Data processing method and device for network application firewall server

Abstract

The embodiment of the invention provides a data processing method and device for a network application firewall server, and the method comprises the steps: storing a network protocol address corresponding to a domain name accessed to the network application firewall server in a cache region; the network protocol address comprises corresponding server information; receiving a target request sent by the client, wherein the target request comprises a target domain name; querying a target network protocol address corresponding to the target domain name from the cache region; and forwarding the target request to a target server corresponding to the target network protocol address. According to the embodiment of the invention, the network protocol address corresponding to the domain name possibly needing to be accessed is analyzed in advance in an asynchronous mode, so that the query does not need to be initiated to the domain name system server again during subsequent access, and unnecessary delay generated by domain name analysis in a source returning process of a network application firewall is effectively reduced; and the back-to-source efficiency of the network application firewall is obviously improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method and device for a network application firewall server, an electronic device and a storage medium. Background Art

[0002] At present, most WAFs (Web Application Firewalls) on the market support two methods of IP (Internet Protocol) and domain name when configuring back-to-source. When the user selects domain name back-to-source, WAF will first call the DNS (Domain Name System) resolution service during the back-to-source process to query the target IP address corresponding to the target domain name, and then use the IP address for back-to-source operation. After receiving the DNS query request, the DNS recursive resolver will first check its own cache. If the IP address corresponding to the target domain name exists in the cache, the IP address is directly used for back-to-source; if it does not exist in the cache, a request is sent to the root domain name server to query the target IP address corresponding to the target domain name.

[0003] As network security threats continue to increase, the efficiency and accuracy of WAF back-to-source becomes particularly important. The DNS resolution method of related technologies may encounter performance bottlenecks and inaccuracy when facing short TTL (Time to Live) or frequently changing domain name resolution. In addition, when the DNS cache expires, it is usually necessary to re-query the DNS, which may cause delays and increase system load, especially when the TTL setting is short. In this case, the back-to-source efficiency of the WAF will be significantly reduced, which in turn limits the QPS (Queries Per Second) of the WAF. Summary of the invention

[0004] The embodiment of the present application provides a data processing method of a network application firewall server to solve or at least partially solve the above-mentioned problem.

[0005] Correspondingly, an embodiment of the present application also provides a data processing device of a network application firewall server, an electronic device and a storage medium to ensure the implementation and application of the above method.

[0006] In order to solve the above problems, an embodiment of the present application discloses a data processing method of a network application firewall server, wherein the network application firewall server is provided with a cache area and is connected to a client for communication, and the method comprises:

[0007] In the cache area, a network protocol address corresponding to the domain name accessing the network application firewall server is stored; the network protocol address includes corresponding server information;

[0008] Receiving a target request sent by the client, wherein the target request includes a target domain name;

[0009] Querying the target network protocol address corresponding to the target domain name from the cache area;

[0010] The target request is forwarded to the target server corresponding to the target network protocol address.

[0011] Optionally, the network application firewall is communicatively connected to a management platform, and the network protocol address corresponding to the domain name accessing the network application firewall server is stored in the cache area, including:

[0012] Receiving the domain name for accessing the network application firewall server sent by the management platform;

[0013] Loading the configuration file of the domain name accessing the network application firewall server;

[0014] According to the configuration file, query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain a query result;

[0015] The query result is stored in the cache area.

[0016] Optionally, the network protocol address has a corresponding validity period, and the method further includes:

[0017] When storing the network protocol address corresponding to the domain name accessing the network application firewall server, recording the validity time of the network protocol address;

[0018] According to the refresh time threshold and the current remaining effective time, determining whether it is necessary to update the network protocol address corresponding to the domain name accessing the network application firewall server;

[0019] If the currently remaining effective time reaches the refresh time threshold, re-query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain the refreshed network protocol address and the refreshed effective time;

[0020] The refreshed network protocol address and the refreshed valid time are stored in the cache area.

[0021] Optionally, the method further comprises:

[0022] If the target request including the target domain name is received when the network protocol address corresponding to the domain name accessing the network application firewall server is requeried, the current network protocol address corresponding to the target domain name is queried from the cache area;

[0023] The target request is forwarded to the current server corresponding to the current network protocol address.

