Message processing method and device, equipment and medium

Abstract

The invention relates to the technical field of firewalls, and discloses a message processing method, device, equipment and medium, and the method comprises the steps: obtaining a first message of a data stream, and when a specific access control strategy exists in an access control strategy set corresponding to the flow direction type of the data stream, applying the first message, determining an application identification result and an application identification state corresponding to the first message, recording the application identification result and the application identification state to a first session associated with the data stream, and performing access control processing on the first message; when a subsequent message of the target data stream is received, performing application identification on the currently received subsequent message based on the application identification state recorded in the current first session, and updating the first session; and processing the currently received subsequent message based on the updated application identification result and application identification state in the first session, thereby avoiding repeated identification of the message and reducing performance loss of the firewall caused by application identification through fine control of internal processing of the firewall.

Description

Technical Field

[0001] The present invention relates to the technical field of firewalls, and in particular to a message processing method, device, equipment and medium. Background Art

[0002] Traditional firewalls have the ability to identify applications. Application identification is a mechanism that classifies traffic according to the application / protocol characteristics in the traffic. Application identification technology accurately identifies various applications in the traffic, thereby finely controlling the traffic. However, since application identification requires deep inspection of messages, it is bound to reduce the performance of the firewall.

[0003] Traditional firewalls are usually deployed at the network exit to protect incoming and outgoing traffic. A global switch is set on it to control the opening and closing of the application identification function. When it is turned on, application identification will be performed on all traffic passing through the firewall, which will cause the firewall performance to drop sharply. Summary of the invention

[0004] In view of this, the present invention provides a message processing method, apparatus, device and medium to solve the problem of firewall performance degradation due to application identification.

[0005] In a first aspect, the present invention provides a message processing method, the method comprising:

[0006] Obtaining a first message of a target data flow, and determining a flow direction type of the target data flow;

[0007] When there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type, the first message is processed by the application identification module of the firewall to determine the application identification result and application identification status corresponding to the first message;

[0008] Recording the application identification result and application identification state corresponding to the first message to a first session associated with the target data flow, and performing access control processing on the first message according to the access control policy set corresponding to the flow direction type;

[0009] When a subsequent message of the target data flow is received, based on the application identification state recorded in the current first session, the application identification module of the firewall is used to process the currently received subsequent message and update the first session;

[0010] The currently received subsequent message is processed based on the updated application identification result and application identification state in the first session.

[0011] The method provided in this aspect, after obtaining the first message of a data stream, when there is application type configuration information in the access control policy under the flow direction type corresponding to the data stream, performs application identification on the first message, records it in the session associated with the data stream and executes corresponding access control processing; when receiving subsequent messages, performs application identification in combination with the application identification status of the message previously received in the session, and updates the first session, which can effectively reduce the number of times the firewall performs deep application identification on the data stream message, thereby reducing the loss of application identification to the firewall performance.

[0012] In an optional embodiment, the method further includes:

[0013] When there is no access control policy containing application type configuration information in the access control policy set corresponding to the flow type, access control processing is performed on the first message directly according to the access control policy set corresponding to the flow type, and access control processing is no longer performed on subsequent messages of the target data flow.

[0014] This implementation mode no longer performs application identification on messages when the access control policy under the flow direction type corresponding to the data flow does not contain application type configuration information, so that users can set whether to perform application identification more finely for messages of different flow direction types, reduce the frequency of application identification, and improve firewall performance.

[0015] In an optional implementation, based on the application identification state recorded in the current first session, using the application identification module of the firewall to process the currently received subsequent message and update the first session includes:

[0016] Determine whether a first application identification state in the current first session is a final state, the first application identification state being the application identification state most recently entered in the current first session;

[0017] If yes, determining the first application identification state and the first identification result corresponding thereto as the application identification state and the application identification result corresponding to the currently received subsequent message, and recording them in the first session;

[0018] If not, the application identification module of the firewall is used to identify the currently received subsequent message, obtain the application identification result and application identification status corresponding to the currently received subsequent message, and record them in the first session.

[0019] This implementation method avoids firewall performance loss caused by deep message identification through the application identification module by directly using the most recently recorded application identification result and application identification status as the identification result and identification status corresponding to the subsequent message received this time when the most recently recorded application identification status is already the final status.

[0020] In an optional implementation, the processing of the currently received subsequent message based on the updated application identification result and application identification state in the first session includes:

[0021] Determining whether the application identification state most recently entered in the updated first session is a final state and the corresponding application identification result has changed;

[0022] If yes, then perform access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow type;

[0023] If not, skip the access control processing for the subsequent message currently received.

[0024] In this implementation, when the most recently entered application identification state is the final state and the application identification has not changed, it indicates that the firewall has fully identified the application identification type of the data flow. For subsequent messages except the first message, access control processing is performed on the messages only in this case, thereby ensuring the efficiency of the firewall's access control processing on the messages.

