the protected server is read, and the cache is searched according to the response message to determine the target WAF protection module, and the response message is sent to the target WAF protection module, so that the target WAF protection module returns the response message to the client. The present invention uses the IPv6 extension header to store the original IP information, and combines it with the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing under the WAF system. In addition, the standard IPv6 / SRv6 transmission message is used, so the network environment where the system is deployed does not require special modification and has strong adaptability; and compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, which makes it more universal.

[0086] The data flow processing device provided by an embodiment of the present invention is introduced below. The data flow processing device described below and the data flow processing method described above can be referenced to each other.

[0087] Please refer to Figure 7 , Figure 7 A schematic structural diagram of a data flow processing device provided in an embodiment of the present invention may include:

[0088] The target WAF protection module determination module 100 is used to read the request message sent by the client and determine the target WAF protection module;

[0089] An SRv6 request message acquisition module 200 is configured to add the original IP information of the request message to an IPv6 extension header and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message;

[0090] An SRv6 proxy request message acquisition module 300 is configured to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message;

[0091] a message modification module 400 configured to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in a cache, modify the IP header information in the IPv6 Payload based on the original IP information in the IPv6 extension header, and forward the modified message to the protected server;

[0092] The response message acquisition module 500 is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0093] Based on the above embodiment, the SRv6 request message acquisition module 200 may include:

[0094] An extension header adding unit, configured to add at least the source IP address, source port, destination address, and destination port of the request message to an IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header;

[0095] The address modification unit is configured to use the IP address of the target WAF protection module as the destination address of the SRv6 request message and the IP address of the load module as the source address of the SRv6 request message.

[0096] Based on the above embodiment, the response message acquisition module 500 may include:

[0097] A response message reading unit, configured to read the response message returned by the protected server;

[0098] A search unit, configured to determine the IP header information in the corresponding IPv6 Payload based on the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache;

[0099] a determining unit, configured to determine the target WAF protection module according to the source IP address in the IP header information in the IPv6 Payload;

[0100] The sending unit is configured to send the response message to the target WAF protection module.

[0101] Based on the above embodiment, the message modification module 400 may include:

[0102] A recording unit is used to record the source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message in the cache.

[0103] Based on the above embodiment, the target WAF protection module determination module 100 may include:

[0104] The protection module determination unit is used to read the request message sent by the client and determine the target WAF protection module corresponding to the request message through a hash algorithm.

[0105] Based on any of the above embodiments, the data flow processing device may further include:

[0106] The forwarding module is used to modify the IP header information in the IPv6 Payload by the original IP information in the IPv6 extension header, and forward the modified message to the protected server using the SRv6 tunnel technology.

[0107] It should be noted that the order of the modules and units in the above-mentioned data flow processing device can be changed without affecting the logic.

[0108] The data flow processing device provided by the embodiment of the present invention is applied, and the target WAF protection module determination module 100 is used to read the request message sent by the client and determine the target WAF protection module; the SRv6 request message acquisition module 200 is used to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain the SRv6 request message; the SRv6 proxy request message acquisition module 300 is used to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain the SRv6 proxy request message; the message modification module 400 is used to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in the cache, and modify the IPv6 according to the original IP information in the IPv6 extension header. The IP header information in the Payload is used to forward the modified message to the protected server; the response message acquisition module 500 is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module, so that the target WAF protection module returns the response message to the client. This device uses the IPv6 extension header to store the original IP information, and combines it with the SRv6 transmission message, so that the request message and its corresponding response message can be received or sent by the same WAF protection module, and can also meet the load balancing under the WAF system. In addition, the standard IPv6 / SRv6 transmission message is used, so the network environment deployed by the system does not require special modification and has strong adaptability; and compared with the method of obtaining the real request source IP by installing the TOA module, there is no need to make intrusive modifications to the operating system protocol stack and system functions, which makes it more universal.

[0109] The data flow processing device provided by an embodiment of the present invention is introduced below. The data flow processing device described below and the data flow processing method described above can be referenced to each other.

[0110] Please refer to Figure 8 , Figure 8 A schematic structural diagram of a data flow processing device provided in an embodiment of the present invention may include:

[0111] Memory 10, for storing computer programs;

[0112] The processor 20 is used to execute computer programs to implement the above-mentioned data flow processing method.

[0113] The memory 10 , the processor 20 , and the communication interface 31 all communicate with each other via the communication bus 32 .

[0114] In the embodiment of the present invention, the memory 10 is used to store one or more programs. The program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0115] Read the request message sent by the client and determine the target WAF protection module;

[0116] The original IP information of the request message is added to the IPv6 extension header, and the request message is encapsulated according to the target WAF protection module to obtain an SRv6 request message;

[0117] Send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message and obtains the SRv6 proxy request message;

[0118] Reads the SRv6 proxy request message sent by the target WAF protection module, records the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in the cache, modifies the IP header information in the IPv6 Payload based on the original IP information in the IPv6 extension header, and forwards the modified message to the protected server;

[0119] Read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

[0120] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function, etc.; the data storage area may store data created during use.