[0024] Optionally, the method further comprises:

[0025] If forwarding the target request to the current server corresponding to the current network protocol address fails, waiting for the cache area to store the refreshed network protocol address;

[0026] Querying the refreshed network protocol address corresponding to the target domain name from the cache area;

[0027] The target request is forwarded to the server corresponding to the refreshed network protocol address.

[0028] Optionally, the method further comprises:

[0029] Obtaining the number of visits to the domain name accessing the network application firewall server;

[0030] According to the number of accesses, a refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set.

[0031] Optionally, the network application firewall includes a configuration synchronization component, the configuration synchronization component is communicatively connected to the management platform, and the method further includes:

[0032] Receiving configuration update items issued by the management platform through the configuration synchronization component;

[0033] The configuration update item is adopted to update the configuration corresponding to the configuration update item.

[0034] The embodiment of the present application also discloses a data processing device of a network application firewall server, wherein the network application firewall server is provided with a cache area and is in communication connection with a client, and the device comprises:

[0035] A pre-fetch module, used to store, in the cache area, a network protocol address corresponding to a domain name accessing the network application firewall server; the network protocol address includes corresponding server information;

[0036] A request receiving module, used for receiving a target request sent by the client, wherein the target request includes a target domain name;

[0037] A network protocol address acquisition module, used to query the target network protocol address corresponding to the target domain name from the cache area;

[0038] The request forwarding module is used to forward the target request to the target server corresponding to the target network protocol address.

[0039] An embodiment of the present application also discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the data processing method of the network application firewall server as described in one or more of the embodiments of the present application.

[0040] The embodiments of the present application also disclose one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes the data processing method of the network application firewall server as described in one or more of the embodiments of the present application.

[0041] Compared with the prior art, the embodiments of the present application have the following advantages:

[0042] In an embodiment of the present application, the network protocol address corresponding to the domain name of the access network application firewall server is stored in the cache area; the network protocol address includes the corresponding server information; the target request sent by the client is received, and the target request includes the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache area; and the target request is forwarded to the target server corresponding to the target network protocol address. The embodiment of the present application adopts the domain name system pre-fetching technology, and resolves the network protocol address corresponding to the domain name that may need to be accessed in advance in an asynchronous manner, and stores it in the cache area, so that there is no need to initiate a query to the domain name system server again during subsequent access, thereby effectively reducing the unnecessary delay caused by domain name resolution in the process of returning to the source of the network application firewall, and significantly improving the efficiency of returning to the source of the network application firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of a data processing method embodiment of a network application firewall server of the present application;

[0044] Figure 2 It is a server schematic diagram of an embodiment of a data processing method of a network application firewall server of the present application;

[0045] Figure 3 It is a flow chart of an embodiment of a data processing method of a network application firewall server of the present application;

[0046] Figure 4 It is a structural block diagram of an embodiment of a data processing device of a network application firewall server of the present application;

[0047] Figure 5 It is a schematic diagram of the structure of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] Reference Figure 1 , is a flowchart of a data processing method embodiment of a network application firewall server of the present application, comprising the following steps:

[0050] Step 101: In the cache area, a network protocol address corresponding to the domain name accessing the network application firewall server is stored; the network protocol address includes corresponding server information.

[0051] The network application firewall server of the embodiment of the present application is provided with a cache area for storing the network protocol address (ie, IP address) corresponding to the queried domain name and communicating with the client used by the user.

[0052] In one embodiment, the network application firewall server may be an OpenResty (Open RESTy, a Web platform based on Nginx and Lua) server. The OpenResty server supports domain name retrieval and / or IP retrieval when traversing the source.

[0053] Reference Figure 2 , is a server schematic diagram of an embodiment of a data processing method for a network application firewall server of the present application.

[0054] Figure 2 The hardware structure of the network application firewall server when it is an OpenResty server is briefly shown. The hardware of the OpenResty server may include a processor, a storage device, an input and output interface, a communication interface, and a bus.

