Access control method, access control terminal and cluster

Abstract

The invention discloses an access control method, an access control terminal and a cluster. The method comprises the following steps: receiving a target data packet, wherein the target data packet comprises a to-be-matched value; a target code of at least one rule in an access control list (ACL) is obtained, the target code comprises a matching logic instruction and a matching item corresponding to each rule, and the matching item is used for judging whether the to-be-matched value is matched with the rule corresponding to the matching item or not; based on the matching item and the to-be-matched value, executing the matching logic instruction to obtain a matching result of the to-be-matched value and a rule corresponding to the matching item; and based on a matching result, allowing or preventing the target data packet from passing. According to the method, the access control efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to an access control method, an access control terminal and a cluster. Background Art

[0002] Access control list (ACL) is an access control technology based on packet filtering. ACL includes at least one routing information, each routing information may include at least one rule, and the at least one rule is used to control the access of data packets. Specifically, if the data packet matches the at least one rule, the data packet is allowed to pass or blocked. Among them, each rule in the at least one rule of ACL generally includes one or more matching items. By judging whether the to-be-matched value of the data packet is consistent with the matching item, it is judged whether the data packet matches the corresponding rule.

[0003] Currently, the matching items of the rules are stored in the memory. When judging whether a data packet matches the rule, the matching items need to be read from the memory, which leads to a large number of memory access operations and affects the efficiency of access control. Summary of the invention

[0004] The embodiments of the present application provide an access control method, an access control terminal and a cluster, which can improve the efficiency of access control.

[0005] In a first aspect, an access control method is provided, the method comprising: receiving a target data packet, the target data packet comprising a value to be matched; obtaining a target code of at least one rule in an access control list (ACL), the target code comprising a matching logic instruction and a matching item corresponding to each rule, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; based on the matching item and the value to be matched, executing the matching logic instruction to obtain a matching result between the value to be matched and the rule corresponding to the matching item; based on the matching result, allowing or blocking the target data packet to pass.

[0006] In this method, the matching items are included in the code for executing access control, and the matching items can be loaded when the processor loads the code from the memory. In this way, when judging whether the target data packet matches the rule, there is no need to obtain the matching items from the memory, which reduces the number of memory accesses, saves memory access operations, and improves the efficiency of access control.

[0007] In a possible implementation, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

[0008] In this implementation, ACL can control data packets based on at least one of the protocol number, source port, source Internet Protocol IP address, destination port and destination IP address, thereby improving the flexibility of access control.

[0009] In a possible implementation, before receiving the target data packet, the method includes: obtaining a matching item; and generating a target code based on a matching logic instruction and the matching item corresponding to at least one rule.

[0010] In this implementation, before performing access control based on the ACL, the matching items in the ACL can be obtained, and the matching items can be included in the code for performing access control to obtain the target code. In this way, when the target code is used to perform access control on the target data packet, there is no need to obtain the matching items from the memory, which saves memory access operations and improves the efficiency of access control.

[0011] In one possible implementation, the matching item is a default value, and a target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: generating a default code based on the matching logic instructions and matching items of at least one rule, and the default code indicates skipping the execution of the matching logic instructions.

[0012] The matching item is the default value, which means that no matter what value the to-be-matched value takes, the to-be-matched value matches the rule, so there is no need to execute the corresponding matching logic instruction. In this case, a default code is generated, and the default code indicates to skip executing the matching logic instruction. Therefore, when performing access control, the matching logic instruction can be skipped based on the default code, which reduces the execution of the logic instruction and improves the efficiency of access control.

[0013] In one possible implementation, the matching item is a preset value, and a target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: generating a first judgment code based on the matching logic instructions and matching items of at least one rule, and the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0014] The matching item is a preset value. By judging whether the value to be matched is consistent with the matching item, the matching result between the value to be matched and the rule can be obtained. This has a high matching efficiency and can improve the efficiency of access control.

