Information hooking method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an information hooking method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring an initial session; the initial session comprises a dynamic service pointer; if the state of the first security service in the security services for the initial session is first hitching, determining a target memory of the initial session; the first security service is a service participating in initial session processing in a firewall; pointing a dynamic service pointer in the initial session to a target memory, and hooking service extension information of the first security service to the initial session; and for the next first security service in the security services, re-executing the step of determining the target memory of the initial session if the state of the first security service in the security services relative to the initial session is first hitching until the service extension information of the last first security service in the security services is hitching to the initial session, thereby obtaining the target session. By adopting the method, the concurrency performance of the firewall can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an information hooking method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the field of network security, firewalls are the first line of defense to protect the network from external threats, and their performance is directly related to the stability and security of the entire network system. Multiple session-based services on the firewall usually share the same session, and each service will attach its own service module extension information to the session.

[0003] In traditional technology, the session structure reserves a service pointer for each security service to attach the respective service module extension information. When the traffic flows through the firewall, each security service in the firewall processes the traffic and then attaches the service extension information of each security service to the session corresponding to the traffic according to the security service pointer reserved for each security service in the session structure, that is, the service extension information is stored in the memory address pointed to by each security service pointer to obtain the target session, so as to associate the processing result of each security service with the session of the traffic.

[0004] However, in the traditional technology, a service pointer is reserved for each security service in the session structure. Since the number of security services is large and the traffic generally only requires the processing of some security services, the security service pointers of the remaining security services are idle, which will cause a waste of memory resources and lead to poor concurrency performance of the firewall. Summary of the invention

[0005] Based on this, it is necessary to provide an information mounting method, apparatus, computer device, computer readable storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides an information hooking method, comprising:

[0007] Acquire an initial session; the initial session includes a dynamic service pointer;

[0008] If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session;

[0009] Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session;

[0010] For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0011] In one embodiment, the initial session further includes an amount of extended information; if the state of the first security service in the security service for the initial session is the first attachment, determining the target memory of the initial session includes:

[0012] For each first security service among the security services, obtaining an index value corresponding to the first security service;

[0013] If the index value is an initial index value, determining the state of the first security service for the initial session as being attached for the first time;

[0014] In the case where the state of the first security service for the initial session is determined to be the first attachment, determining the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service according to the amount of extended information in the initial session;

[0015] The target memory of the dynamic service pointer is determined based on the occupied memory and the newly added memory.

[0016] In one embodiment, the initial session further includes a mounting position value; and the obtaining, for each first security service in the security services, an index value corresponding to the first security service includes:

[0017] For each first security service in the security services, determine a target position corresponding to the first security service according to an enumeration value corresponding to the first security service; the target position is a position of the first security service in the attachment position value;

[0018] An index value corresponding to the first security service is determined in the attachment position value according to the target position.

[0019] In one embodiment, attaching the service extension information of the first security service to the initial session includes:

[0020] If there is an occupied memory, obtaining the existing control block data of the dynamic service pointer in the occupied memory;

[0021] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0022] In one embodiment, the method further includes storing the service extension information of the first security service before the target service corresponds to the target array position in the target service pointer:

[0023] The number of the extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

[0024] In one embodiment, after copying the existing control block data to the target memory corresponding to the target service pointer, the method further includes:

[0025] If there is occupied memory, the occupied memory in the initial session and the existing control block data in the occupied memory are released.

[0026] In one embodiment, after attaching the service extension information of the first security service to the initial session, the method further includes:

[0027] The index value corresponding to the first security service is updated according to the number of extended information to obtain a new attachment position value, and the number of extended information is updated.

[0028] In a second aspect, the present application also provides an information hooking device, including:

[0029] An acquisition module, used for acquiring an initial session; the initial session includes a dynamic service pointer;

[0030] A first determination module is used to determine the target memory of the initial session if the state of the first security service in the security service for the initial session is the first attachment; the first security service is the service in the firewall that participates in the processing of the initial session;

[0031] A first mounting module, used for pointing the dynamic service pointer in the initial session to the target memory, and mounting the service extension information of the first security service to the initial session;

[0032] The second mounting module is used to re-execute the step of determining the target memory of the initial session for the next first security service in the security service if the status of the first security service in the security service for the initial session is the first mounting, until the service extension information of the last first security service in the security service is mounted to the initial session to obtain the target session.