[0055] Among them, the processor can adopt a general-purpose CPU (Central Processing Unit) to execute relevant programs. The storage device can be implemented in the form of RAM (Random Access Memory), SSD (Solid State Drive), HDD (Hard Disk Drive), etc. The input and output interfaces are used to connect the input / output modules to realize information input and output. The input / output module can be configured in the device as a component, or it can be externally connected to the device to provide corresponding functions. Among them, the input device can include a keyboard, a mouse, various sensors, etc., and the output device can include a display, a speaker, an indicator light, etc. The communication interface is used to connect the communication module to realize the communication interaction between this device and other devices. Among them, the communication module can realize communication through a wired method (such as USB (Universal Serial Bus), a network cable, etc.). The bus includes a channel to transmit information between various components of the device (such as a processor, a storage device, an input / output interface, and a communication interface).

[0056] It should be noted that although Figure 2 Only the processor, storage device, input / output interface, communication interface and bus are shown, but in the specific implementation process, the OpenResty server may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above-mentioned OpenResty server may also include only the components necessary for implementing the solution of the embodiment of the present application, and does not necessarily include all the components.

[0057] In step 101, the network protocol addresses corresponding to the domain names of the access network application firewall servers are queried respectively, so that the network protocol addresses corresponding to the domain names of the access network application firewall servers are stored in the cache area, and the network protocol addresses include the server information corresponding to the network protocol addresses.

[0058] It should be noted that the network protocol address corresponding to the domain name of the cache access network application firewall server in step 101 is asynchronous with the network application firewall server request forwarding in subsequent steps, so the DNS query in step 101 will not block the request forwarding of the network application firewall server.

[0059] Step 102: Receive a target request sent by the client, wherein the target request includes a target domain name.

[0060] The network application firewall server receives the target request including the target domain name sent by the client. The network application firewall server needs to return the target domain name to the source, that is, forward the target request to the server corresponding to the network protocol address corresponding to the target domain name.

[0061] Step 103: Query the target network protocol address corresponding to the target domain name from the cache area.

[0062] After caching the network protocol address corresponding to the domain name of the access network application firewall server, when returning the domain name to the source, there is no need to perform a DNS query again. You only need to query the target network protocol address corresponding to the target domain name from the cache area to obtain the target network protocol address corresponding to the target domain name, thus reducing the waiting time for DNS query.

[0063] Step 104: forward the target request to a target server corresponding to the target network protocol address.

[0064] After obtaining the target network protocol address corresponding to the target domain name, the domain name can be returned to the source, and the target request can be forwarded to the target server corresponding to the target network protocol address.

[0065] In an embodiment of the present application, the network protocol address corresponding to the domain name of the access network application firewall server is stored in the cache area; the network protocol address includes the corresponding server information; the target request sent by the client is received, and the target request includes the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache area; and the target request is forwarded to the target server corresponding to the target network protocol address. The embodiment of the present application adopts the domain name system pre-fetching technology, and resolves the network protocol address corresponding to the domain name that may need to be accessed in advance in an asynchronous manner, and stores it in the cache area, so that there is no need to initiate a query to the domain name system server again during subsequent access, thereby effectively reducing the unnecessary delay caused by domain name resolution in the process of returning to the source of the network application firewall, and significantly improving the efficiency of returning to the source of the network application firewall.

[0066] Optionally, the network application firewall is communicatively connected to a management platform, and step 101 includes:

[0067] Receiving the domain name for accessing the network application firewall server sent by the management platform;

[0068] Loading the configuration file of the domain name accessing the network application firewall server;

[0069] According to the configuration file, query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain a query result;

[0070] The query result is stored in the cache area.

[0071] In this embodiment, the network protocol address corresponding to the domain name of the network application firewall server is pre-queried and cached, and the domain name of the network application firewall server sent by the management platform needs to be received first. The user can add the domain name to be protected on the management platform system, and the management platform can use the domain name to be protected as the domain name that needs to access the network application firewall server and send it to the network application firewall server.

