Load balancing method and database firewall system

Abstract

The embodiment of the invention aims to provide a two-layer load balancing method for forwarding a client request to corresponding processing equipment by calculating a hash value of a source MAC (Media Access Control), and a database firewall system using the method. Firstly, a hash value is calculated for a data source MAC (Media Access Control) from a client, then a hash result is used for carrying out remainder operation on a node number, so that a current client message is shunted to a firewall node with a corresponding serial number, two-layer load balancing under database firewall cluster deployment can be realized, and the reliability, availability and high-concurrency processing capability of a system are improved; meanwhile, for a firewall deployed in a bridge mode, a source MAC of a message of a database server is modified into a bridge port MAC of the firewall on a client side, so that a switch on the client side can be prevented from learning the MAC of the database server to a fixed port, and a scheduling algorithm is prevented from losing efficacy; moreover, the client side port of the firewall filters out the message of which the source MAC is the MAC of the port at the same side of other firewalls, and the server side port of the firewall filters out the message of which the source MAC is the client side MAC, so that the network loop problem can be avoided.

Description

Technical Field

[0001] This invention belongs to the field of information security protection technology, and in particular relates to a two-layer load balancing method using a hash algorithm and a database firewall system. Background Technology

[0002] To handle the increased traffic pressure from rapidly growing business, multiple servers are needed to cope with the massive concurrent access from users. With multiple servers performing the same function, there's the issue of distributing traffic effectively among them. Furthermore, some servers may be overloaded while others are underutilized or even idle. Load balancing technology has emerged as an effective solution to this problem.

[0003] Load balancing technology refers to a service cluster composed of multiple devices in a symmetrical manner. Each device has the same status, meaning it can respond to external access requests independently without the assistance of other servers, and they do not affect each other, greatly improving the response speed of concurrent access.

[0004] Specifically, even high-configuration database firewalls have limitations in computing power. When business volume increases, a single firewall device may become overloaded, leading to slow response times or even system crashes. Therefore, deploying the same service across multiple firewall devices to form a cluster provides the service externally. By utilizing load balancing technology and scheduling algorithms to forward business traffic to various server nodes within the cluster, the access pressure on the devices can be distributed, improving business processing capacity. Summary of the Invention

[0005] In view of the above background, the present invention and its embodiments aim to propose a Layer 2 load balancing method for forwarding client requests to corresponding processing devices by calculating the hash value of the source MAC, and a database firewall system utilizing the method.

[0006] On the one hand, a load balancing method for database firewalls is proposed, including: Deploy at least two database firewalls in bridge mode as a cluster to provide services to the outside world as a whole; The system acquires data packets sent by the client, performs load balancing on the source MAC address using a preset algorithm, and distributes the data packets to the corresponding firewalls. Obtain the data packets sent from the database server to the client via the firewall, and modify the source MAC of the link layer data to the MAC of the bridge port of the firewall on the client side.

[0007] Preferably, the above algorithm includes processing the received data packets from the client: Calculate the hash value of the packet source MAC, and perform a modulo operation on the hash value with SUM to obtain NUM. Then forward the packet to the firewall numbered NUM for security inspection. SUM represents the total number of nodes in the database firewall, and NUM represents the number of each database firewall node.

[0008] If a data packet from a client cannot be load balanced, the packet is dropped.

[0009] Ideally, NUM should take the values ​​0, 1, 2, ..., SUM-1.

[0010] Furthermore, the aforementioned security checks include performing rule matching on data packets; if the check succeeds, the data packet is forwarded to the destination database server; otherwise, the data packet is discarded.

[0011] Furthermore, subsequent data packets from the same client are directly forwarded to the same database firewall for detection.

[0012] Ideally, the firewall on the client-side bridge port should filter out packets whose source MAC address is the MAC address of another database's firewall on the client-side bridge port when receiving packets; the firewall on the server-side bridge port should filter out packets whose source MAC address is the client's MAC address when receiving packets.

[0013] On the other hand, a database firewall system is proposed, deployed between the application server and the database server, including at least two bridge-mode database firewall nodes. This system comprises: The load balancing module acquires data packets sent by the client, performs load balancing on the source MAC address according to a preset algorithm, and distributes the data packets to the corresponding firewall. The security detection module performs security checks, including rule matching, on the received client data packets.