[0033] In one embodiment, the initial session further includes the number of extended information; the first determining module is specifically configured to obtain an index value corresponding to each first security service in the security services;

[0034] If the index value is an initial index value, determining the state of the first security service for the initial session as being attached for the first time;

[0035] In the case where the state of the first security service for the initial session is determined to be the first attachment, determining the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service according to the amount of extended information in the initial session;

[0036] The target memory of the dynamic service pointer is determined based on the occupied memory and the newly added memory.

[0037] In one embodiment, the initial session further includes a mounting position value; the first determination module is specifically used to determine, for each first security service in the security services, a target position corresponding to the first security service according to an enumeration value corresponding to the first security service; the target position is a position of the first security service in the mounting position value;

[0038] An index value corresponding to the first security service is determined in the attachment position value according to the target position.

[0039] In one of the embodiments, the first mounting module is specifically used to obtain the existing control block data of the dynamic service pointer in the occupied memory if there is an occupied memory;

[0040] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0041] In one embodiment, the device further comprises:

[0042] The second determining module is used to determine the quantity of the extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0043] In one embodiment, the device further comprises:

[0044] The release module is used to release the occupied memory in the initial session and the existing control block data in the occupied memory if there is any occupied memory.

[0045] In one embodiment, the device further comprises:

[0046] An updating module is used to update the index value corresponding to the first security service according to the number of extended information, obtain a new attachment position value, and update the number of extended information.

[0047] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0048] Acquire an initial session; the initial session includes a dynamic service pointer;

[0049] If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session;

[0050] Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session;

[0051] For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0052] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0053] Acquire an initial session; the initial session includes a dynamic service pointer;

[0054] If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session;

[0055] Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session;

[0056] For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0057] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0058] Acquire an initial session; the initial session includes a dynamic service pointer;

[0059] If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session;

[0060] Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session;

[0061] For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0062] The above-mentioned information attachment method, device, computer equipment, computer-readable storage medium and computer program product obtain an initial session; the initial session includes a dynamic service pointer; if the state of the first security service in the security service for the initial session is the first attachment, determine the target memory of the initial session; the first security service is the service involved in the initial session processing in the firewall; point the dynamic service pointer in the initial session to the target memory, and attach the service extension information of the first security service to the initial session; for the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the state of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session, and the target session is obtained. By adopting this method, in the process of completing each first security service in the initial session established by the specific traffic, the dynamic service pointer is used to allocate the target memory for attaching the dynamic service pointer of the first security service. Since the first security service is the security service that the current traffic needs to process among all security services, there is no need to pre-set a security service pointer for each security service in advance, so the memory occupation of the security service pointer in the initial session can be reduced, thereby improving the concurrency performance of the firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0064] Figure 1 A schematic diagram of a flow chart of an information hooking method in an embodiment;

[0065] Figure 2 A schematic diagram of a process of determining a target memory in one embodiment;

[0066] Figure 3 A schematic diagram of a flow chart of a step of determining an index value in an embodiment;

[0067] Figure 4 It is a schematic diagram of a process of attaching service extension information in a specific embodiment;

[0068] Figure 5 It is a flowchart of an example of attaching a specific first security service in an information attaching method in an embodiment;

[0069] Figure 6 A schematic diagram of service extension information hooking in one embodiment;

[0070] Figure 7 A schematic diagram of connecting service extension information in another embodiment;

[0071] Figure 8 A schematic diagram of connecting service extension information in another embodiment;

[0072] Fig. 9 A schematic diagram of a mounting implementation code of a first security service mounted for the first time in an embodiment;

[0073] Fig.10 A schematic diagram of a code for implementing the mounting of a first security service that is not mounted for the first time in an embodiment;

[0074] Fig.11 is a structural block diagram of an information hooking device in an embodiment;

[0075] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0077] In one embodiment, Figure 1 As shown, an information hooking method is provided. This embodiment uses the method applied to a server as an example for illustration. It can be understood that the method can also be applied to a system including a terminal and a server and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0078] Step 102: Get the initial session.

[0079] The initial session includes a dynamic service pointer, which is represented by pAttachCb.

[0080] In the embodiment of the present application, in the field of network security, the firewall is the first line of defense to protect the network from external threats, and its performance is directly related to the stability and security of the entire network system. Session concurrency is an important performance indicator of the firewall and a key indicator for measuring the firewall's ability to handle multiple simultaneous sessions. In order to increase the session concurrency of the firewall, multiple session-based security services on the firewall usually share the same session, that is, when a traffic flow is processed by multiple security services, only one session will be established in the end, but each security service will attach the service extension information of its own service module to the session.

[0081] The session-based security services supported on the firewall may include connection limit, network address translation (NAT), load balancing (Load Balancing), application layer gateway (ALG), advanced flow detection (AFT), and intrusion prevention system (IPS).

