Information hooking method and device, computer device, readable storage medium and program product

Abstract

This application relates to an information attachment method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: obtaining an initial session; the initial session containing a dynamic service pointer; if a first security service in the security services is in the initial session's first attachment state, determining the target memory of the initial session; the first security service is a service in the firewall participating in the initial session processing; pointing the dynamic service pointer in the initial session to the target memory, and attaching the service extension information of the first security service to the initial session; for the next first security service in the security services, re-executing the step of determining the target memory of the initial session if the first security service in the security services is in the initial attachment state, until the service extension information of the last first security service in the security services is attached to the initial session, thus obtaining the target session. This method can improve the concurrency performance of the firewall.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an information splicing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] In the field of network security, firewalls, as the first line of defense protecting networks from external threats, directly affect the stability and security of the entire network system. Multiple session-based services on a firewall typically share the same session, with each service attaching its own extended service module information to that session.

[0003] In traditional technology, the session structure reserves a service pointer for each security service to attach its respective service module extension information. When traffic flows through the firewall, each security service in the firewall processes the traffic and, based on the security service pointers reserved for each security service in the session structure, attaches the service extension information of each security service to the session corresponding to the traffic. That is, the service extension information is stored in the memory address pointed to by each security service pointer, thus obtaining the target session and realizing the association of the processing result of each security service with the session of the traffic.

[0004] However, in traditional technologies, the implementation method of reserving a service pointer for each security service in the session structure is often insufficient. Since the number of security services is large and traffic generally only requires processing by a portion of the security services, the security service pointers of the remaining security services are idle, which wastes memory resources and leads to poor concurrency performance of the firewall. Summary of the Invention

[0005] Therefore, it is necessary to provide an information linking method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] Firstly, this application provides an information linking method, including:

[0007] Obtain an initial session; the initial session contains a dynamic service pointer;

[0008] If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing.

[0009] The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session;

[0010] For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0011] In one embodiment, the initial session further includes the number of extended information; if the first security service in the security service is in the state of first connection for the initial session, determining the target memory of the initial session includes:

[0012] For each first security service in the security service, obtain the index value corresponding to the first security service;

[0013] If the index value is the initial index value, the state of the first security service for the initial session is determined as the first connection;

[0014] If the state of the first security service in relation to the initial session is determined to be the first connection, the memory already occupied by the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session.

[0015] The target memory for the dynamic service pointer is determined based on the already occupied memory and the newly added memory.

[0016] In one embodiment, the initial session further includes a hook-up location value; obtaining the index value corresponding to each first security service in the security services includes:

[0017] For each first security service in the security services, the target location corresponding to the first security service is determined according to the enumeration value corresponding to the first security service; the target location is the position of the first security service in the attachment location value.

[0018] The index value corresponding to the first security service is determined from the attachment location value based on the target location.

[0019] In one embodiment, attaching the service extension information of the first security service to the initial session includes:

[0020] If there is already occupied memory, retrieve the existing control block data of the dynamic service pointer in the occupied memory;

[0021] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0022] In one embodiment, before storing the service extension information of the first security service to the target array position corresponding to the target service in the target service pointer, the method further includes:

[0023] The quantity of extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

[0024] In one embodiment, after copying the existing control block data to the target memory corresponding to the target service pointer, the method further includes:

[0025] If there is already occupied memory, release the occupied memory in the initial session and the existing control block data in the occupied memory.

[0026] In one embodiment, after attaching the service extension information of the first security service to the initial session, the method further includes:

[0027] The index value corresponding to the first security service is updated based on the number of extended information to obtain a new attachment location value, and the number of extended information is updated accordingly.

[0028] Secondly, this application also provides an information linking device, comprising:

[0029] The acquisition module is used to acquire the initial session; the initial session contains a dynamic service pointer.

[0030] The first determining module is used to determine the target memory of the initial session if the first security service in the security service is in the state of first connection for the initial session; the first security service is a service in the firewall that participates in the initial session processing.

[0031] The first attach module is used to point the dynamic service pointer in the initial session to the target memory and attach the service extension information of the first security service to the initial session;

[0032] The second attach module is used to re-execute the steps of determining the target memory of the initial session if the state of the first security service in the security service is the first attach to the initial session, for the next first security service in the security service, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0033] In one embodiment, the initial session further includes the number of extended information; the first determining module is specifically used to obtain the index value corresponding to each first security service in the security services;

[0034] If the index value is the initial index value, the state of the first security service for the initial session is determined as the first connection;

[0035] If the state of the first security service in relation to the initial session is determined to be the first connection, the memory already occupied by the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session.

[0036] The target memory for the dynamic service pointer is determined based on the already occupied memory and the newly added memory.