[0025] In an optional implementation, if the application identification state most recently entered in the current first session is not the final state, before using the application identification module of the firewall to identify the currently received subsequent message, the method further includes:

[0026] Obtaining a historical number of times the application identification module performs application identification on the message of the target data flow;

[0027] If the historical number of times is greater than a preset threshold, the step of using the application identification module of the firewall to identify the subsequent message currently received is skipped, the application identification state corresponding to the subsequent message currently received is determined as the final state, and the first identification result corresponding to the first identification state in the first session is determined as the application identification result corresponding to the subsequent message currently received.

[0028] In this embodiment, by setting a preset threshold for the application identification module, when the application identification module faces some data flows that cannot obtain accurate identification results through multiple message identifications using its own rules, the application identification module directly uses the last identification result as the identification result in the final state, thereby avoiding repeated invalid identification by the application identification module and ensuring firewall performance.

[0029] In an optional implementation manner, the flow direction type of the target data flow is determined as follows:

[0030] Obtain the destination IP address and source IP address of the first message and the user IP address corresponding to the firewall;

[0031] If the user IP address and the destination IP address are the same, determining that the flow direction type of the data flow is an inbound type;

[0032] If the user IP address and the source IP address are the same, it is determined that the flow type of the data flow is an outbound type.

[0033] In this implementation, by comparing the source IP address and destination IP address of the first message and the IP address corresponding to the user protected by the firewall, the flow direction type of the data flow corresponding to the first message can be determined quickly and efficiently.

[0034] In an optional embodiment, the flow direction type includes an inlet type and an outlet type;

[0035] The performing access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow direction type includes:

[0036] If the flow type is an inbound type, performing user authentication and authorization, protocol and port restriction, and content filtering on the currently received subsequent message based on the first access control policy set corresponding to the inbound type;

[0037] If the flow type is an outbound type, data leakage prevention, application program restriction, and flow control are performed on the currently received subsequent messages based on the second access control policy set corresponding to the outbound type.

[0038] In this implementation, when the flow type is an inbound type or an outbound type, access control policies of different angles are respectively executed, so that targeted access control processing of the message can be achieved.

[0039] In a second aspect, the present invention provides a message processing device, applied to a firewall, the device comprising:

[0040] A flow direction determination module, used to obtain the first message of the target data flow and determine the flow direction type of the target data flow;

[0041] A first packet identification module, used to process the first message using the application identification module of the firewall to determine the application identification result and application identification status corresponding to the first message when there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type;

[0042] A first packet processing module, used to record the application identification result and application identification status corresponding to the first message to the first session associated with the target data flow, and perform access control processing on the first message according to the access control policy set corresponding to the flow type;

[0043] A subsequent packet identification module, configured to, when receiving a subsequent message of the target data flow, process the currently received subsequent message using the application identification module of the firewall based on the application identification state recorded in the current first session, and update the first session;

[0044] The subsequent packet processing module is used to process the currently received subsequent message based on the updated application identification result and application identification state in the first session.

[0045] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the message processing method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the message processing method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 is a flow chart of a message processing method according to an embodiment of the present invention;

[0049] Figure 2 is a flow chart of another message processing method according to an embodiment of the present invention;

[0050] Figure 3is an example diagram of a processing flow for the first message of a data stream according to an embodiment of the present invention;

[0051] Figure 4 is an example diagram of a processing flow for subsequent messages of a data stream according to an embodiment of the present invention;

[0052] Figure 5 is an example diagram of an application identification process flow according to an embodiment of the present invention;

[0053] Figure 6 is a structural block diagram of a message processing device according to an embodiment of the present invention;

[0054] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0056] Traditional firewalls have the ability to identify applications. Application identification is a mechanism that classifies traffic according to the application / protocol characteristics in the traffic. Application identification technology accurately identifies various applications in the traffic, thereby finely controlling the traffic. However, since application identification requires deep inspection of messages, it is bound to reduce the performance of the firewall.

[0057] Traditional firewalls are usually deployed at the network exit to protect incoming and outgoing traffic. A global switch is set on it to control the opening and closing of the application identification function. When it is turned on, application identification will be performed on all traffic passing through the firewall, which will cause the firewall performance to drop sharply.

[0058] To this end, an embodiment of the present invention provides a message processing method. After obtaining the first message of a data flow, when there is application type configuration information in the access control policy under the flow direction type corresponding to the data flow, the first message is subjected to application identification, and is recorded in the session associated with the data flow and the corresponding access control processing is executed. When subsequent messages are received, application identification is performed in combination with the application identification status corresponding to the message previously received in the session, and the first session is updated. This can effectively reduce the number of times the firewall performs deep application identification on the data flow message, thereby reducing the loss of application identification to the firewall performance.

[0059] According to an embodiment of the present invention, a message processing method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] In this embodiment, a message processing method is provided, which is applied to a firewall. Figure 1 is a flow chart of a message processing method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0061] Step S101, obtaining the first message of the target data flow, and determining the flow direction type of the target data flow.

[0062] When the firewall is turned on, when data passes through the firewall, the messages in the data flow will be sent to the firewall for processing in sequence. The firewall needs to process the received messages in real time. For the data flow corresponding to the data transmission, that is, the target data flow, when the first message is sent to the firewall, the firewall can determine the flow type of the corresponding data flow, that is, the target data flow, based on the first message, for example, the outbound type or the inbound type.