[0082] The firewall in the server obtains the initial session. In addition to the dynamic service pointer, the initial session also contains a session quintuple, including five fields: source IP, source port, destination IP, destination port, and the layer 4 protocol, which serve as session identifiers to identify and manage sessions.

[0083] Step 104: If the state of the first security service in the security services for the initial session is the first mounting, determine the target memory of the initial session.

[0084] The first security service is a service participating in the initial session processing in the firewall.

[0085] In the embodiment of the present application, the firewall is pre-configured with a series of security policies, which define security processing rules for different types of traffic (based on source IP, destination IP, source port, destination port, 4-layer communication protocol, etc.). When traffic enters the firewall, the server will first match the corresponding security policy based on the characteristics of the traffic (for example, source IP, destination IP, source port, destination port, protocol, etc.). Then, the server determines the security services that need to be executed by the firewall for the current initial session, and determines the first security service that needs to participate in the security processing for the initial session from the full amount of security services pre-configured by the firewall.

[0086] In a specific embodiment, the security policy can be a security rule based on specific conditions, for example, "apply IPS (Intrusion Prevention System) inspection to traffic from IP address A to IP address B". When traffic enters the firewall, the firewall checks the rules in the security policy library one by one, finds the target policy that matches the current traffic characteristics, and processes the initial session of the traffic according to the security business indicated by the target policy.

[0087] After the server determines the first security service among the security services, it transmits the initial session to each first security service in the order preset by the firewall. In each security service, the server first detects whether the current first security service is processing the initial session for the first time, and determines the status of the first security service for the initial session. If the status of the first security service for the initial session is the first attachment, it means that no memory has been allocated for the first security service in the session structure. In order to store the service extension information of the first security service, memory must be allocated first. Among them, the dynamic service pointer can be a general pointer pointing to an array, and the array pointed to by the dynamic service pointer is used in the session structure to store the service extension information of each service.

[0088] Therefore, when each first security service is first attached, the dynamic service pointer may be empty or need to be expanded. Therefore, sufficient memory space must be allocated for it. Then, when the state of the first security service for the initial session is first attached, the server first determines the target of the dynamic service pointer in the initial session.

[0089] In another embodiment, if the status of the first security service in the security service for the initial session is not the first time to be attached, and the control block belonging to the subsequent first security service is updated, the updated first security service is directly attached at the position indicated by the index value without the need to reallocate the target memory for the first security service that is not attached for the first time.

[0090] Step 106: point the dynamic service pointer in the initial session to the target memory, and attach the service extension information of the first security service to the initial session.

[0091] In the embodiment of the present application, the server points the dynamic service pointer in the initial session to the target memory, and allocates memory resources of the target memory size to the dynamic service pointer, so that the service extension information of the first security service can be attached to the initial session. After each first security service performs security processing on the initial session, the server allocates memory for the first security service in the dynamic service pointer (pointer to the array) of the initial session, and stores its address in a new pointer control block. Since the pointer control block is dynamically allocated according to the number of first security services in the initial session, the dynamic service pointer points to the target memory, which can expand the target memory of the dynamic service as needed, and then correctly reference the memory address where the service extension information of the first security service is located.

[0092] The service extension information of the first security service may be the processing result of the first security service, and the service extension information needs to be managed and stored in the session. The process of attaching the service extension information is to associate the service extension information with the initial session. The server attaches the service extension information of the first security service to the specified position of the initial session, that is, the session structure can access and operate the service extension information of the first security service through the dynamic service pointer, thereby ensuring that the session structure can correctly access and operate the service extension information.

[0093] Step 108, for the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0094] The second security service is the last security service in the first security service.

[0095] In the embodiment of the present application, the security service may include multiple first security services (for example, SESSION_ATTACH_CONNLMT, SESSION_ATTACH_NAT, etc.). The server performs the same attachment operation on each first security service according to step 104 and step 106 until all first security services are processed. The operation of repeatedly attaching the service extension information of each subsequent first security service is not repeated in this embodiment. When the attachment of the service extension information of the last first security service in the security service is completed, it means that the server has completed the attachment of the service extension information of all first security services, that is, each element in the array pointed to by the service dynamic pointer of the target session stores the service extension information of a first security service.

[0096] In the above-mentioned information attachment method, a dynamic service pointer is used to allocate a target memory for attaching the dynamic service pointer of the first security service during the process of completing each first security service in the initial session established for specific traffic. Since the first security service is the security service that needs to be processed by the current traffic among all security services, there is no need to pre-set a security service pointer for each security service. Therefore, the memory occupancy of the security service pointer in the initial session can be reduced, thereby improving the concurrency performance of the firewall.