[0037] In one embodiment, the initial session further includes a hook-up location value; the first determining module is specifically used to determine the target location corresponding to each first security service in the security services based on the enumeration value corresponding to the first security service; the target location is the position of the first security service in the hook-up location value;

[0038] The index value corresponding to the first security service is determined from the attachment location value based on the target location.

[0039] In one embodiment, the first hooking module is specifically used to obtain the existing control block data of the dynamic service pointer in the occupied memory if there is already occupied memory.

[0040] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0041] In one embodiment, the device further includes:

[0042] The second determining module is used to determine the number of extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0043] In one embodiment, the device further includes:

[0044] The release module is used to release the occupied memory in the initial session and the existing control block data in the occupied memory if there is occupied memory.

[0045] In one embodiment, the device further includes:

[0046] The update module is used to update the index value corresponding to the first security service according to the number of extended information, obtain a new attachment location value, and update the number of extended information.

[0047] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0048] Obtain an initial session; the initial session contains a dynamic service pointer;

[0049] If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing.

[0050] The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session;

[0051] For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0052] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0053] Obtain an initial session; the initial session contains a dynamic service pointer;

[0054] If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing.

[0055] The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session;

[0056] For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0057] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0058] Obtain an initial session; the initial session contains a dynamic service pointer;

[0059] If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing.

[0060] The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session;

[0061] For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0062] The aforementioned information attaching method, apparatus, computer equipment, computer-readable storage medium, and computer program product obtain an initial session; the initial session contains a dynamic service pointer; if the first security service in the security services is in the initial session's first attach state, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing; the dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session; for the next first security service in the security services, the step of determining the target memory of the initial session if the first security service in the security services is in the initial session's first attach state is re-executed, until the service extension information of the last first security service in the security services is attached to the initial session, thus obtaining the target session. Using this method, by using a dynamic service pointer to allocate target memory for attaching the dynamic service pointer during the process of completing each first security service in the initial session established for specific traffic, since the first security service is the security service that the current traffic needs to process among all security services, it is not necessary to pre-configure a security service pointer for each security service. Therefore, the memory usage of the security service pointer in the initial session can be reduced, thereby improving the firewall's concurrency performance. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a flowchart illustrating an information attachment method in one embodiment;

[0065] Figure 2 This is a flowchart illustrating the process of determining the target memory in one embodiment;

[0066] Figure 3 This is a flowchart illustrating the steps for determining the index value in one embodiment;

[0067] Figure 4 This is a flowchart illustrating the process of attaching business extension information in a specific embodiment.

[0068] Figure 5 This is a flowchart illustrating an example of attaching a specific first security service in an information attachment method in one embodiment.

[0069] Figure 6 This is a schematic diagram illustrating the attachment of service extension information in one embodiment;

[0070] Figure 7 This is a schematic diagram illustrating the attachment of service extension information in another embodiment;

[0071] Figure 8 This is a schematic diagram illustrating the attachment of service extension information in another embodiment;

[0072] Figure 9 This is a schematic diagram of the code for attaching the first security service in one embodiment.

[0073] Figure 10 This is a schematic diagram of the code for attaching the first security service that is not being attached for the first time in one embodiment;

[0074] Figure 11 This is a structural block diagram of an information attachment device in one embodiment;

[0075] Figure 12 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0077] In one embodiment, such as Figure 1 As shown, an information linking method is provided. This embodiment illustrates the method by applying it to a server. It is understood that this method can also be applied to systems including terminals and servers, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0078] Step 102: Obtain the initial session.

[0079] The initial session contains a dynamic business pointer, which is represented by pAttachCb.

[0080] In this embodiment of the application, in the field of network security, the firewall, as the first line of defense protecting the network from external threats, directly affects the stability and security of the entire network system. Session concurrency, as an important performance indicator of the firewall, is a key metric for measuring its ability to handle multiple simultaneous sessions. To improve the firewall's session concurrency, multiple security services on the firewall based on sessions typically share the same session. That is, when a traffic flow passes through multiple security services, only one session is ultimately established, but each security service attaches its respective service module's service extension information to that session.

[0081] Session-based security services supported on firewalls may include connection limit, network address translation (NAT), load balancing, application layer gateway (ALG), advanced flow tracking (AFT), and intrusion prevention system (IPS).

[0082] The firewall in the server obtains the initial session. In addition to the dynamic business pointer, the initial session also contains a session 5-tuple, which includes five fields: source IP, source port, destination IP, destination port, and the layer 4 protocol. These fields serve as the session identifier to identify and manage the session.