[0063] Specifically, the source IP address and destination IP address of the first message can be compared with the IP address of the user corresponding to the firewall to determine the flow type of the data flow corresponding to the first message. For example, the flow type can also be further determined in combination with the port number, or the flow type can be determined in combination with the protocol type and application scenario. The specific flow type determination method can be set according to the actual situation.

[0064] Exemplarily, after determining the flow direction of the data flow corresponding to the first message, the firewall can record the flow direction type of the data flow, ie, the target data flow, so that when receiving subsequent messages, it can be directly called to perform corresponding processing.

[0065] Step S102, when there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type, the application identification module of the firewall is used to process the first message to determine the application identification result and application identification status corresponding to the first message.

[0066] After receiving the first message and determining the flow type of the corresponding data flow, the firewall needs to process the message according to the specific access control policy. Therefore, before processing the message, it is necessary to determine whether there is an access control policy containing application type configuration information in the access control policy set for the flow type inside the firewall. For the configuration of access control policies, application type configuration information can be set only for some of the access control policies under the inbound type, or only for some of the access control policies under the outbound type. Through the refined configuration of access control policies, application identification can be achieved only for messages under a certain flow type.

[0067] Taking the inbound type as an example, assume that the access control policy set for this flow type in the firewall includes multiple access control policies, such as: Policy 1, Policy 2, Policy 3, Policy 4, where Policy 1 and Policy 2 involve configuration information about the application type.

[0068] In this case, it is necessary to identify the application type corresponding to the target data flow. Therefore, it is necessary to use the application identification module inside the firewall to perform in-depth application type identification on the first message, such as deep packet inspection mechanism, to determine the application identification result and application identification status corresponding to the first message.

[0069] Furthermore, whether there is an access control policy containing application type configuration information in the access control policy set under the flow direction type corresponding to the target data flow can be recorded in the session associated with the data flow, so that when subsequent messages of the data flow corresponding to the first message are processed, it can be directly determined whether application type identification is required. If this information is not recorded, when subsequent messages are received for corresponding processing, it is necessary to determine again whether there is an access control policy containing application configuration information in the access control policy set corresponding to the flow direction type. For messages of the same data flow, since the flow direction types are the same, the judgment results must be the same. Therefore, when subsequent messages are received, it can be directly determined whether there is an access control policy containing application configuration information in the corresponding access control policy set based on the judgment result of the corresponding first message.

[0070] The application identification result and application identification status corresponding to the first message mentioned above can be understood as the identification result of the application type information of the data flow given by the application identification module based on the first message and the identification status corresponding to the identification result. The identification status refers to whether the identification result is the final state.

[0071] For example, based on the first message, the application identification module believes that the target data flow belongs to application type A, but the target data flow may be a more detailed application type under application type A. Since the information of the first message may not be able to fully characterize the data flow, the application identification module cannot determine the specific detailed application type based on the information of the first message. Therefore, the identification status corresponding to the identification result will be given as a non-final state.

[0072] Step S103: Record the application identification result and application identification state corresponding to the first message into the first session associated with the target data flow, and perform access control processing on the first message according to the access control policy set corresponding to the flow type.

[0073] After obtaining the application identification result and application identification status corresponding to the above-mentioned first message, it will be recorded in the session associated with the target data flow in the firewall, that is, the first session, so that when the firewall receives subsequent messages of the target data flow, it can process the subsequent messages accordingly according to the specific application identification information recorded in the first session. After completing the application identification of the first message, the first message can be subjected to specific access control processing according to the access control policy under the flow type corresponding to the target data flow. The specific access control processing process will not be repeated here.

[0074] Step S104: when a subsequent message of the target data flow is received, based on the application identification state recorded in the current first session, the application identification module of the firewall is used to process the currently received subsequent message and update the first session.

[0075] When a subsequent message of the target data stream is received, the subsequent message refers to the message after the first message, such as the second message, the third message, etc. in the data stream. When a subsequent message is received, since it has been determined that the access control policy under the flow type contains the application type configuration information when the first message is received, for the subsequent message, since it has the same flow type as the first message, the access control policy corresponding to the flow type must also contain the access control policy containing the application type configuration information, and therefore corresponding application identification is also required.

[0076] When performing application identification, the information recorded in the first session can be combined to assist in identifying the message received this time, that is, the application identification result and application identification status of the subsequent message currently received mentioned above, so as to minimize the number of times the application identification module performs deep identification.

[0077] For example, when the application identification state most recently entered in the first session is the final state, it means that the application identification result during the last message identification is already the final result that can be identified for the target data stream. Therefore, the application identification result and application identification state corresponding to the previous message can be directly used as the application identification result and application identification state of the message received this time, and written into the first session, that is, the first session is updated, so that the next message can also be processed accordingly according to the information in the first session at the corresponding moment.