[0072] The network application firewall server loads the configuration file of the domain name connected to the network application firewall server at startup. In one embodiment, when the network application firewall server starts, the DNS prefetch module is asynchronously initialized in the Lua (a scripting language) code using the ngx.timer.at function (a Lua API function provided by OpenResty for creating an asynchronous timer), thereby loading the configuration file of the connected domain name.

[0073] According to the configuration file, for each domain name accessing the network application firewall server, the corresponding network protocol address is queried to obtain the query result, so that the query result can be stored in the cache area. In one embodiment, a DNS pre-fetch module can be used to pre-query and cache the network protocol address corresponding to the domain name accessing the network application firewall server.

[0074] In one embodiment, the query result may include a network protocol address corresponding to a domain name for accessing a network application firewall server, and a valid time corresponding to the network protocol address.

[0075] The embodiment of the present application adopts domain name system pre-fetching technology, which resolves the network protocol address corresponding to the domain name that may need to be accessed in advance in an asynchronous manner, and stores it in a cache area, so that there is no need to initiate a query to the domain name system server again during subsequent access, thereby effectively reducing unnecessary delays caused by domain name resolution during the back-to-source process of the network application firewall.

[0076] If the DNS system is attacked and goes offline, since the embodiment of the present application has already parsed the network protocol address corresponding to the domain name that may need to be accessed in advance, the target network protocol address corresponding to the target domain name can still be obtained from the cache area when the DNS system is attacked and goes offline, thereby tracing the domain name back to the source.

[0077] Optionally, the network protocol address has a corresponding validity period, and the method further includes:

[0078] When storing the network protocol address corresponding to the domain name accessing the network application firewall server, recording the validity time of the network protocol address;

[0079] According to the refresh time threshold and the current remaining effective time, determining whether it is necessary to update the network protocol address corresponding to the domain name accessing the network application firewall server;

[0080] If the currently remaining effective time reaches the refresh time threshold, re-query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain the refreshed network protocol address and the refreshed effective time;

[0081] The refreshed network protocol address and the refreshed valid time are stored in the cache area.

[0082] In this embodiment, the cached network protocol address can be updated regularly according to the validity period corresponding to the network protocol address, so that there is no need to wait for re-querying the network protocol address corresponding to the domain name when the domain name is returned to the source next time.

[0083] Specifically, when storing the network protocol address corresponding to the domain name of the access network application firewall server, the validity time of the network protocol address, that is, the TTL value, is recorded. And according to the refresh time threshold and the current remaining validity time, it is determined whether the network protocol address corresponding to the domain name of the access network application firewall server needs to be updated. If the current remaining validity time reaches the refresh time threshold, it is necessary to re-query the network protocol address corresponding to the domain name of the access network application firewall server, obtain the refreshed network protocol address and the refreshed validity time, and store the refreshed network protocol address and the refreshed validity time in the cache area.

[0084] For example, if the TTL value of a network protocol address is 600 seconds, the refresh time threshold can be set to 590 seconds. When the network protocol address has been cached for 590 seconds, that is, there are 10 seconds before the network protocol address expires, you need to update the network protocol address corresponding to the domain name of the access network application firewall server, and re-execute the steps of querying and caching the network protocol address corresponding to the domain name of the access network application firewall server. The TTL value of the updated network protocol address is reset to 600 seconds.

[0085] The embodiment of the present application actively updates the network protocol address and its validity period before the validity period of the network protocol address is about to expire, so that even in the face of short TTL and frequently changing domain name resolution, it can maintain a high stability and response speed.

[0086] Optionally, the method further comprises:

[0087] If the target request including the target domain name is received when the network protocol address corresponding to the domain name accessing the network application firewall server is requeried, the current network protocol address corresponding to the target domain name is queried from the cache area;

[0088] The target request is forwarded to the current server corresponding to the current network protocol address.

[0089] In an embodiment of the present application, if during the update of the network protocol address corresponding to the domain name accessing the network application firewall server, that is, when re-querying the network protocol address corresponding to the domain name accessing the network application firewall server, a target request including the target domain name is received and the domain name needs to be returned to the source, the network protocol address before the update is first used for return to the source.