[0014] Preferably, the load balancing module includes: The packet receiving module is used to acquire data packets sent by the client and the server, and to modify the source MAC of the link layer data of the data packets sent by the database server to the client to the MAC of the bridge port of the firewall on the client side. The algorithm submodule calculates the hash value of the source MAC address of the received data packet from the client, and performs a modulo operation on the hash value with SUM to obtain NUM; where SUM represents the total number of nodes in the database firewall, and NUM represents the number of each database firewall node. The packet forwarding submodule forwards packets to firewall nodes numbered NUM. The packet filtering submodule filters packets whose source MAC address is the MAC address of other databases on the client-side bridge port of the firewall; and filters packets whose source MAC address is the client's MAC address on the server-side bridge port of the firewall.

[0015] The embodiments of the present invention employing the above technical solution have at least the following beneficial effects: First, a hash value is calculated for the data source MAC from the client, and then the hash result is moduloed by the number of nodes, thereby diverting the current client packet to the corresponding firewall node. This enables Layer 2 load balancing under a database firewall cluster deployment, improving system reliability, availability, and high-concurrency processing capabilities. Simultaneously, for firewalls deployed in bridge mode, modifying the source MAC of the database server's packet to the MAC of the firewall's bridge port on the client side prevents the client-side switch from learning the database server's MAC to a fixed port, thus rendering the scheduling algorithm ineffective. Furthermore, the firewall's client-side port filters out packets whose source MAC is the same-side port MAC of other firewalls, while the firewall's server-side port filters out packets whose source MAC is the client's MAC, thus avoiding network loop problems. Attached Figure Description

[0016] Figure 1 This is a topology diagram illustrating a database firewall deployment method. Figure 2 This is a schematic diagram illustrating the workflow of an embodiment of a load balancing method for a database firewall. Figure 3 This is a schematic diagram of the module composition of an embodiment of a database firewall system. Implementation

[0017] To make the objectives, technical solutions, and effects of this invention clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the relevant content of this application and are not intended to limit the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0018] First, the terms used in the embodiments of this invention will be explained: Hash, generally translated as "hashing" or sometimes simply "hashing," is a function that transforms an input of arbitrary length into a fixed-length output using a hash algorithm. This output is called the hash value. This transformation is a compression mapping; that is, the space of hash values ​​is usually much smaller than the space of inputs. Different inputs may hash to the same output, so it's impossible to determine a unique input value from the hash value. Simply put, it's a function that compresses a message of arbitrary length into a message digest of a fixed length.

[0019] Ethernet switches are Layer 2 network devices. Their main working principle is to learn the MAC address table based on the source MAC address, look up the MAC address table entry based on the destination MAC address, and forward packets based on the lookup results. They use an automatic address learning and aging mechanism to manage the MAC address table.

[0020] The process of a switch automatically learning its MAC address mapping table can be simply described as follows: Initially, the mapping table is empty. Now, host A sends a data frame FRAME1 to host B. Because there is no record for address B in the mapping table, the switch broadcasts the data frame to all other ports. Since the switch received the data frame from port Fa0 / 1, it knows that A is connected to port Fa0 / 1, and the source address of the data frame is A. The switch can add A's address and port Fa0 / 1 as a record to the mapping table. The switch learns A's address. Next, host B replies to A with a data frame FRAME2. Since there is already a record for address A in the mapping table, the switch accurately forwards the data frame to port Fa0 / 1. Similarly, the switch learns host B's address. When host C starts sending data, the switch also learns its address, and the learning process is complete.

[0021] A database firewall is a device or product that defends against and eliminates data (database) security problems caused by vulnerabilities or defects in application business logic. It is typically deployed between the application server and the database server, using database protocol parsing to achieve this.