[0078] Similarly, in the above example, if the application identification status most recently entered in the first session is not the final status, it means that it is still necessary to use the first identification module to perform application identification on the message received this time, that is, the subsequent message currently received, and write the specific identification result and identification status into the first session, so that when facing the newly received message later, the application identification can be combined with the information in the first session.

[0079] Step S105: Process the currently received subsequent message based on the updated application identification result and application identification state in the first session.

[0080] After completing the application identification of the message received this time, that is, after performing application identification on the subsequent messages currently received, for the subsequent messages, when performing access control processing on them, the decision can be made based on the specific circumstances of the application identification results. For example, when the application identification result corresponding to the message received this time is changed compared to the previously recorded result and the application identification state is the final state, it means that the actual application identification result of the target data flow is currently identified, so access control processing is required for it. Otherwise, it means that the identification result has not changed; or if it has changed, but the final state result is not identified, access control processing can be omitted and it can directly enter the subsequent exit process in the firewall.

[0081] In an example, it can also be set that access control processing is performed as long as the application identification result changes to ensure data security. The specific rule settings can be set based on actual conditions.

[0082] The message processing method provided in this embodiment, after obtaining the first message of a data stream, when there is application type configuration information in the access control policy under the flow direction type corresponding to the data stream, performs application identification on the first message, records it in the session associated with the data stream, and executes corresponding access control processing; when receiving subsequent messages, performs application identification in combination with the application identification status of the previously received messages in the session, and updates the first session, which can effectively reduce the number of times the firewall performs deep application identification on the data stream messages, thereby reducing the loss of application identification to the firewall performance.

[0083] According to an embodiment of the present invention, another message processing method embodiment is provided, which is applied to a firewall. Figure 2 is a flow chart of another message processing method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0084] Step S201, obtaining the first message of the target data flow, and determining the flow direction type of the target data flow.

[0085] Specifically, in the above step S201, the flow direction type of the target data flow is determined as follows:

[0086] Step S201-1, obtaining the destination IP address and source IP address of the first message and the user IP address corresponding to the firewall.

[0087] Step S201-2: If the user IP address and the destination IP address are the same, determine that the flow direction type of the data flow is an inbound type.

[0088] Step S201-3: If the user IP address and the source IP address are the same, determine that the flow type of the data flow is an outbound type.

[0089] It can be understood that when determining the flow type of the target data flow, the source IP address and destination IP address of the first message can be obtained, which can characterize the source and destination of the data flow. The IP address of the user protected by the firewall is compared with the source IP address and the destination IP address, so as to efficiently and quickly determine the flow type of the data flow. If it is the same as the destination IP address, it is the inbound type, that is, the data flow is inflow; if it is the same as the source IP address, it is the outbound type, that is, the data flow is outflow.

[0090] Step S202: When there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type, the application identification module of the firewall is used to process the first message to determine the application identification result and application identification status corresponding to the first message. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0091] Step S203, the application identification result and application identification state corresponding to the first message are recorded in the first session associated with the target data flow, and access control processing is performed on the first message according to the access control policy set corresponding to the flow type. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0092] Step S204: When a subsequent message of the target data flow is received, the application identification module of the firewall is used to process the currently received subsequent message based on the application identification state recorded in the current first session, and the first session is updated.

[0093] Specifically, in step S204, based on the application identification state recorded in the current first session, the application identification module of the firewall is used to process the currently received subsequent message and update the first session, including:

[0094] Step S204-1, determining whether the first application identification state in the current first session is a final state, the first application identification state being the application identification state most recently entered in the current first session.

[0095] Step S204-2: If yes, the first application identification state and its corresponding first identification result are determined as the application identification state and application identification result corresponding to the currently received subsequent message, and recorded in the first session.

[0096] Step S204-3: if no, the application identification module of the firewall is used to identify the currently received subsequent message, obtain the application identification result and application identification status corresponding to the currently received subsequent message, and record them in the first session.

[0097] It can be understood that when the firewall receives a subsequent message of the target data flow corresponding to the first message, the subsequent message refers to the message after the first message, such as the second message, the third message, etc. of the data flow. For step S204-1, it can be understood that each time a subsequent message is received, it will be determined whether the application identification state most recently entered in the current first session is the final state, that is, whether the first application identification state is the final state. For example, assuming that the subsequent message received this time is the second message, the application identification state most recently entered is the application identification state obtained by identifying the first message; if the subsequent message received this time is the third message, the application identification state most recently entered is the application identification state obtained by identifying the second message, and so on.

[0098] Next, for step S204-2, if the application identification state recorded most recently is the final state, it means that the application identification result recorded most recently in the first session is the application identification result in the final state, that is, the application identification type finally identified for the target data flow has been obtained. Therefore, for the message received this time, it is not necessary to perform message identification through the application identification module, and the application identification state recorded most recently and the corresponding application identification result can be directly used as the application identification result corresponding to the message received this time, and recorded in the first session, so as to perform application identification on subsequent messages based on the same logic, avoiding repeated calls to the application identification module and affecting the firewall performance.