[0097] In an exemplary embodiment, the initial session further includes the number of extension information, which is the number of service extension information attached to the initial session, represented by the uiAttachNum field; Figure 2 As shown, step 104 includes steps 202 to 208. Among them:

[0098] Step 202: For each first security service among the security services, obtain an index value corresponding to the first security service.

[0099] In the embodiment of the present application, the index value corresponding to the first security service is the index value stored at the corresponding position of the first security service in the attachment position value. When the server performs security processing on the initial session according to each security service, it first obtains the index value corresponding to the first security service in the attachment position value to determine whether the current first security service is processing the initial session for the first time.

[0100] Step 204: If the index value is the initial index value, the state of the first security service for the initial session is determined to be the first attachment.

[0101] In the embodiment of the present application, the attachment position value is used to store the attachment information of each first security service in the initial session, and the index value stored in each position represents the processing status identifier of the corresponding first security service. The initial index value is the default value of the attachment position value, for example, the initial value is all 1, that is, 0XFFFFFFFFFFFFFFFF. The attachment position value and the position of the first security service in the attachment position value are described in detail in the following embodiments.

[0102] Step 206, when the state of the first security service for the initial session is determined to be the first attachment, the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session.

[0103] In the embodiment of the present application, when the state of the first security service for the initial session is determined to be the first attachment, the server determines the number of extended information uiAttachNum in the current initial session as the occupied memory of the dynamic service pointer, and uiAttachNum is a counter that records the number of service modules that have been currently attached. For example, if the value of uiAttachNum is 5, it means that there are currently 5 service extension information of the first security service attached to the initial session. When a new service extension information of the first security service needs to be attached to the initial session, the server needs to allocate memory for the service extension information of the new first security service. In order to ensure the correctness of memory allocation, the server needs to know the total number of service modules currently attached so as to allocate the correct memory location for the service extension information of the new first security service. Then the server determines the location of the service extension information of the new first security service according to uiAttachNum+1. That is, uiAttachNum+1 calculates the location of the service extension information of the newly attached first security service. For example, if uiAttachNum is 5, then uiAttachNum+1 is 6, indicating that the service extension information of the new first security service will be attached to the 6th position.

[0104] Step 208: Determine the target memory of the dynamic service pointer based on the occupied memory and the newly added memory.

[0105] In the embodiment of the present application, after determining the occupied memory and the newly added memory, the server needs to calculate the total target memory of the dynamic service pointer and reallocate the memory according to the target memory. That is, the server obtains the target memory according to the position calculated by uiAttachNum+1, and allocates it according to the service extension information that the target memory is the new first security service.

[0106] In this embodiment, by obtaining the index value corresponding to the first security service and determining whether it is the first attachment, the server can accurately identify the processing status of each first security service and allocate appropriate memory resources accordingly. This not only optimizes memory usage and avoids resource waste and fragmentation, but also ensures that the business expansion information of the new first security service can be smoothly attached to the initial session, thereby improving the overall stability and processing efficiency of the system.

[0107] In an exemplary embodiment, the initial session also includes an attachment position value, which is represented by uiAttachPos; Figure 3 As shown, step 202 includes steps 302 to 304. Among them:

[0108] Step 302: for each first security service among the security services, determine a target position corresponding to the first security service according to an enumeration value corresponding to the first security service.

[0109] The target position is the position of the first security service in the attachment position value.

[0110] In the embodiment of the present application, in the security service of the enumeration type, each security service has a corresponding enumeration value, and the server can determine the enumeration value corresponding to the first security service according to the corresponding relationship between the security service and the enumeration value, and the enumeration value is used to determine the target position of the first security service in the attachment position value. For example, the enumeration value: SESSION_ATTACH_CONNLMT=0, SESSION_ATTACH_NAT=1, SESSION_ATTACH_LB, etc.

[0111] The initial value of the attachment position value is all 1, that is, 0XFFFFFFFFFFFFFFFF. Each 4 bits in uiAttachPos (attachment position value) represent the position of a security service attached in pAttachCb (dynamic service pointer), which is divided according to the enumeration values ​​corresponding to the above security services, that is, bits 0 to 3 of uiAttachPos record the position of CONNLMT extended information in pAttachCb, bits 4 to 7 of uiAttachPos record the position of NAT extended information in pAttachCb, bits 8 to 11 of uiAttachPos record the position of LB extended information in pAttachCb, and so on for other security services. Then, the server determines the target position corresponding to the first security service in the attachment position value according to the enumeration value corresponding to the first security service. For example, if the current first security service is NAT service (SESSION_ATTACH_NAT), the server first determines that the enumeration value corresponding to the NAT service is 2, and then determines that the target position of the first security service is bits 4 to 7 of uiAttachPos according to the enumeration value corresponding to the NAT service.