[0121] In addition, the memory 10 may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset or an extended set thereof. The operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0122] The processor 20 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array, or other programmable logic device. The processor 20 may be a microprocessor or any conventional processor. The processor 20 may call a program stored in the memory 10 .

[0123] The communication interface 31 may be an interface of a communication module, used for connecting to other devices or systems.

[0124] Of course, it needs to be explained that Figure 8 The structure shown does not constitute a limitation on the data flow processing device in the embodiment of the present invention. In actual applications, the data flow processing device may include Figure 8 More or fewer components than shown, or combinations of certain components.

[0125] The computer-readable storage medium provided in an embodiment of the present invention is introduced below. The computer-readable storage medium described below and the data flow processing method described above can be referenced to each other.

[0126] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned data flow processing method are implemented.

[0127] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0129] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0130] Finally, it should be noted that, in this document, relationships such as first and second, etc., are used solely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0131] The above is a detailed introduction to the data flow processing method, device, equipment and computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A data flow processing method, characterized in that: The load modules used in the WAF system include: Read the request message sent by the client and determine the target WAF protection module; Adding the original IP information of the request message to the IPv6 extension header, and encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message; Sending the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message; Read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in the cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server; Read the response message returned by the protected server, search the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

2. The data flow processing method according to claim 1, characterized in that: Adding the original IP information of the request message to the IPv6 extension header, and encapsulating the request message according to the target WAF protection module to obtain an SRv6 request message, including: Adding at least the source IP address, source port, destination address, and destination port of the request message to an IPv6 extension header of the SRv6 request message; the IPv6 extension header is an additional extension header; The IP address of the target WAF protection module is used as the destination address of the SRv6 request message, and the IP address of the load module is used as the source address of the SRv6 request message.

3. The data flow processing method according to claim 1, characterized in that: Reading the response message returned by the protected server, searching the cache according to the response message, determining the target WAF protection module, and sending the response message to the target WAF protection module, including: Read the response message returned by the protected server; Determine the IP header information in the corresponding IPv6 Payload based on the information in the IPv6 extension header in the response message and the original IP information in the IPv6 extension header in the SRv6 proxy request message in the cache; Determine the target WAF protection module based on the source IP address in the IP header information in the IPv6 Payload; The response message is sent to the target WAF protection module.

4. The data flow processing method according to claim 1, characterized in that: Recording the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in a cache includes: The source IP address, source port, destination address and destination port in the request message and the source IP address, source port, destination address and destination port in the IPv6 Payload in the SRv6 proxy request message are recorded in the cache.

5. The data flow processing method according to claim 1, characterized in that: Read the request message sent by the client and determine the target WAF protection module, including: The request message sent by the client is read, and the target WAF protection module corresponding to the request message is determined by a hash algorithm.

6. The data flow processing method according to any one of claims 1 to 5, characterized in that: Modifying the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forwarding the modified message to the protected server, including: The original IP information in the IPv6 extension header is modified into the IP header information in the IPv6 Payload, and the modified message is forwarded to the protected server using SRv6 tunnel technology.

7. The data flow processing method according to claim 1, characterized in that: Before encapsulating the request message according to the target WAF protection module to obtain the SRv6 request message, the method further includes: The segment identifier of the target WAF protection module is used as the last node of the SRv6 segment list.

8. A data flow processing device, characterized in that: The load modules used in the WAF system include: The target WAF protection module determination module is used to read the request message sent by the client and determine the target WAF protection module; An SRv6 request message acquisition module, configured to add the original IP information of the request message to the IPv6 extension header, and encapsulate the request message according to the target WAF protection module to obtain an SRv6 request message; An SRv6 proxy request message acquisition module is configured to send the SRv6 request message to the target WAF protection module, so that the target WAF protection module receives and processes the SRv6 request message to obtain an SRv6 proxy request message; a message modification module, configured to read the SRv6 proxy request message sent by the target WAF protection module, record the original IP information in the IPv6 extension header and the IP header information in the IPv6 Payload in the SRv6 proxy request message in a cache, modify the IP header information in the IPv6 Payload according to the original IP information in the IPv6 extension header, and forward the modified message to the protected server; A response message acquisition module is used to read the response message returned by the protected server, search from the cache according to the response message, determine the target WAF protection module, and send the response message to the target WAF protection module so that the target WAF protection module returns the response message to the client.

9. A data flow processing device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the data flow processing method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the data flow processing method according to any one of claims 1 to 7 is implemented.

Images