[0099] For step S204-3, it can be understood that if the application identification state recorded most recently is not the final state, it means that the final application identification result of the target data flow has not yet been identified. Therefore, it is necessary to further identify the currently received message, that is, to perform application identification on the currently received message through the application identification module, determine its corresponding application identification state and application identification result, and record the first session, so as to facilitate application identification of subsequent messages based on the same application identification logic.

[0100] To facilitate understanding of the above steps, an example can be used to assist understanding. For example, for a certain data flow, the identification result corresponding to the first message received by the firewall is: application type A, the application identification state is: non-final state, and the information recorded in the first session is: 1: application type A, non-final state;

[0101] Next, for the second message received, since the application identification status recently written in the first session is a non-final state, the application identification module performs further identification based on the second message, and obtains the application identification result: application type A-1, application identification status: non-final state, and after updating the first session, it is: 1: application type A, non-final state; 2: application type A-1, non-final state. It should be noted that in actual situations, not every message can get a further application identification result, and it is possible that the application identification result after identifying the second message is still application type A. This is only an illustrative example given here for ease of understanding.

[0102] Next, for the third message received, since the application identification status most recently written in the first session is a non-final state, the application identification module still performs further identification based on the third message to obtain the application identification result and the corresponding application identification status and write them into the first session, and so on.

[0103] Assuming that when the Nth message is received, the application identification status most recently written in the first session is the final status, and assuming that its corresponding application identification result is A-1-c-0, the application identification result corresponding to the Nth message is directly determined as A-1-c-0, the application identification status is the final status, and is written into the first session.

[0104] When the N+1th message is received, the most recently written application identification status is the final status, then its corresponding application identification result A-1-c-0 can be directly used as the application identification result of the N+1th message, and its corresponding application identification status can be determined as the final status and recorded in the first session, so that subsequently received messages can continue to perform application identification based on this logic.

[0105] Furthermore, in step S204-3, before the application identification module of the firewall is used to identify the currently received subsequent message, the method further includes:

[0106] Step S204-3-A, obtaining the historical number of times the application identification module performs application identification on the packets of the target data flow.

[0107] Step S204-3-B, if the historical number of times is greater than the preset threshold, skip the step of using the application identification module of the firewall to identify the subsequent message currently received, determine the application identification state corresponding to the subsequent message currently received as the final state, and determine the first identification result corresponding to the first identification state in the first session as the application identification result corresponding to the subsequent message currently received.

[0108] It can be understood that in step S204-3, since the application identification state most recently entered in the current first session is not the final state, it is necessary to call the application identification module to perform message identification. Before performing message identification, the historical number of times the application identification module has performed application identification on the target data stream can be obtained, that is, for the target data stream, the application identification module has performed message identification several times.

[0109] If the historical number is greater than the preset threshold, it means that the application identification has performed multiple message identifications, but still has not obtained the application identification result corresponding to the final state. Therefore, it means that the application identification module cannot achieve the final state application identification for the target data stream due to insufficient configuration. At this time, the message received this time can no longer be identified by the application identification module, and the application identification state of the message received this time can be directly determined as the final state. The application identification result entered most recently in the first session, that is, the application identification result corresponding to the first identification state mentioned above, is determined as the application identification result corresponding to the message received this time, and is written into the first session.

[0110] Assuming that the application identification result written into the first session corresponding to the message received this time is application type A, and the application identification state is the final state, for the next received message x, when processing based on the above execution logic, since the application identification state most recently written in the first session is the final state, the application identification result corresponding to the next received message x can be directly determined as application type A, and the application identification state is determined to be the final state, and so on, and the same is true for the subsequent ones, so there is no need to use the application identification module for in-depth identification again, thereby ensuring the application identification effect of the firewall.

[0111] In another case, when the history here is not greater than the preset threshold, the step of using the application identification module of the firewall to identify the subsequent message currently received is directly executed, which will not be repeated here.

[0112] Step S205: Process the currently received subsequent message based on the updated application identification result and application identification state in the first session.

[0113] Specifically, in step S205, the currently received subsequent message is processed based on the updated application identification result and application identification state in the first session, including:

[0114] Step S205-1, determining whether the application identification state most recently entered in the updated first session is the final state, and whether the corresponding application identification result has changed.

[0115] Step S205-2: if yes, perform access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow type;

[0116] Step S205-3: if no, skip the access control process for the currently received subsequent message.

[0117] It can be understood that, for the subsequent message currently received, after the application identification is completed and the corresponding status and result are written into the first session, the information in the first session has been updated, that is, the most recently entered application identification result and application identification status are the relevant information for the subsequent message currently received.

[0118] It is necessary to determine whether the application identification state entered most recently is the final state, and whether the corresponding application identification result has changed compared to the result entered last time. If yes, it means that the final identification result corresponding to the target data flow has been identified through the message received this time, so it is necessary to perform access control processing on the message received this time through the access control policy set under the corresponding flow type.