[0112] Step 304: Determine the index value corresponding to the first security service in the attachment position value according to the target position.

[0113] In the embodiment of the present application, the server extracts 4 bits of data corresponding to the target position from the attachment position value through bit operation, and the 4 bits of data represent the index value of the first security service in the dynamic service pointer. For example, the server calculates the index value of the target position in the attachment position value through "uiPosIndex = (uint8_t)((pstSession->uiAttachPos >> ((uint32_t)enAttach <<2)) & 0x0F)" as the index value corresponding to the first security service.

[0114] In this embodiment, the target position of each first security service in the attachment position value can be accurately determined through enumeration values, and the index value of the first security service can be determined through the target position. It has been realized that memory allocation and index value recording are performed only after the initial session is processed by the first security service. A security service pointer is preset for each security service, reducing the memory occupancy of the security service pointer in the initial session, thereby improving the concurrency performance of the firewall.

[0115] In an exemplary embodiment, Figure 4 As shown, step 108 includes steps 402 to 404. Among them:

[0116] Step 402: If there is occupied memory, obtain the existing control block data of the dynamic service pointer in the occupied memory.

[0117] In an embodiment of the present application, when the dynamic service pointer has occupied memory, the server obtains the existing control block data of the dynamic service pointer in the occupied memory. The existing control block data contains the business extension information of the first security service previously attached, and needs to be used in conjunction with the business extension information of the new first security service in subsequent processing. Occupied memory refers to the memory space in the dynamic service pointer (pAttachCb) that has been allocated and stored with part of the business extension information of the first security service. When a new first security service needs to be attached, the server can obtain the existing control block data through the get() method.

[0118] Step 404: copy the existing control block data to the target memory corresponding to the target service pointer, and store the service extension information of the first security service to the target array position corresponding to the target service in the target service pointer.

[0119] In an embodiment of the present application, the server copies the existing control block data to the target memory corresponding to the target business pointer, and stores the business extension information of the first security business to the target array position corresponding to the target business in the target business pointer. Specifically, according to the target memory, the server temporarily allocates a continuous memory area as the target memory for all first security services. The server copies the acquired existing control block data to the target memory through the memory copy function, and stores the business extension information of the first security business to the target array position in the target array, and uses pointer operations and memory write operations to write the business extension information of the first security business to the corresponding target array position in the target array, thereby completing the attachment of the business extension information of the first security business. Among them, the existing control block data is the business extension information attached after the first security business processes the initial session. For example, the original control block array is pAttachCb, which contains uiAttachNum control blocks, and each control block data contains the processing function, configuration parameters, status information and processing results of the first security business.

[0120] In this embodiment, by effectively managing the existing control block data and the service extension information of the new first security service in the dynamic service pointer, unified memory management and efficient data operation for the security processing of the initial session are achieved. The server obtains and copies the existing control block data to the target memory, and accurately stores the service extension information of the new first security service in the corresponding position in the target array, thereby ensuring the efficient use of the target memory in the dynamic service pointer, avoiding presetting a security service pointer for each security service, and improving the concurrency performance of the firewall.

[0121] In an exemplary embodiment, before step 404, the method further includes step 4041. Wherein:

[0122] Step 4041, determine the number of extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0123] In the embodiment of the present application, the server uses the extension information number (uiAttachNum) as the target array position corresponding to the target service, and stores the service extension information of the first security service in the target array position of the array pointed to by the dynamic service pointer. For example, the first security service is the first security service to perform security processing on the initial session, and when the first security service is executed, the initial value of uiAttachNum is 0. Furthermore, after the first security service is executed, the server uses uiAttachNum=0 as the target array position corresponding to the target service.

[0124] In this embodiment, each service extension information is attached to the session in the form of a dynamic pointer array. The uiAttachNum field not only indicates the number of service extension information attached to the initial session, but also directly identifies the target position of the number of extension information attached in the pointer array when the new first security service is attached for the first time. The algorithm is simple and efficient, and does not require searching, thereby improving the efficiency of determining the target position.

[0125] In an exemplary embodiment, after step 404 copies the existing control block data to the target memory corresponding to the target service pointer, the method further includes step 4042. Wherein:

[0126] Step 4042: If there is occupied memory, the occupied memory in the initial session and the existing control block data in the occupied memory are released.