[0090] Specifically, the current network protocol address corresponding to the target domain name can be queried from the cache area, and the target request can be forwarded to the current server corresponding to the current network protocol address.

[0091] During the updating of the network protocol address corresponding to the domain name accessing the network application firewall server, the embodiment of the present application can still use the network protocol address before the update for tracing back to the source, which significantly improves the tracing back to the source efficiency of the network application firewall.

[0092] Optionally, the method further comprises:

[0093] If forwarding the target request to the current server corresponding to the current network protocol address fails, waiting for the cache area to store the refreshed network protocol address;

[0094] Querying the refreshed network protocol address corresponding to the target domain name from the cache area;

[0095] The target request is forwarded to the server corresponding to the refreshed network protocol address.

[0096] In this embodiment, if during the update of the network protocol address corresponding to the domain name of the access network application firewall server, the network protocol address before the update is used for return to the source, but the target request fails to be forwarded to the current server corresponding to the current network protocol address, it is necessary to wait for the query to be refreshed.

[0097] Specifically, if forwarding the target request to the current server corresponding to the current network protocol address fails, it is necessary to wait for the query of the refreshed network protocol address and the cache area to store the refreshed network protocol address, and then query the refreshed network protocol address corresponding to the target domain name from the cache area, and forward the target request to the server corresponding to the refreshed network protocol address.

[0098] When the forwarding of the target request to the current server corresponding to the current network protocol address fails, the embodiment of the present application can wait for the cache area to store the refreshed network protocol address before returning to the source, thereby improving the stability of the network application firewall returning to the source.

[0099] Optionally, the method further comprises:

[0100] Obtaining the number of visits to the domain name accessing the network application firewall server;

[0101] According to the number of accesses, a refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set.

[0102] In this embodiment, the refresh time threshold of the corresponding network protocol address can be set according to the number of accesses to the domain name of the network application firewall server.

[0103] In one embodiment, the refresh time threshold of the network protocol address corresponding to the domain name with a large number of accesses can be set to be shorter, and the refresh time threshold of the network protocol address corresponding to the domain name with a small number of accesses can be set to be longer, or even set to not be updated. The number of accesses to the domain name accessing the network application firewall server can also be obtained regularly, and the refresh time threshold can be set according to the new number of accesses, for example, the refresh time threshold of the network protocol address corresponding to the domain name with a small number of accesses before but an increase in the number of accesses now can be set to be shorter.

[0104] In one example, the TTL values ​​of domain name A and domain name B are both 600 seconds. However, domain name A has a large number of visits per unit time, so the refresh time threshold can be set to 300 seconds; domain name B has a small number of visits per unit time, so the refresh time threshold can be set to 590 seconds. If, after obtaining the number of visits per unit time at a regular interval, it is found that the number of visits per unit time of domain name B has increased, the refresh time threshold of domain name B can be reset to 400 seconds based on the number of visits. The above specific settings for the refresh time threshold are only for example, and those skilled in the art can set them according to actual conditions.

[0105] In the embodiment of the present application, each domain name has a corresponding refresh time threshold. According to the number of accesses, the refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set, thereby greatly reducing the query pressure of the network application firewall server and will not reduce the performance of the network application firewall server as the number of access domain names increases.

[0106] Reference Figure 3 , is a flow chart of an embodiment of a data processing method of a network application firewall server of the present application.

[0107] Figure 3 A specific flow chart of a data processing method of a network application firewall server using an embodiment of the present application is shown, including the following steps:

[0108] Step 301: Start the WAF system.

[0109] Step 302: Initialize the DNS pre-fetch module.

[0110] Step 303: Load the configuration file of the connected domain name.

[0111] Step 304: The DNS pre-fetch module performs a DNS query.

[0112] Step 305: Store the queried IP address into the local cache.

[0113] Step 306: Refresh the DNS query regularly according to the TTL value.

[0114] Step 307: Check whether there is a return request.

[0115] Step 308: If there is a request to return to the source, check whether the old IP address can be used for return to the source.