[0119] Let's use an example to help understand. Assume that for the target data stream, 5 messages have been received so far, and the subsequent message currently received is the 5th message. After the recognition status and recognition result of the 5th message are recorded in the first session, the corresponding application recognition results in the first session are: Message 1: Application type A, non-final state; Message 2: Application type A (when identifying message 2, no new result is further identified), non-final state; Message 3: Application type A-1, non-final state; Message 4: Application type A-1-c, non-final state; Message 5: Application type A-1-ct, final state.

[0120] In this process, only message 1 and message 5 need to be processed for access control. The first message is processed for access control because it is the first message and has the highest importance, so it needs to be processed for access control. The fifth message is processed for access control because it is a message that determines the final identification result of the data flow, and the application identification type is the final state, so it needs to be processed for access control in combination with the access control policy. On this basis, for subsequent messages received, based on the above application identification logic, the corresponding application identification results and application identification states will not change, so there is no need to perform corresponding access control processing.

[0121] In the actual firewall processing mechanism, the access control processing mechanism can be set according to the actual situation. The above is only a preferred exemplary embodiment, and the rule setting during the specific implementation is not limited here.

[0122] Furthermore, the flow type includes an inbound type and an outbound type;

[0123] In the above method embodiment, access control processing is performed on the currently received subsequent message according to the access control policy set corresponding to the flow type, including:

[0124] If the flow type is an inbound type, user authentication and authorization, protocol and port restrictions, and content filtering are performed on the currently received subsequent messages based on the first access control policy set corresponding to the inbound type;

[0125] If the flow type is an outbound type, data leakage prevention, application program restriction, and flow control are performed on the currently received subsequent messages based on the second access control policy set corresponding to the outbound type.

[0126] It can be understood that, when performing access control processing on messages of different flow types, access control policies of different angles can be respectively executed, thereby achieving targeted access control processing on the messages.

[0127] For example, for messages under the inbound type, the access control policy set corresponding to the inbound type is the first access control policy set, based on which access control policies from the perspectives of user authentication and authorization, protocol and port restrictions, and content filtering are performed on the messages; for messages under the outbound type, the access control policy set corresponding to the outbound type is the second access control policy set, based on which access control policies from the perspectives of data leakage prevention, application restrictions, and traffic control are performed on the messages.

[0128] This is just a preferred illustrative example, and the specific access control strategy can be set according to actual needs.

[0129] The contents corresponding to the above steps S202 to S205 are the processing flow when there is an access control policy with application type configuration information in the access control policy under the flow type corresponding to the target data flow.

[0130] In some cases, when there is no access control policy containing application type configuration information in the access control policy set corresponding to the flow type, access control processing is performed on the first message directly according to the access control policy set corresponding to the flow type, and access control processing is no longer performed on subsequent messages of the target data flow.

[0131] It can be understood that after receiving the first message of the target data flow and determining the flow type of the data flow, if there is no application type configuration information in all access control policies for the flow type in the firewall, there is no need to perform application identification on the target data flow. For the first message, access control processing can be performed directly according to the corresponding access control policy. For subsequent messages of the data flow, there is no need to perform access control processing, and they can directly enter the subsequent process of firewall processing. The specific subsequent process is set according to actual needs.

[0132] The message processing method provided by the embodiment of the present invention, after obtaining the first message of a data stream, when there is application type configuration information in the access control policy under the flow direction type corresponding to the data stream, performs application identification on the first message, records it to the session associated with the data stream and executes corresponding access control processing; when receiving subsequent messages, performs application identification in combination with the application identification status of the previously received messages in the session, and updates the first session, which can effectively reduce the number of times the firewall performs deep application identification on the data stream messages, thereby reducing the loss of application identification to the firewall performance.

[0133] In order to facilitate understanding of the above method embodiment, an example diagram of a processing flow for the first message of a data stream is provided according to an embodiment of the present invention. Figure 3 shown.

[0134] After receiving the first message, it determines whether the message is outgoing or incoming based on the IP address of the message, and records the result on the flow, that is, in the session associated with the data flow. Then, it checks whether the application type is configured in the corresponding access control policy based on the specific direction of the flow.

[0135] If all corresponding access control policies are not configured with application type information, then access control processing can be performed directly; if there is an access control policy with application type configuration information among the corresponding access control policies, it is necessary to determine the application identification result and application identification status corresponding to the first message through the application identification module, and record them on the flow, and then enter the subsequent process after access control processing is performed on the first message.

[0136] In addition, if Figure 4 As shown, it is an example diagram of a processing flow for subsequent messages of a data stream according to an embodiment of the present invention.

[0137] After receiving a subsequent message, the application identification result and application identification status of the last identification, as well as the corresponding flow type, are obtained from the session corresponding to the data stream to which the message belongs. The flow type is used to subsequently determine whether the corresponding access control policy has no application type information configured. In actual application scenarios, the judgment result can be recorded and called directly when processing the first message. This is only to facilitate understanding of the overall technical ideas. In actual application scenarios, it can be set according to actual conditions.

[0138] If all access control policies under the flow type do not have application type information configured, the subsequent message will directly enter other subsequent processing flows. Otherwise, it will be input into the application identification module to obtain the corresponding application identification result and application identification status, and recorded in the session associated with the data flow.