[0083] Step 104: If the first security service in the security services is in the state of first connection for the initial session, determine the target memory of the initial session.

[0084] The first security service is the service that participates in the initial session processing within the firewall.

[0085] In this embodiment, the firewall is pre-configured with a series of security policies, which define security processing rules for different types of traffic (based on source IP, destination IP, source port, destination port, Layer 4 communication protocol, etc.). When traffic enters the firewall, the server first matches the corresponding security policy based on the traffic characteristics (e.g., source IP, destination IP, source port, destination port, protocol, etc.). Then, the server determines the security services that the firewall needs to execute for the current initial session, and identifies the first security service that needs to participate in the security processing of the initial session from the full set of pre-configured security services of the firewall.

[0086] In one specific embodiment, the security policy can be a security rule based on specific conditions, such as "apply IPS (Intrusion Prevention System) inspection to traffic from IP address A to IP address B". When traffic enters the firewall, the firewall checks the rules in the security policy library one by one, finds the target policy that matches the characteristics of the current traffic, and processes the initial session of the traffic according to the security services indicated by the target policy.

[0087] After identifying the first security service within the security services, the server transmits the initial session to each of the first security services according to the firewall's preset order. Within each security service, the server first checks whether this is the first security service processing the initial session for the first time, determining the status of the first security service relative to the initial session. If the status of the first security service relative to the initial session is "first connection," it means that no memory has been allocated for this first security service in the session structure. To store the service extension information of this first security service, memory must first be allocated. The dynamic service pointer can be a general pointer to an array; the session structure uses the array pointed to by the dynamic service pointer to store the service extension information of each service.

[0088] Therefore, when each first security service is first attached, the dynamic service pointer may be empty or need to be expanded. Therefore, sufficient memory space must be allocated for it. Thus, when the first security service is attached for the first session, the server first determines the target of the dynamic service pointer in the initial session.

[0089] In another embodiment, if the first security service in the security service is not the first time it is attached to the initial session, and the control block of the subsequent first security service is updated, the updated first security service is directly attached to the position indicated by the index value, without having to reallocate target memory for the first security service that is not the first time it is attached.

[0090] Step 106: Point the dynamic service pointer in the initial session to the target memory, and attach the service extension information of the first security service to the initial session.

[0091] In this embodiment, the server allocates memory resources of the target memory size to the dynamic service pointer in the initial session, allowing the service extension information of the first security service to be attached to the initial session. After each first security service performs security processing on the initial session, the server allocates memory for that first security service in the dynamic service pointer (a pointer to an array) of the initial session and stores its address in a new pointer control block. Since this pointer control block is dynamically allocated according to the number of first security services in the initial session, the dynamic service pointer pointing to the target memory can expand the target memory of the dynamic service as needed, thereby correctly referencing the memory address where the service extension information of the first security service is located.

[0092] The extended service information for the primary security service can be the processing result of the primary security service. This extended service information needs to be managed and stored within the session. The process of attaching extended service information involves associating this information with the initial session. By attaching the extended service information of the primary security service to a designated location within the initial session, the server ensures that the session structure can correctly access and manipulate this extended service information through dynamic service pointers.

[0093] Step 108: For the next first security service in the security service, re-execute the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session, until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0094] The second security service is the last security service within the first security service.

[0095] In this embodiment, the security service may include multiple first security services (e.g., SESSION_ATTACH_CONNLMT, SESSION_ATTACH_NAT, etc.). The server performs the same attach operation on each first security service according to steps 104 and 106 until all first security services are processed. The operation of repeatedly attaching the service extension information of each subsequent first security service is not described in detail in this embodiment. After attaching the service extension information of the last first security service in the security service, it indicates that the server has completed attaching the service extension information of all first security services; that is, each element in the array pointed to by the service dynamic pointer of the target session stores the service extension information of one first security service.

[0096] In the above information attachment method, during the process of completing each first security service in the initial session established for specific traffic, a dynamic service pointer is used to allocate target memory for attaching the dynamic service pointer for the first security service. Since the first security service is the security service that the current traffic needs to process among all security services, it is not necessary to pre-configure a security service pointer for each security service. Therefore, the memory occupation of the security service pointer in the initial session can be reduced, thereby improving the concurrency performance of the firewall.

[0097] In an exemplary embodiment, the initial session also includes a number of extended information entries, which is the number of service extended information entries already attached in the initial session, represented by the uiAttachNum field; for example... Figure 2 As shown, step 104 includes steps 202 to 208. Wherein:

[0098] Step 202: For each first security service in the security services, obtain the index value corresponding to the first security service.