[0022] like Figure 1 As shown, when the firewall operates in bridge mode (transparent mode), packets are received on one port, matched against rules, and then dropped or forwarded to another port. No IP addresses can be configured on any port, and the security zone where the port resides is a Layer 2 zone. All users connected to ports within the Layer 2 zone belong to the same subnet. When network packets are forwarded between ports in the Layer 2 zone, the port is located based on the packet's MAC address; in this case, the firewall acts as a transparent bridge. However, unlike a bridge, IP packets in the firewall are also sent to the upper layer for filtering, where session tables or rule matching are checked to determine whether the packet is allowed to pass. Firewalls operating in bridge mode connect to the local area network (LAN) at the data link layer, requiring no special configuration of the network by network end users, thus offering strong applicability.

[0023] like Figure 2 As shown, an embodiment of a load balancing method for a database firewall includes: Deploy at least two database firewalls in bridge mode as a cluster, provide overall external services through load balancing, and use DPDK to implement the bridge forwarding function of the database firewalls.

[0024] Each database firewall node pre-negotiates its own number (NUM) and determines the current total number of nodes in the cluster (SUM).

[0025] The client-side port of the database firewall receives data packets sent by the client, performs load balancing on the source MAC address according to a preset algorithm, and distributes the data packets to the corresponding firewalls; if a data packet from the client does not conform to the formula, the data packet is discarded.

[0026] Specifically: Regarding the data packets received from the client: Formula ① shown in the figure refers to calculating the hash value of the MAC address of the packet source, and then taking the remainder of the hash value with SUM to obtain NUM. The data packet is then forwarded to the firewall numbered NUM for security inspection. Preferably, SUM represents the total number of nodes in the database firewall. NUM takes values ​​of 0, 1, 2, ..., SUM-1.

[0027] If the source MAC address is not modified when forwarding packets according to the above algorithm, the following problem exists: Based on the MAC address learning principle of the switch (i.e., binding the forwarding port according to the source MAC address of the input packet), when the switch on the client side receives a packet from the database server, it will learn the MAC address of the server to the corresponding port. Then, the packets sent to the database server will be automatically forwarded only to the port recorded last time, instead of being split according to the above algorithm.

[0028] Therefore, the server-side port of the database firewall obtains the data packets sent from the database server to the client via the firewall, and modifies the source MAC address of the link-layer data to the MAC address of the firewall's bridge port on the client side. It should be noted that this modification only applies to Layer 2 protocols and does not modify ARP packets. After this step, the client-side switch cannot learn and record the database server's MAC address, so packets sent from the client to the server will be forwarded by the switch to all ports, allowing the database firewall to perform load balancing. It should be noted that this modification may cause flooding issues during switch forwarding, but since client request traffic is generally smaller than response traffic, the impact on overall data processing is minimal.

[0029] Furthermore, subsequent modules of the firewall perform rule matching on the data packets sent by the client. If a rule is detected, the data packet is forwarded to the destination database server; otherwise, the data packet is discarded.

[0030] Furthermore, subsequent data packets from the same client are directly forwarded to the same database firewall for detection.

[0031] As a preferred implementation, to avoid network loop problems, the firewall on the client-side bridge port filters out packets whose source MAC address is the MAC address of another database firewall on the client-side bridge port when receiving packets; the firewall on the server-side bridge port filters out packets whose source MAC address is the client's MAC address when receiving packets.

[0032] Load balancing of the database firewall cluster after load balancing can effectively improve data throughput, thus having a positive impact on enhancing system reliability, availability, and high-concurrency processing capabilities.

[0033] As shown in Figure 3, an embodiment of a database firewall system is deployed between an application server and a database server. The system is characterized by including at least two bridge-mode database firewall nodes. The load balancing module acquires data packets sent by the client, performs load balancing on the source MAC address according to a preset algorithm, and distributes the data packets to the corresponding firewall. The security detection module performs security checks, including rule matching, on the received client data packets.

[0034] As a preferred implementation, the load balancing module includes: The packet receiving module is used to acquire data packets sent by the client and the server, and to modify the source MAC of the link layer data of the data packets sent by the database server to the client to the MAC of the bridge port of the firewall on the client side. The algorithm submodule calculates the hash value of the source MAC address of the received data packet from the client, and performs a modulo operation on the hash value with SUM to obtain NUM; where SUM represents the total number of nodes in the database firewall, and NUM represents the number of each database firewall node. The packet forwarding submodule forwards packets to firewall nodes numbered NUM. The packet filtering submodule filters packets whose source MAC address is the MAC address of other databases on the client-side bridge port of the firewall; and filters packets whose source MAC address is the client's MAC address on the server-side bridge port of the firewall.