[0127] In the embodiment of the present application, the server calls the memory release function to release the occupied memory area, so that the occupied memory resources allocated by the first security service after the execution of the initial session are completely released and can be reallocated. After the occupied memory is released, the occupied memory area in the initial session becomes free and can be used for new memory allocation.

[0128] In this embodiment, the occupied memory and the existing control block data in the initial session are released, and then clean memory space is allocated for the business extension information of the new first security business, thereby avoiding memory leaks and ensuring that resource management in the server is more efficient and reliable, thereby improving the concurrency capability of the firewall.

[0129] In an exemplary embodiment, after step 108, the method further includes step 1081. Wherein:

[0130] Step 1081: Update the index value corresponding to the first security service according to the number of extended information, obtain a new attachment position value, and update the number of extended information.

[0131] In an embodiment of the present application, first, the server clears the index value of the old target position. For example, the server clears the index value of the old target position through "pstSession->uiAttachPos&=~((uint64_t)0x0F<<((uint32_t)enAttach<<2))", that is, the server clears the index value of the old target position by clearing the 4 bits of the corresponding position in uiAttachPos. 0x0F is a mask used to operate only 4 bits, enAttach is the enumeration value of the attachment service, and <<2 is because every 4 bits represent the location of a security service. Then, the index value of the new target position is updated, that is, "pstSession->uiAttachPos |= (uiAttachNum & (uint64_t)0x0F) << ((uint32_t)enAttach << 2);", to achieve the writing of the new target position (the lower 4 bits of uiAttachNum) to the corresponding position in uiAttachPos (attachment position value).

[0132] In this embodiment, the uiAttachPos field is used to record the set of service attachment positions. Every 4 bits identify the attachment position of a service. Whenever it is necessary to obtain the pointer of the service extension block attached to the session, only a simple shift operation is required to quickly update the attachment position value, which is more convenient and efficient than conventional traversal and search operations. At the same time, the number of extension information is updated to indicate the number of service extension information attached to the initial session according to the number of extension information, and directly identify the subscript position in the pointer array that needs to be attached when the new security service is attached for the first time. The algorithm is simple and efficient, and the target position can be directly locked without searching.

[0133] In a specific embodiment, Figure 5 As shown, an example of attaching a specific first security service in an information attaching method is provided, including:

[0134] Step 501, obtaining service extension information corresponding to the initial session and the first security service;

[0135] Step 502, determining a target position in the attachment position value according to the enumeration value corresponding to the first security service, and an index value of the target position in the attachment position value;

[0136] Step 503, determining whether the index value is equal to the initial index value, if the index value is not equal to the initial index value, determining that the state of the first security service is not the first attachment, and executing step 504; if the index value is equal to the initial index value, determining that the state of the first security service is the first attachment, and executing step 505;

[0137] Step 504, attaching the service extension information corresponding to the first security service to the position of the array indexed by the number of extension information;

[0138] Step 505, allocating the number of extended information plus a pointer memory space to the first security service as the target memory;

[0139] Step 506, copy the existing control block data in the pointer memory space of the original extended information quantity to the pointer memory space of the target memory, release the pointer memory space of the original extended information quantity, and point the dynamic service pointer in the initial session to the target memory;

[0140] Step 507, attaching the service extension information corresponding to the first security service to the target position of the array pointed to by the service dynamic pointer and having the array subscript of the extension information quantity;

[0141] Step 508: Update the index value of the first security service to the target position in the attachment position value, and increase the number of extended information by one.

[0142] In an embodiment of the present application, the members in the session structure of the initial session include "void *pAttachCb", "uint64_t_t uiAttachPos" and "uint8_t uiAttachNum", wherein "void *pAttachCb" is a business dynamic pointer pointing to an array used to attach business extension information; "uint64_t_t uiAttachPos" is an attachment position value used to record the target position to which each first security business is attached, and a set of index values ​​corresponding to the first security business in each target position; "uint8_t uiAttachNum" is the number of extended information, used to record the number of business extension information of the first security business that has been attached to the initial session.

[0143] The initial value of uiAttachPos is all 1, that is, 0XFFFFFFFFFFFFFFFF. Each 4 bits in uiAttachPos represents the position of a security service attached in pAttachCb. Figure 6 , Figure 7 and Figure 8 As shown, Figure 6In the initial session, two first security services, CONNLMT and NAT, are attached. CONNLMT is done first and NAT is done later. That is, the target position of CONNLMT in uiAttachPos is 0 to 3, and the target position of NAT in uiAttachPos is 4 to 7. Since CONNLMT is done first, the index value of CONNLMT (the same as the number of extended information when CONNLMT is executed, and CONNLMT is the first first security service to be executed. At this time, the number of extended information of the attached first security service is 0) is 0, and the index value of NAT is 1. Figure 6 The uiAttachPos value in is 0xFFFFFFFFFFFFFF10.