[0099] In this embodiment, the index value corresponding to the first security service is the index value stored at the corresponding position in the attachment position value. When the server performs security processing on the initial session according to each security service, it first obtains the index value corresponding to the first security service from the attachment position value to determine whether the current first security service is the first time processing the initial session.

[0100] Step 204: If the index value is the initial index value, determine the state of the first security service for the initial session as the first connection.

[0101] In this embodiment, the attachment position value is used to store the attachment information of each first security service in the initial session. The index value stored at each position represents the processing status identifier of the corresponding first security service. The initial index value is the default value of the attachment position value; for example, the initial value is all 1s, i.e., 0xFFFFFFFFFFFFFFFF. The attachment position value and the position of the first security service in the attachment position value are described in detail in the following embodiments.

[0102] Step 206: If the state of the first security service for the initial session is determined to be the first connection, determine the memory already occupied by the dynamic service pointer and the newly added memory corresponding to the first security service based on the amount of extended information in the initial session.

[0103] In this embodiment, when the state of the first security service in the initial session is determined to be "first connection," the server determines the number of extended information entries (uiAttachNum) in the current initial session as the occupied memory of the dynamic service pointer. uiAttachNum is a counter that records the number of currently connected service modules. For example, if the value of uiAttachNum is 5, it means that 5 extended information entries for the first security service have been connected to the initial session. When a new extended information entry for the first security service needs to be connected to the initial session, the server needs to allocate memory for this new extended information entry. To ensure the correctness of memory allocation, the server needs to know the total number of currently connected service modules in order to allocate the correct memory location for the new extended information entry. Therefore, the server determines the location of the new extended information entry based on uiAttachNum+1. That is, uiAttachNum+1 calculates the location of the newly connected extended information entry. For example, if uiAttachNum is 5, then uiAttachNum+1 is 6, indicating that the new extended information entry will be connected to the 6th location.

[0104] Step 208: Determine the target memory for the dynamic business pointer based on the occupied memory and the newly added memory.

[0105] In this embodiment, after determining the occupied memory and the newly added memory, the server needs to calculate the total target memory for the dynamic service pointer and reallocate memory based on the target memory. That is, the server obtains the target memory based on the position calculated by uiAttachNum+1, and allocates it according to the service extension information of the new first security service.

[0106] In this embodiment, by obtaining the index value corresponding to the first security service and determining whether it is the first connection, the server can accurately identify the processing status of each first security service and allocate appropriate memory resources accordingly. This not only optimizes memory usage and avoids resource waste and fragmentation, but also ensures that the service extension information of new first security services can be successfully connected to the initial session, thereby improving the overall stability and processing efficiency of the system.

[0107] In one exemplary embodiment, the initial session also includes a attach position value, represented by uiAttachPos; such as Figure 3 As shown, step 202 includes steps 302 to 304. Wherein:

[0108] Step 302: For each first security service in the security services, determine the target location corresponding to the first security service based on the enumeration value corresponding to the first security service.

[0109] The target location is the position of the first security service within the attached location value.

[0110] In this embodiment of the application, in the enumerated type of security services, each security service has a corresponding enumeration value. The server can determine the enumeration value corresponding to the first security service based on the correspondence between the security services and the enumeration values. This enumeration value is used to determine the target position of the first security service in the attachment location value. For example, enumeration values ​​include: SESSION_ATTACH_CONNLMT=0, SESSION_ATTACH_NAT=1, SESSION_ATTACH_LB, etc.

[0111] The initial value of the attachment position value is all 1s, i.e., 0xFFFFFFFFFFFFFFFF. Each 4 bits in uiAttachPos (attachment position value) represents the position of a security service attached to pAttachCb (dynamic service pointer). This is divided according to the enumeration values ​​corresponding to the aforementioned security services: bits 0 to 3 of uiAttachPos record the position of CONNLMT extension information in pAttachCb; bits 4 to 7 of uiAttachPos record the position of NAT extension information in pAttachCb; bits 8 to 11 of uiAttachPos record the position of LB extension information in pAttachCb; and so on for other security services. Then, the server determines the target position of the first security service based on the enumeration value corresponding to the first security service in the attachment position value. For example, if the current first security service is a NAT service (SESSION_ATTACH_NAT), the server first determines that the enumeration value corresponding to the NAT service is 2, and then determines the target position of the first security service as bits 4 to 7 of uiAttachPos based on the enumeration value corresponding to the NAT service.

[0112] Step 304: Determine the index value corresponding to the first security service in the attachment location value based on the target location.

[0113] In this embodiment, the server extracts the 4-bit data corresponding to the target position from the attachment position value through bit operations. This 4-bit data represents the index value of the first security service in the dynamic service pointer. For example, the server calculates the index value of the target position in the attachment position value using "uiPosIndex = (uint8_t)((pstSession->uiAttachPos >> ((uint32_t)enAttach <<2)) & 0x0F)", which serves as the index value corresponding to the first security service.