[0116] Step 309: If the old IP address can be used for tracing back to the source, the old IP address is used for tracing back to the source; if the old IP address cannot be used for tracing back to the source, wait for the new DNS query result, and then use the new IP address for tracing back to the source.

[0117] Optionally, the network application firewall includes a configuration synchronization component, the configuration synchronization component is communicatively connected to the management platform, and the method further includes:

[0118] Receiving configuration update items issued by the management platform through the configuration synchronization component;

[0119] The configuration update item is adopted to update the configuration corresponding to the configuration update item.

[0120] In this embodiment, the network application firewall may also include a configuration synchronization component and a management platform system. In one example, if the network application firewall server is an OpenResty server, when the user modifies configuration items such as WAF protection configuration and back-to-source configuration, the management platform system may send the latest configuration items on the web page to the configuration synchronization component, and the configuration synchronization component calls the OpenResty API interface to synchronize the latest configuration to the OpenResty server when the configuration changes.

[0121] In one embodiment, the configuration synchronization component may be a configuration synchronization component for an Agent.

[0122] Specifically, the network application firewall can receive the configuration update item issued by the management platform through the configuration synchronization component, and adopt the configuration update item to update the configuration corresponding to the configuration update item.

[0123] The embodiment of the present application can update the configuration of the network application firewall by configuring the synchronization component and the management platform.

[0124] In an embodiment of the present application, the network protocol address corresponding to the domain name of the access network application firewall server is stored in the cache area; the network protocol address includes the corresponding server information; the target request sent by the client is received, and the target request includes the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache area; and the target request is forwarded to the target server corresponding to the target network protocol address. The embodiment of the present application adopts the domain name system pre-fetching technology, and resolves the network protocol address corresponding to the domain name that may need to be accessed in advance in an asynchronous manner, and stores it in the cache area, so that there is no need to initiate a query to the domain name system server again during subsequent access, thereby effectively reducing the unnecessary delay caused by domain name resolution in the process of returning to the source of the network application firewall, and significantly improving the efficiency of returning to the source of the network application firewall.

[0125] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0126] On the basis of the above embodiments, this embodiment further provides a data processing device for a network application firewall server, which is applied to electronic devices such as terminal devices and servers.

[0127] Reference Figure 4 , shows a structural block diagram of an embodiment of a data processing device of a network application firewall server of the present application, which may specifically include the following modules:

[0128] The pre-fetch module 401 is used to store the network protocol address corresponding to the domain name accessing the network application firewall server in the cache area; the network protocol address includes the corresponding server information;

[0129] The request receiving module 402 is used to receive a target request sent by the client, wherein the target request includes a target domain name;

[0130] A network protocol address acquisition module 403 is used to query the target network protocol address corresponding to the target domain name from the cache area;

[0131] The request forwarding module 404 is used to forward the target request to the target server corresponding to the target network protocol address.

[0132] Optionally, the network application firewall is communicatively connected to a management platform, and the pre-fetching module 401 includes:

[0133] A domain name receiving submodule, used to receive the domain name for accessing the network application firewall server sent by the management platform;

[0134] A configuration loading submodule, used to load the configuration file of the domain name accessing the network application firewall server;

[0135] A network protocol address query submodule, used to query the network protocol address corresponding to the domain name accessing the network application firewall server according to the configuration file, and obtain a query result;

[0136] The network protocol address cache submodule is used to store the query result in the cache area.

[0137] Optionally, the network protocol address has a corresponding validity period, and the device further includes:

[0138] An effective time recording module, used to record the effective time of the network protocol address when storing the network protocol address corresponding to the domain name accessing the network application firewall server;

[0139] A refresh judgment module, used to judge whether it is necessary to update the network protocol address corresponding to the domain name accessing the network application firewall server according to the refresh time threshold and the current remaining effective time;

[0140] A network protocol address refresh module, configured to re-query the network protocol address corresponding to the domain name accessing the network application firewall server if the currently remaining effective time reaches the refresh time threshold, and obtain a refreshed network protocol address and a refreshed effective time;

[0141] The refresh cache module is used to store the refreshed network protocol address and the refreshed valid time in the cache area.