[0144] Figure 7 This is a schematic diagram of the hook record for executing NAT first and then CONNLMT. Figure 8 A schematic diagram of recording the connection of service extension information for executing the three primary security services of CONNLMT, NAT and IPS, with NAT being performed first, CONNLMT being performed second and IPS being performed last. Figure 7 and Figure 8 The recording principle of uiAttachPos value in Figure 6 The recording principle of first performing CONNLMT and then performing NAT is the same as that in the above embodiment, and will not be described in detail.

[0145] The server first executes "uiPosIndex = (uint8_t)((pstSession->uiAttachPos >>((uint32_t)enAttach << 2)) & 0x0F)" to determine the index value of the first security service. There are two cases for the uiPosIndex value. One is that the obtained value is 0x0F (initial index value, indicating that the first security service has not attached service extension information to the initial session before, and this is the first attachment), and the other is that the obtained value is not 0x0F (indicating that the first security service has already attached service extension information to the initial session, and this is not the first attachment, but the service extension information may be updated and needs to be reattached).

[0146] Then, for the first security service that is attached for the first time with a uiPosIndex value of 0x0F, it is necessary to first allocate memory pNewAttachCb, and allocate memory of the size of uiAttachNum + 1 pointer space as the target memory; then copy the original uiAttachNum pointer control blocks to pNewAttachCb, and release the original memory of the size of uiAttachNum pointer space after the copy is completed. At the same time, point the pAttachCb on the initial session to the newly allocated memory pNewAttachCb to allocate the target memory to pAttachCb (pstSession->pAttachCb = pNewAttachCb); finally, attach the business extension block information of the first security service to the initial session, and attach it in an array manner, where uiAttachNum is the subscript index of the array pointed to by pAttachCb. After the attachment is completed, the server will record the target position of the execution attachment in uiAttachPos, and uiAttachNum needs to be increased by 1. The specific attachment process is as follows: Fig. 9 As shown, the attachment process for the first security service that is not attached for the first time is as follows Fig.10 shown.

[0147] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0148] Based on the same inventive concept, the embodiment of the present application also provides an information mounting device for implementing the above-mentioned information mounting method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more information mounting device embodiments provided below can refer to the limitations on the information mounting method above, and will not be repeated here.

[0149] In an exemplary embodiment, Fig.11As shown, an information attachment device 1100 is provided, comprising: an acquisition module 1101, a first determination module 1102, a first attachment module 1103 and a second attachment module 1104, wherein:

[0150] The acquisition module 1101 is used to acquire an initial session; the initial session includes a dynamic service pointer;

[0151] A first determination module 1102 is used to determine a target memory of the initial session if the state of the first security service in the security service for the initial session is the first attachment; the first security service is a service in the firewall that participates in the initial session processing;

[0152] The first attachment module 1103 is used to point the dynamic service pointer in the initial session to the target memory, and to attach the service extension information of the first security service to the initial session;

[0153] The second mounting module 1104 is used to re-execute the step of determining the target memory of the initial session for the next first security service in the security service if the status of the first security service in the security service for the initial session is the first mounting, until the service extension information of the last first security service in the security service is mounted to the initial session to obtain the target session.

[0154] In one embodiment, the initial session further includes the number of extended information; the first determination module 1102 is specifically configured to obtain an index value corresponding to each first security service in the security services;

[0155] If the index value is an initial index value, determining the state of the first security service for the initial session as being attached for the first time;

[0156] When the state of the first security service for the initial session is determined to be the first attachment, determining the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service according to the amount of extended information in the initial session;

[0157] The target memory of the dynamic business pointer is determined based on the occupied memory and the newly added memory.

[0158] In one embodiment, the initial session further includes a mounting position value; the first determination module 1102 is specifically used to determine, for each first security service in the security service, a target position corresponding to the first security service according to an enumeration value corresponding to the first security service; the target position is a position of the first security service in the mounting position value;

[0159] An index value corresponding to the first security service is determined in the attachment position value according to the target position.

[0160] In one embodiment, the first mounting module 1103 is specifically used to obtain the existing control block data of the dynamic service pointer in the occupied memory if there is an occupied memory;

[0161] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0162] In one embodiment, the apparatus 1100 further includes:

[0163] The second determining module is used to determine the quantity of the extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0164] In one embodiment, the apparatus 1100 further includes:

[0165] The release module is used to release the occupied memory in the initial session and the existing control block data in the occupied memory if there is any occupied memory.