[0114] In this embodiment, the target position of each first security service in the attachment position value can be accurately determined by enumerating the value, and the index value of the first security service can be determined by the target position. This achieves memory allocation and index value recording only after the initial session is processed by the first security service. A security service pointer is pre-set for each security service, reducing the memory occupation of the security service pointer in the initial session, thereby improving the concurrency performance of the firewall.

[0115] In one exemplary embodiment, such as Figure 4 As shown, step 108 includes steps 402 to 404. Wherein:

[0116] Step 402: If there is already occupied memory, obtain the existing control block data of the dynamic business pointer in the occupied memory.

[0117] In this embodiment, when the dynamic service pointer already occupies memory, the server retrieves the existing control block data of the dynamic service pointer within the occupied memory. This existing control block data contains service extension information for previously attached first security services and needs to be used in conjunction with the service extension information of new first security services in subsequent processing. Occupied memory refers to the memory space in the dynamic service pointer (pAttachCb) that has already been allocated and stores some of the service extension information for the first security services. When a new first security service needs to be attached, the server can retrieve the existing control block data using the get() method.

[0118] Step 404: Copy the existing control block data to the target memory corresponding to the target service pointer, and store the service extension information of the first security service to the target array position corresponding to the target service in the target service pointer.

[0119] In this embodiment, the server copies existing control block data to the target memory corresponding to the target service pointer and stores the service extension information of the first security service in the target array position corresponding to the target service pointer. Specifically, based on the target memory, the server temporarily allocates a contiguous memory region as the target memory for all first security services. The server copies the acquired existing control block data to the target memory using a memory copy function and stores the service extension information of the current first security service in the target array position. Pointer operations and memory write operations are used to write the service extension information of the first security service to the corresponding target array position in the target array, completing the attachment of the service extension information of the first security service. The existing control block data consists of the service extension information attached after each processing of the initial session by the first security service. For example, the original control block array is pAttachCb, which contains uiAttachNum control blocks. Each control block contains the processing function, configuration parameters, status information, and processing result of the first security service.

[0120] In this embodiment, by effectively managing the existing control block data and the service extension information of the new first security service in the dynamic service pointer, unified memory management and efficient data operations are achieved for the secure processing of the initial session. The server obtains and copies the existing control block data to the target memory and accurately stores the service extension information of the new first security service in the corresponding position in the target array, ensuring efficient utilization of the target memory in the dynamic service pointer, avoiding the need to pre-configure a security service pointer for each security service, and improving the concurrency performance of the firewall.

[0121] In an exemplary embodiment, prior to step 404, the method further includes step 4041. Wherein:

[0122] Step 4041: Determine the number of extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0123] In this embodiment, the server uses the number of extended information (uiAttachNum) as the target array location corresponding to the target service, and stores the service extended information of the first security service in the target array location pointed to by the dynamic service pointer. For example, if the first security service is the first security service to perform security processing on the initial session, then when the first security service is executed, the initial value of uiAttachNum is 0. Furthermore, after the first security service is executed, the server uses uiAttachNum=0 as the target array location corresponding to the target service.

[0124] In this embodiment, various service extension information is attached to the session in the form of a dynamic pointer array. The uiAttachNum field indicates both the number of service extension information already attached to the initial session and directly identifies the target position of the number of extension information attached to the pointer array when a new first security service is attached for the first time. The algorithm is simple and efficient, requires no searching, and improves the efficiency of determining the target position.

[0125] In an exemplary embodiment, after step 404, which copies the existing control block data to the target memory corresponding to the target service pointer, the method further includes step 4042. Wherein:

[0126] Step 4042: If there is already occupied memory, release the already occupied memory in the initial session and the existing control block data in the already occupied memory.

[0127] In this embodiment, the server calls a memory release function to release the occupied memory area, ensuring that the memory resources allocated by each of the first security services after the initial session are completely released and can be reallocated. After releasing the occupied memory, the occupied memory area in the initial session becomes free and can be used for new memory allocation.

[0128] In this embodiment, the memory already occupied in the initial session and the existing control block data therein are released, and then clean memory space is allocated for the service extension information of the new first security service. This avoids memory leaks and ensures that resource management in the server is more efficient and reliable, thereby improving the concurrency capability of the firewall.

[0129] In an exemplary embodiment, after step 108, the method further includes step 1081. Wherein:

[0130] Step 1081: Update the index value corresponding to the first security service according to the number of extended information to obtain a new attachment location value, and update the number of extended information.