[0139] Then determine whether the identified application identification state is the final state and whether the corresponding application identification result has changed compared with the previous identification result. If so, perform access control processing on it. Otherwise, directly enter the subsequent processing flow.

[0140] Furthermore, regarding the above Figure 3 and Figure 4 For the specific processing flow of the application identification module in Figure 5 , is an example diagram of an application identification processing flow according to an embodiment of the present invention.

[0141] First, determine whether the current most recent application identification state in the associated session corresponding to the data flow is the final state. If so, directly use the most recently entered application identification result and application identification state in the session as the application identification result and application identification state corresponding to the currently received message.

[0142] If the answer is no, determine whether the number of messages for application identification of the data flow exceeds the upper limit. If so, determine the application identification result most recently entered in the session as the application identification result of this message, and determine its corresponding application identification state as the final state; if no, enter the application identification process, that is, perform deep packet processing on it through the application identification module to determine its corresponding application identification result and application identification state and output them, and at the same time increase the number of messages identified by the application identification module by 1.

[0143] The above method embodiment sets the application identification switch for outgoing and incoming traffic respectively, and can dynamically adjust the application identification switch according to the current outgoing and incoming access control policies. Compared with the global application identification switch of the traditional firewall, the control accuracy is more refined, and it can be dynamically adjusted according to the access control policy, which can reduce unnecessary messages entering the application identification, thereby reducing the loss of application identification to the firewall performance. In addition, the application identification module increases the application identification state and the number of messages. The number of application identification messages indicates the maximum number of messages that can be identified by a single stream. If this value is exceeded, it means that the application type cannot be identified, and subsequent messages do not need to be identified. For those that have already identified the application type or exceed the number of application identification messages, the application identification state is returned to the final state, and subsequent messages do not need to be identified, thereby further reducing unnecessary messages entering the application identification and further reducing the loss of application identification to the firewall performance.

[0144] In the present embodiment, a message processing device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made are omitted. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0145] This embodiment provides a message processing device, such as Figure 6 As shown, including:

[0146] The flow direction determination module 401 is used to obtain the first message of the target data flow and determine the flow direction type of the target data flow.

[0147] The first packet identification module 402 is used to process the first message using the firewall's application identification module when there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type, and determine the application identification result and application identification status corresponding to the first message.

[0148] The first packet processing module 403 is used to record the application identification result and application identification status corresponding to the first message to the first session associated with the target data flow, and perform access control processing on the first message according to the access control policy set corresponding to the flow type.

[0149] The subsequent packet identification module 404 is used to process the currently received subsequent message based on the application identification state recorded in the current first session by using the application identification module of the firewall and update the first session when receiving the subsequent message of the target data flow.

[0150] The subsequent packet processing module 405 is used to process the currently received subsequent message based on the updated application identification result and application identification state in the first session.

[0151] In some optional embodiments, the device is also used to, when there is no access control policy containing application type configuration information in the access control policy set corresponding to the flow type, directly perform access control processing on the first message according to the access control policy set corresponding to the flow type, and no longer perform access control processing on subsequent messages of the target data flow.

[0152] In some optional implementations, the subsequent packet identification module 404, based on the application identification state recorded in the current first session, uses the application identification module of the firewall to process the currently received subsequent message and update the first session, including:

[0153] Determine whether the first application identification state in the current first session is a final state, the first application identification state being the application identification state most recently entered in the current first session;

[0154] If yes, the first application identification state and the first identification result corresponding thereto are determined as the application identification state and the application identification result corresponding to the currently received subsequent message, and are recorded in the first session;

[0155] If not, the application identification module of the firewall is used to identify the currently received subsequent message, obtain the application identification result and application identification state corresponding to the currently received subsequent message, and record them in the first session.

[0156] In some optional implementations, the subsequent packet processing module 405 processes the currently received subsequent message based on the updated application identification result and application identification state in the first session, including:

[0157] Determine whether the application identification state most recently entered in the updated first session is the final state and the corresponding application identification result has changed;

[0158] If yes, then access control processing is performed on the subsequent messages currently received according to the access control policy set corresponding to the flow type;

[0159] If not, skip the access control processing for the subsequent message currently received.

[0160] In some optional implementations, if the application identification state most recently entered in the current first session is not the final state, the subsequent packet identification module 404, before using the application identification module of the firewall to identify the currently received subsequent message, is further configured to:

[0161] Obtain the historical number of times the application identification module performs application identification on the packets of the target data flow;

[0162] If the historical number of times is greater than the preset threshold, the step of using the application identification module of the firewall to identify the subsequent message currently received is skipped, the application identification state corresponding to the subsequent message currently received is determined as the final state, and the first identification result corresponding to the first identification state in the first session is determined as the application identification result corresponding to the subsequent message currently received.

[0163] In some optional implementations, the flow direction type of the target data flow is determined as follows:

[0164] Get the destination IP address and source IP address of the first message and the user IP address corresponding to the firewall;

[0165] If the user IP address and the destination IP address are the same, the flow type of the data flow is determined to be inbound;

[0166] If the user IP address and the source IP address are the same, the flow direction type of the data flow is determined to be the outbound type.