[0166] In one embodiment, the apparatus 1100 further includes:

[0167] The updating module is used to update the index value corresponding to the first security service according to the number of extended information, obtain a new attachment position value, and update the number of extended information.

[0168] Each module in the above-mentioned information hooking device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0169] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.12As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an information hanging method is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0170] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0171] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0172] Acquire an initial session; the initial session includes a dynamic service pointer;

[0173] If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session;

[0174] Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session;

[0175] For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0176] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0177] For each first security service among the security services, obtaining an index value corresponding to the first security service;

[0178] If the index value is an initial index value, determining the state of the first security service for the initial session as being attached for the first time;

[0179] In the case where the state of the first security service for the initial session is determined to be the first attachment, determining the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service according to the amount of extended information in the initial session;

[0180] The target memory of the dynamic service pointer is determined based on the occupied memory and the newly added memory.

[0181] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0182] For each first security service in the security services, determine a target position corresponding to the first security service according to an enumeration value corresponding to the first security service; the target position is a position of the first security service in the attachment position value;

[0183] An index value corresponding to the first security service is determined in the attachment position value according to the target position.

[0184] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0185] If there is an occupied memory, obtaining the existing control block data of the dynamic service pointer in the occupied memory;

[0186] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0187] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0188] The number of the extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

[0189] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0190] If there is occupied memory, the occupied memory in the initial session and the existing control block data in the occupied memory are released.

[0191] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0192] The index value corresponding to the first security service is updated according to the number of extended information to obtain a new attachment position value, and the number of extended information is updated.

[0193] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0194] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0195] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0196] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0197] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0198] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An information hooking method, characterized in that: The method comprises: Acquire an initial session; the initial session includes a dynamic service pointer; If the state of a first security service in the security services for the initial session is the first attachment, determining the target memory of the initial session; the first security service is a service in the firewall that participates in the processing of the initial session; Pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session; For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the status of the first security service in the security service for the initial session is the first attachment, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

2. The method according to claim 1, characterized in that The initial session further includes the number of extended information; if the first security service in the security service is attached to the initial session for the first time, determining the target memory of the initial session includes: For each first security service among the security services, obtaining an index value corresponding to the first security service; If the index value is an initial index value, determining the state of the first security service for the initial session as being attached for the first time; In the case where the state of the first security service for the initial session is determined to be the first attachment, determining the occupied memory of the dynamic service pointer and the newly added memory corresponding to the first security service according to the amount of extended information in the initial session; The target memory of the dynamic service pointer is determined based on the occupied memory and the newly added memory.

3. The method according to claim 2, characterized in that The initial session further includes a mounting position value; and the obtaining, for each first security service in the security services, an index value corresponding to the first security service, includes: For each first security service in the security services, determine a target position corresponding to the first security service according to an enumeration value corresponding to the first security service; the target position is a position of the first security service in the attachment position value; An index value corresponding to the first security service is determined in the attachment position value according to the target position.

4. The method according to claim 1, characterized in that: The step of attaching the service extension information of the first security service to the initial session includes: If there is an occupied memory, obtaining the existing control block data of the dynamic service pointer in the occupied memory; The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

5. The method according to claim 4, characterized in that Before storing the service extension information of the first security service to the target array position corresponding to the target service in the target service pointer, the method further comprises: The number of the extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

6. The method according to claim 4, characterized in that After copying the existing control block data to the target memory corresponding to the target service pointer, the method further includes: If there is occupied memory, the occupied memory in the initial session and the existing control block data in the occupied memory are released.

7. The method according to claim 1, characterized in that After attaching the service extension information of the first security service to the initial session, the method further includes: The index value corresponding to the first security service is updated according to the number of extended information to obtain a new attachment position value, and the number of extended information is updated.

8. An information hooking device, characterized in that: The device comprises: An acquisition module, used for acquiring an initial session; the initial session includes a dynamic service pointer; A first determination module is used to determine the target memory of the initial session if the state of the first security service in the security service for the initial session is the first attachment; the first security service is the service in the firewall that participates in the processing of the initial session; A first mounting module, used for pointing the dynamic service pointer in the initial session to the target memory, and mounting the service extension information of the first security service to the initial session; The second mounting module is used to re-execute the step of determining the target memory of the initial session for the next first security service in the security service if the status of the first security service in the security service for the initial session is the first mounting, until the service extension information of the last first security service in the security service is mounted to the initial session to obtain the target session.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images