[0131] In this embodiment, firstly, the server clears the old target location index value. For example, the server clears the old target location index value by using "pstSession->uiAttachPos&=~((uint64_t)0x0F<<((uint32_t)enAttach<<2))", which means the server clears the old target location index value by clearing the corresponding 4 bits in uiAttachPos. 0x0F is a mask used to operate on only 4 bits, enAttach is the enumeration value of the attached service, and <<2 is because each 4 bits represents the location of a security service. Then, the new target location index value is updated, i.e., "pstSession->uiAttachPos |= (uiAttachNum & (uint64_t)0x0F) << ((uint32_t)enAttach << 2);", which writes the new target location (the lower 4 bits of uiAttachNum) into the corresponding position in uiAttachPos (attachment location value).

[0132] In this embodiment, the `uiAttachPos` field records the set of attachment positions for each service. Each 4 bits identify the attachment position of a service. Whenever it is necessary to obtain the pointer of the service extension block attached to the session, only a simple bitwise shift operation is needed to quickly update the attachment position value, which is more convenient and efficient than conventional traversal and search operations. At the same time, the number of extension information is updated, which indicates the number of service extension information already attached to the initial session, and directly identifies the index position in the pointer array that a new security service needs to be attached to for the first time. The algorithm is simple and efficient, and the target position is directly locked without searching.

[0133] In a specific embodiment, such as Figure 5 As shown, an example of attaching a specific first-level security service in an information attachment method is provided, including:

[0134] Step 501: Obtain the service extension information corresponding to the initial session and the first security service;

[0135] Step 502: Determine the target location in the attachment location value based on the enumeration value corresponding to the first security service, and determine the index value of the target location in the attachment location value;

[0136] Step 503: Determine whether the index value is equal to the initial index value. If the index value is not equal to the initial index value, determine that the status of the first security service is not the first connection and proceed to step 504. If the index value is equal to the initial index value, determine that the status of the first security service is the first connection and proceed to step 505.

[0137] Step 504: Attach the service extension information corresponding to the first security service to the array index corresponding to the number of extension information items;

[0138] Step 505: Allocate an additional pointer memory space to the first security service for the number of extended information items, as the target memory.

[0139] Step 506: Copy the existing control block data in the pointer memory space of the original extended information quantity to the pointer memory space of the target memory, release the pointer memory space of the original extended information quantity, and point the dynamic business pointer in the initial session to the target memory.

[0140] Step 507: Attach the service extension information corresponding to the first security service to the target position where the array index of the array pointed to by the service dynamic pointer is the number of extension information items;

[0141] Step 508: Update the index value of the first security service to the target location in the attachment location value, and increment the number of extended information by one.

[0142] In this embodiment of the application, the members in the session structure of the initial session include “void *pAttachCb”, “uint64_t_t uiAttachPos”, and “uint8_t uiAttachNum”. Among them, “void *pAttachCb” is a dynamic pointer to the service, pointing to an array used to attach service extension information; “uint64_t_t uiAttachPos” is the attachment position value, used to record the target position to which each first security service is attached, and the set of index values ​​corresponding to the first security service in each target position; “uint8_t uiAttachNum” is the number of extension information, used to record the number of service extension information of the first security services that have been attached to the initial session.

[0143] The initial value of uiAttachPos is all 1s, i.e., 0xFFFFFFFFFFFFFFFF. Each 4 bits in uiAttachPos represents the position of a security service attached to pAttachCb. For example... Figure 6 , Figure 7 and Figure 8 As shown, Figure 6In the initial session, two primary security services, CONNLMT and NAT, were attached, with CONNLMT performed first and NAT performed later. Specifically, the target position for CONNLMT in uiAttachPos is 0 to 3, and the target position for NAT is 4 to 7. Since CONNLMT was performed first, its index value (which is the same as the number of extended information entries when CONNLMT was executed, and since CONNLMT is the first primary security service executed, the number of extended information entries for the attached primary security services is 0) is 0. The index value for NAT is 1. Figure 6 The value of uiAttachPos in the value is 0XFFFFFFFFFFFFFF10.

[0144] Figure 7 This is a diagram illustrating the process of executing NAT first, followed by CONNLMT for attaching records. Figure 8 This diagram illustrates the process of attaching service extension information when performing the three primary security services: CONNLMT, NAT, and IPS, with NAT performed first, followed by CONNLMT, and finally IPS. Figure 7 and Figure 8 The recording principle of uiAttachPos value and Figure 6 The recording principle for performing CONNLMT first and then NAT is the same, and will not be repeated in this embodiment.