[0142] Optionally, the device further comprises:

[0143] A first query module, configured to query a current network protocol address corresponding to the target domain name from the cache area if the target request including the target domain name is received when the network protocol address corresponding to the domain name accessing the network application firewall server is requeried;

[0144] The first forwarding module is used to forward the target request to the current server corresponding to the current network protocol address.

[0145] Optionally, the device further comprises:

[0146] A refresh waiting module, configured to wait for the cache area to store the refreshed network protocol address if forwarding the target request to the current server corresponding to the current network protocol address fails;

[0147] A second query module, used to query the refreshed network protocol address corresponding to the target domain name from the cache area;

[0148] The second forwarding module is used to forward the target request to the server corresponding to the refreshed network protocol address.

[0149] Optionally, the device further comprises:

[0150] An access count acquisition module, used to acquire the access count of the domain name accessing the network application firewall server;

[0151] The refresh time threshold setting module is used to set the refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server according to the number of accesses.

[0152] Optionally, the network application firewall includes a configuration synchronization component, the configuration synchronization component is communicatively connected to the management platform, and the device further includes:

[0153] A configuration update item receiving module, used to receive the configuration update items issued by the management platform through the configuration synchronization component;

[0154] The configuration update module is used to adopt the configuration update item to update the configuration corresponding to the configuration update item.

[0155] In an embodiment of the present application, the network protocol address corresponding to the domain name of the access network application firewall server is stored in the cache area; the network protocol address includes the corresponding server information; the target request sent by the client is received, and the target request includes the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache area; and the target request is forwarded to the target server corresponding to the target network protocol address. The embodiment of the present application adopts the domain name system pre-fetching technology, and resolves the network protocol address corresponding to the domain name that may need to be accessed in advance in an asynchronous manner, and stores it in the cache area, so that there is no need to initiate a query to the domain name system server again during subsequent access, thereby effectively reducing the unnecessary delay caused by domain name resolution in the process of returning to the source of the network application firewall, and significantly improving the efficiency of returning to the source of the network application firewall.

[0156] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0157] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0158] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as terminal devices and servers (clusters). Figure 5 An exemplary apparatus 500 that can be used to implement various embodiments described in this application is schematically shown.

[0159] For one embodiment, Figure 5 An exemplary apparatus 500 is shown having one or more processors 502, a control module (chip set) 504 coupled to at least one of the processor(s) 502, a memory 506 coupled to the control module 504, a non-volatile memory (NVM) / storage device 508 coupled to the control module 504, one or more input / output devices 510 coupled to the control module 504, and a network interface 512 coupled to the control module 504.

[0160] The processor 502 may include one or more single-core or multi-core processors, and the processor 502 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 500 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0161] In some embodiments, the apparatus 500 may include one or more computer-readable media (e.g., memory 506 or NVM / storage device 508) having instructions 514 and one or more processors 502 configured in conjunction with the one or more computer-readable media to execute the instructions 514 to implement a module to perform the actions described in the present disclosure.

[0162] For one embodiment, control module 504 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 502 and / or any suitable device or component in communication with control module 504 .

[0163] The control module 504 may include a memory controller module to provide an interface to the memory 506. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0164] The memory 506 may be used, for example, to load and store data and / or instructions 514 for the device 500. For one embodiment, the memory 506 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 506 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0165] For one embodiment, control module 504 may include one or more input / output controllers to provide an interface to NVM / storage device 508 and input / output device(s) 510 .

[0166] For example, NVM / storage 508 may be used to store data and / or instructions 514. NVM / storage 508 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0167] NVM / storage device 508 may include storage resources that are physically part of the device on which apparatus 500 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 508 may be accessed via input / output device(s) 510 over a network.

[0168] (One or more) input / output devices 510 may provide an interface for the apparatus 500 to communicate with any other appropriate device, and the input / output device 510 may include a communication component, an audio component, a sensor component, etc. The network interface 512 may provide an interface for the apparatus 500 to communicate through one or more networks, and the apparatus 500 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0169] For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 504. For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers of the control module 504 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504. For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504 to form a system-on-chip (SoC).