[0035] As described in the embodiments of the present invention, the hash value of the data source MAC from the client is first calculated, and then the hash result is moduloed by the number of nodes to distribute the current client packet to the corresponding firewall node. This enables Layer 2 load balancing in a database firewall cluster deployment, improving system reliability, availability, and high-concurrency processing capabilities. Simultaneously, for firewalls deployed in bridge mode, modifying the source MAC of the database server's packets to the MAC of the firewall's bridge port on the client side prevents the client-side switch from learning the database server's MAC to a fixed port, thus rendering the scheduling algorithm ineffective. Furthermore, the firewall's client-side port filters out packets whose source MAC is the same-side port MAC of other firewalls, while the firewall's server-side port filters out packets whose source MAC is the client's MAC, preventing network loop problems.

[0036] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on key points. All the details shown are differences from other embodiments; similar or identical parts between embodiments can be referred to accordingly. For the actual... The systems or apparatus disclosed in the embodiments are described in a relatively simple manner because they correspond to the methods disclosed in the examples. For details, please refer to the instructions in the method section.

[0037] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0038] The above description of the disclosed embodiments enables those skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.

Claims

1. A load balancing method for a database firewall, characterized in that: include: Deploy at least two database firewalls in bridge mode as a cluster to provide services to the outside world as a whole; Get the data packets sent by the client, perform load balancing on the source MAC according to the preset algorithm, and divert the data packets to the corresponding firewall; The data packet sent from the database server to the client via the firewall is obtained, and the source MAC of the link layer data therein is modified to the bridge port MAC of the firewall on the client side.

2. The load balancing method according to claim 1, characterized in that: For packets received from the client: Calculate the hash value of the message source MAC, and perform a modulo operation on the hash value to obtain NUM, and forward the data packet to the firewall numbered NUM for security detection; The SUM represents the total number of database firewall nodes, and the NUM represents the number of each database firewall node.

3. The load balancing method according to claim 2, characterized in that: If the data packet from the client cannot be load balanced, the data packet is discarded.

4. The load balancing method according to claim 2, characterized in that: The NUM takes values ​​of 0, 1, 2, ..., SUM-1.

5. The load balancing method according to claim 2, characterized in that: The firewall matches the data packets received from the client with rules. If the detection passes, the data packets are forwarded to the destination database server; otherwise, the data packets are discarded.

6. The load balancing method according to claim 2, characterized in that: Subsequent packets from the same client are directly forwarded to the same database firewall for inspection.

7. The load balancing method according to claim 1, characterized in that: When receiving packets, the firewall's bridge port on the client side filters out messages whose source MAC is the MAC of the bridge port of other database firewalls on the client side; when receiving packets, the firewall's bridge port on the server side filters out messages whose source MAC is the client MAC.

8. A database firewall system, deployed between an application server and a database server, characterized in that: The system comprises at least two database firewall nodes in bridge mode, and includes: The load balancing module obtains the data packets sent by the client, performs load balancing on the source MAC according to the preset algorithm, and diverts the data packets to the corresponding firewall; The security detection module performs security detection including rule matching on the received client data packets.

9. The system according to claim 8, characterized in that The load balancing module comprises: The data packet receiving submodule is used to obtain the data packets sent by the client and the server, and to modify the source MAC of the link layer data of the data packet sent by the database server to the client to the bridge port MAC of the firewall on the client side; The algorithm submodule calculates the hash value of the message source MAC for the data packet received from the client, and performs a modulo operation on the hash value to obtain NUM; the SUM represents the total number of nodes of the database firewall, and the NUM represents the number of each database firewall node; The data packet forwarding submodule forwards the data packet to the firewall node numbered by NUM; The packet filtering submodule, the bridge port of the firewall on the client side, filters out the messages whose source MAC is the MAC of the bridge port of other database firewalls on the client side when receiving packets; the bridge port of the firewall on the server side filters out the messages whose source MAC is the client MAC when receiving packets.

Images