[0145] The server first executes "uiPosIndex =(uint8_t)((pstSession->uiAttachPos >>((uint32_t)enAttach << 2)) & 0x0F)" to determine the index value of the first security service. The uiPosIndex value can have two possibilities: either it returns 0x0F (the initial index value, indicating that the first security service has not previously attached service extension information to the initial session, and this is the first attachment), or it returns a value other than 0x0F (meaning that the first security service already has service extension information attached to the initial session, this is not the first attachment, but the service extension information may have been updated, requiring reattaching).

[0146] Then, for the first security service attached with an uiPosIndex value of 0x0F, memory pNewAttachCb needs to be allocated first, along with memory of uiAttachNum + 1 pointer space as the target memory. Next, the original uiAttachNum pointer control blocks are copied to pNewAttachCb. After copying, the original uiAttachNum pointer space is released, and the pAttachCb in the initial session is set to point to the newly allocated memory pNewAttachCb, thus allocating the target memory to pAttachCb (pstSession->pAttachCb = pNewAttachCb). Finally, the service extension block information for this first security service is attached to the initial session using an array, where uiAttachNum serves as the index of the array pointed to by pAttachCb. After attachment, the server records the target location of the attachment in uiAttachPos and increments uiAttachNum by 1. The specific attachment process is as follows: Figure 9 As shown, the connection process for the first security service that is not being connected for the first time is as follows: Figure 10 As shown.

[0147] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0148] Based on the same inventive concept, this application also provides an information attaching device for implementing the information attaching method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more information attaching device embodiments provided below can be found in the limitations of the information attaching method described above, and will not be repeated here.

[0149] In one exemplary embodiment, such as Figure 11As shown, an information attachment device 1100 is provided, including: an acquisition module 1101, a first determination module 1102, a first attachment module 1103, and a second attachment module 1104, wherein:

[0150] Module 1101 is used to obtain the initial session; the initial session contains a dynamic business pointer.

[0151] The first determining module 1102 is used to determine the target memory of the initial session if the first security service in the security service is in the state of first connection for the initial session; the first security service is the service in the firewall that participates in the initial session processing.

[0152] The first attach module 1103 is used to point the dynamic service pointer in the initial session to the target memory and attach the service extension information of the first security service to the initial session;

[0153] The second attach module 1104 is used to re-execute the steps of determining the target memory of the initial session if the state of the first security service in the security service is the first attachment for the initial session, for the next first security service in the security service, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session.

[0154] In one embodiment, the initial session also includes the number of extended information; the first determining module 1102 is specifically used to obtain the index value corresponding to each first security service in the security services;

[0155] If the index value is the initial index value, the state of the first security service for the initial session will be determined as the first connection;

[0156] When the state of the first security service for the initial session is determined to be the first connection, the memory occupied by the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session.

[0157] The target memory for dynamic business pointers is determined based on the memory already occupied and the newly added memory.

[0158] In one embodiment, the initial session further includes a hook position value; the first determining module 1102 is specifically used to determine the target position corresponding to each first security service in the security services according to the enumeration value corresponding to the first security service; the target position is the position of the first security service in the hook position value;

[0159] The index value corresponding to the first security service is determined from the attachment location value based on the target location.

[0160] In one embodiment, the first hooking module 1103 is specifically used to obtain the existing control block data of the dynamic business pointer in the occupied memory if there is occupied memory.

[0161] Copy the existing control block data to the target memory corresponding to the target service pointer, and store the service extension information of the first security service in the target array position corresponding to the target service in the target service pointer.

[0162] In one embodiment, the device 1100 further includes:

[0163] The second determining module is used to determine the number of extended information in the initial session as the target array position corresponding to the target service in the target service pointer.

[0164] In one embodiment, the device 1100 further includes:

[0165] The release module is used to release the memory already occupied in the initial session, as well as the existing control block data in the occupied memory, if there is any occupied memory.

[0166] In one embodiment, the device 1100 further includes:

[0167] The update module is used to update the index value corresponding to the first security service based on the number of extended information, obtain the new attachment location value, and update the number of extended information.

[0168] Each module in the aforementioned information connection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0169] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 12As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an information linking method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0170] Those skilled in the art will understand that Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0171] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0172] Obtain an initial session; the initial session contains a dynamic service pointer;

[0173] If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is the service in the firewall that participates in the initial session processing.

[0174] The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session;

[0175] For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session.

[0176] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0177] For each first security service in the security service, obtain the index value corresponding to the first security service;

[0178] If the index value is the initial index value, the state of the first security service for the initial session is determined as the first connection;

[0179] If the state of the first security service in relation to the initial session is determined to be the first connection, the memory already occupied by the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session.