[0167] In some optional embodiments, the flow type includes an inbound type and an outbound type;

[0168] The subsequent packet identification module 404, when performing access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow type, includes:

[0169] If the flow type is an inbound type, user authentication and authorization, protocol and port restrictions, and content filtering are performed on the currently received subsequent messages based on the first access control policy set corresponding to the inbound type;

[0170] If the flow type is an outbound type, data leakage prevention, application program restriction, and flow control are performed on the currently received subsequent messages based on the second access control policy set corresponding to the outbound type.

[0171] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0172] The message processing device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0173] The embodiment of the present invention also provides a computer device having the above Figure 6 The message processing device shown.

[0174] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0175] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0176] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0177] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0178] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0179] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0180] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0181] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0182] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A message processing method, applied to a firewall, characterized in that: The method comprises: Obtaining a first message of a target data flow, and determining a flow direction type of the target data flow; When there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type, the first message is processed by the application identification module of the firewall to determine the application identification result and application identification status corresponding to the first message; Recording the application identification result and application identification state corresponding to the first message to a first session associated with the target data flow, and performing access control processing on the first message according to the access control policy set corresponding to the flow direction type; When a subsequent message of the target data flow is received, based on the application identification state recorded in the current first session, the application identification module of the firewall is used to process the currently received subsequent message and update the first session; The currently received subsequent message is processed based on the updated application identification result and application identification state in the first session.

2. The method according to claim 1, characterized in that The method further comprises: When there is no access control policy containing application type configuration information in the access control policy set corresponding to the flow type, access control processing is performed on the first message directly according to the access control policy set corresponding to the flow type, and access control processing is no longer performed on subsequent messages of the target data flow.

3. The method according to claim 1, characterized in that The processing of the currently received subsequent message by using the application identification module of the firewall based on the application identification state recorded in the current first session and updating the first session includes: Determine whether a first application identification state in the current first session is a final state, the first application identification state being the application identification state most recently entered in the current first session; If yes, determining the first application identification state and the first identification result corresponding thereto as the application identification state and the application identification result corresponding to the currently received subsequent message, and recording them in the first session; If not, the application identification module of the firewall is used to identify the currently received subsequent message, obtain the application identification result and application identification status corresponding to the currently received subsequent message, and record them in the first session.

4. The method according to claim 3, characterized in that The processing of the currently received subsequent message based on the updated application identification result and application identification state in the first session includes: Determining whether the application identification state most recently entered in the updated first session is a final state and the corresponding application identification result has changed; If yes, then perform access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow type; If not, skip the access control processing for the subsequent message currently received.

5. The method according to claim 3, characterized in that: If the application identification state most recently entered in the current first session is not the final state, before using the application identification module of the firewall to identify the currently received subsequent message, the method further includes: Obtaining a historical number of times the application identification module performs application identification on the message of the target data flow; If the historical number of times is greater than a preset threshold, the step of using the application identification module of the firewall to identify the subsequent message currently received is skipped, the application identification state corresponding to the subsequent message currently received is determined as the final state, and the first identification result corresponding to the first identification state in the first session is determined as the application identification result corresponding to the subsequent message currently received.

6. The method according to claim 1, characterized in that The flow direction type of the target data flow is determined as follows: Obtain the destination IP address and source IP address of the first message and the user IP address corresponding to the firewall; If the user IP address and the destination IP address are the same, determining that the flow direction type of the data flow is an inbound type; If the user IP address and the source IP address are the same, it is determined that the flow type of the data flow is an outbound type.

7. The method according to claim 4, characterized in that The flow direction type includes an inbound type and an outbound type; The performing access control processing on the currently received subsequent message according to the access control policy set corresponding to the flow direction type includes: If the flow type is an inbound type, performing user authentication and authorization, protocol and port restriction, and content filtering on the currently received subsequent message based on the first access control policy set corresponding to the inbound type; If the flow type is an outbound type, data leakage prevention, application program restriction, and flow control are performed on the currently received subsequent messages based on the second access control policy set corresponding to the outbound type.

8. A message processing device, applied to a firewall, characterized in that: The device comprises: A flow direction determination module, used to obtain the first message of the target data flow and determine the flow direction type of the target data flow; A first packet identification module, used to process the first message using the application identification module of the firewall to determine the application identification result and application identification status corresponding to the first message when there is an access control policy containing application type configuration information in the access control policy set corresponding to the flow type; A first packet processing module, used to record the application identification result and application identification state corresponding to the first message to the first session associated with the target data flow, and perform access control processing on the first message according to the access control policy set corresponding to the flow type; A subsequent packet identification module, configured to, when receiving a subsequent message of the target data flow, process the currently received subsequent message using the application identification module of the firewall based on the application identification state recorded in the current first session, and update the first session; The subsequent packet processing module is used to process the currently received subsequent message based on the updated application identification result and application identification state in the first session.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the message processing method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the message processing method according to any one of claims 1 to 7.

Images