[0170] In various embodiments, the apparatus 500 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the apparatus 500 may have more or fewer components and / or a different architecture. For example, in some embodiments, the apparatus 500 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0171] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0172] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0173] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0174] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other data processing terminal device of a programmable network application firewall server to generate a machine, so that the instructions executed by the processor of the computer or other data processing terminal device of the programmable network application firewall server generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0175] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other data processing terminal device of a programmable network application firewall server to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0176] These computer program instructions can also be loaded onto a computer or other data processing terminal device of a programmable network application firewall server, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable terminal device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0177] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0178] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0179] The data processing method and device of a network application firewall server, an electronic device and a storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data processing method for a network application firewall server, characterized in that: The network application firewall server is provided with a cache area and is connected to the client for communication. The method includes: In the cache area, a network protocol address corresponding to the domain name accessing the network application firewall server is stored; the network protocol address includes corresponding server information; Receiving a target request sent by the client, wherein the target request includes a target domain name; Querying the target network protocol address corresponding to the target domain name from the cache area; The target request is forwarded to the target server corresponding to the target network protocol address.

2. The method according to claim 1, characterized in that The network application firewall is in communication connection with the management platform, and the network protocol address corresponding to the domain name accessing the network application firewall server is stored in the cache area, including: Receiving the domain name for accessing the network application firewall server sent by the management platform; Loading the configuration file of the domain name accessing the network application firewall server; According to the configuration file, query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain a query result; The query result is stored in the cache area.

3. The method according to claim 1, characterized in that: The network protocol address has a corresponding valid time, and the method further includes: When storing the network protocol address corresponding to the domain name accessing the network application firewall server, recording the validity time of the network protocol address; According to the refresh time threshold and the current remaining effective time, determining whether it is necessary to update the network protocol address corresponding to the domain name accessing the network application firewall server; If the currently remaining effective time reaches the refresh time threshold, re-query the network protocol address corresponding to the domain name accessing the network application firewall server to obtain the refreshed network protocol address and the refreshed effective time; The refreshed network protocol address and the refreshed valid time are stored in the cache area.

4. The method according to claim 3, characterized in that The method further comprises: If the target request including the target domain name is received when the network protocol address corresponding to the domain name accessing the network application firewall server is requeried, the current network protocol address corresponding to the target domain name is queried from the cache area; The target request is forwarded to the current server corresponding to the current network protocol address.

5. The method according to claim 4, characterized in that The method further comprises: If forwarding the target request to the current server corresponding to the current network protocol address fails, waiting for the cache area to store the refreshed network protocol address; Querying the refreshed network protocol address corresponding to the target domain name from the cache area; The target request is forwarded to the server corresponding to the refreshed network protocol address.

6. The method according to claim 3, characterized in that The method further comprises: Obtaining the number of visits to the domain name accessing the network application firewall server; According to the number of accesses, a refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set.

7. The method according to claim 1, characterized in that The network application firewall includes a configuration synchronization component, the configuration synchronization component is in communication connection with the management platform, and the method further includes: Receiving configuration update items issued by the management platform through the configuration synchronization component; The configuration update item is adopted to update the configuration corresponding to the configuration update item.

8. A data processing device for a network application firewall server, characterized in that: The network application firewall server is provided with a cache area and is connected to the client for communication. The device comprises: A pre-fetch module, used to store, in the cache area, a network protocol address corresponding to a domain name accessing the network application firewall server; the network protocol address includes corresponding server information; A request receiving module, used for receiving a target request sent by the client, wherein the target request includes a target domain name; A network protocol address acquisition module, used to query the target network protocol address corresponding to the target domain name from the cache area; The request forwarding module is used to forward the target request to the target server corresponding to the target network protocol address.

9. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, enables the processor to execute the data processing method of the network application firewall server as described in one or more of claims 1-7.

10. One or more machine-readable media having executable codes stored thereon, which, when executed, enable a processor to execute the data processing method of a network application firewall server as described in one or more of claims 1-7.

Images