[0180] The target memory for the dynamic service pointer is determined based on the already occupied memory and the newly added memory.

[0181] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0182] For each first security service in the security services, the target location corresponding to the first security service is determined according to the enumeration value corresponding to the first security service; the target location is the position of the first security service in the attachment location value.

[0183] The index value corresponding to the first security service is determined from the attachment location value based on the target location.

[0184] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0185] If there is already occupied memory, retrieve the existing control block data of the dynamic service pointer in the occupied memory;

[0186] The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

[0187] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0188] The quantity of extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

[0189] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0190] If there is already occupied memory, release the occupied memory in the initial session and the existing control block data in the occupied memory.

[0191] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0192] The index value corresponding to the first security service is updated based on the number of extended information to obtain a new attachment location value, and the number of extended information is updated accordingly.

[0193] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0194] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0195] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0196] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0197] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0198] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An information linking method, characterized in that, The method includes: Obtain an initial session; the initial session contains a dynamic service pointer, which is used to point to an array and store the service extension information of the first security service; If the first security service in the security services is in the state of first connection for the initial session, the target memory of the initial session is determined; the first security service is a service in the firewall that participates in the initial session processing. The dynamic service pointer in the initial session is pointed to the target memory, and the service extension information of the first security service is attached to the initial session; For the next first security service in the security service, the step of determining the target memory of the initial session if the state of the first security service in the security service is the first connection to the initial session is re-executed until the service extension information of the last first security service in the security service is connected to the initial session to obtain the target session; If the first security service in the security service is in the state of first connection for the initial session, determining the target memory of the initial session includes: For the initial session, among the pre-configured full set of security services, the first security service that requires security processing for the initial session is determined; If the first security service is in the state of first connection for the initial session, determine the target memory for the initial session.

2. The method according to claim 1, characterized in that, The initial session also includes the amount of extended information; if the first security service in the security service is in the state of first connection to the initial session, determining the target memory of the initial session includes: For each first security service in the security services, obtain the index value corresponding to the first security service; If the index value is the initial index value, the state of the first security service for the initial session is determined as the first connection; If the state of the first security service in relation to the initial session is determined to be the first connection, the memory already occupied by the dynamic service pointer and the newly added memory corresponding to the first security service are determined according to the amount of extended information in the initial session. The target memory for the dynamic service pointer is determined based on the already occupied memory and the newly added memory.

3. The method according to claim 2, characterized in that, The initial session also includes a hook-up location value; obtaining the index value corresponding to each first security service in the security services includes: For each first security service in the security services, the target location corresponding to the first security service is determined according to the enumeration value corresponding to the first security service; the target location is the position of the first security service in the attachment location value. The index value corresponding to the first security service is determined from the attachment location value based on the target location.

4. The method according to claim 1, characterized in that, The step of attaching the service extension information of the first security service to the initial session includes: If there is already occupied memory, retrieve the existing control block data of the dynamic service pointer in the occupied memory; The existing control block data is copied to the target memory corresponding to the target service pointer, and the service extension information of the first security service is stored in the target array position corresponding to the target service in the target service pointer.

5. The method according to claim 4, characterized in that, Before storing the service extension information of the first security service into the target array position corresponding to the target service in the target service pointer, the method further includes: The quantity of extended information in the initial session is determined as the target array position corresponding to the target service in the target service pointer.

6. The method according to claim 4, characterized in that, After copying the existing control block data to the target memory corresponding to the target service pointer, the method further includes: If there is already occupied memory, release the occupied memory in the initial session and the existing control block data in the occupied memory.

7. The method according to claim 1, characterized in that, After attaching the service extension information of the first security service to the initial session, the method further includes: The index value corresponding to the first security service is updated based on the number of extended information to obtain a new attachment location value, and the number of extended information is updated accordingly.

8. An information linking device, characterized in that, The device includes: An acquisition module is used to acquire an initial session; the initial session contains a dynamic service pointer, which is used to point to an array and store the service extension information of the first security service; The first determining module is used to determine the target memory of the initial session if the first security service in the security service is in the state of first connection for the initial session; the first security service is a service in the firewall that participates in the initial session processing. The first attach module is used to point the dynamic service pointer in the initial session to the target memory and attach the service extension information of the first security service to the initial session; The second attach module is used to re-execute the step of determining the target memory of the initial session if the state of the first security service in the security service is the first attach for the initial session, for the next first security service in the security service, until the service extension information of the last first security service in the security service is attached to the initial session to obtain the target session; The first determining module is specifically used to determine, for the initial session, the first security service that needs to be security processed for the initial session from the pre-configured full set of security services; If the first security service is in the state of first connection for the initial session, determine the target memory for the initial session.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images