[0015] In one possible implementation, the matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and a target code is generated based on the matching logic instructions and matching items corresponding to at least one rule, including: determining the left endpoint as the minimum value of the value to be matched, generating a second judgment code based on the matching logic instructions and matching items of at least one rule, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or determining the right endpoint as the maximum value of the value to be matched, generating a third judgment code based on the matching logic instructions and matching items of at least one rule, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0016] When the matching item is a plurality of continuous values, the plurality of continuous values ​​can be represented by an interval. By judging whether the value to be matched is in the interval, the matching result between the value to be matched and the rule can be obtained. This improves the efficiency of access control.

[0017] When the left endpoint of the interval is the minimum value that the value to be matched can take, it is only necessary to determine whether the value to be matched is less than or equal to the right endpoint of the interval to obtain the matching result between the value to be matched and the rule. This further improves the efficiency of access control.

[0018] When the right endpoint of the interval is the maximum value that the value to be matched can take, it is only necessary to determine whether the value to be matched is greater than or equal to the left endpoint of the interval to obtain the matching result between the value to be matched and the rule. This further improves the efficiency of access control.

[0019] In a possible implementation, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

[0020] In this implementation, the target code can be generated based on the dictionary tree structure of the ACL and using the code compilation capability of JIT, which has a high code generation efficiency.

[0021] In a second aspect, an access control terminal is provided, which includes: a receiving module, used to receive a target data packet, the target data packet includes a value to be matched; an acquisition module, used to obtain a target code of at least one rule in an access control list ACL, the target code includes a matching logic instruction and a matching item corresponding to each rule, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; an execution module, used to execute the matching logic instruction based on the matching item and the value to be matched, and obtain a matching result between the value to be matched and the rule corresponding to the matching item; and a control module, used to allow or prevent the target data packet from passing based on the matching result.

[0022] In a possible implementation, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

[0023] In a possible implementation, before receiving the target data packet, the acquisition module is used to: acquire a matching item; and generate a target code based on a matching logic instruction and the matching item corresponding to at least one rule.

[0024] In a possible implementation, the matching item is a default value, and the acquisition module is used to generate a default code based on the matching logic instruction and the matching item of at least one rule, wherein the default code indicates to skip executing the matching logic instruction.

[0025] In a possible implementation, the matching item is a preset value, and the acquisition module is used to generate a first judgment code based on the matching logic instruction and the matching item of at least one rule, and the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0026] In one possible implementation, the matching item is a preset interval, and the preset interval includes a left endpoint and a right endpoint. The acquisition module is used to: determine the left endpoint as the minimum value of the value to be matched, and generate a second judgment code based on the matching logic instructions and matching items of at least one rule, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or determine the right endpoint as the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instructions and matching items of at least one rule, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0027] In a possible implementation, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

[0028] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster performs the method provided in the first aspect.

[0029] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0030] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0031] The beneficial effects of the second to fifth aspects can be referred to the above introduction to the beneficial effects of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1A schematic diagram of a system architecture provided for an embodiment of the present application;

[0033] Figure 2 A schematic diagram of the structure of an access control terminal provided in an embodiment of the present application;

[0034] Figure 3 A schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0035] Figure 4 A flowchart of generating code provided in an embodiment of the present application;

[0036] Figure 5 A schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0037] Figure 6 A schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0038] Figure 7 A schematic diagram of a dictionary tree provided in an embodiment of the present application;

[0039] Figure 8 A flowchart of an access control method provided in an embodiment of the present application;

[0040] Fig. 9 A schematic diagram of the structure of an access control terminal provided in an embodiment of the present application;

[0041] Fig.10 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0042] Fig.11 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0043] Fig.12 A schematic diagram of a structure of a computing device cluster connected via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The scheme provided by the embodiment of the present application will be described below in conjunction with the accompanying drawings. In the embodiment of the present application, "plurality" refers to two or more than two. "First", "second", etc. are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0045] Next, the technical terms that may be involved in the embodiments of the present application are introduced.

[0046] Access control list (ACL): refers to a list of rules for resource access control configured by the user. ACL is divided into network ACL, file system ACL and other types. Generally speaking, network ACL is a list of rules for access control of intranet resources. File system ACL is a list of rules for access control of file systems. ACL includes at least one routing information, and each routing information includes at least one rule. If the data packet matches at least one rule of the routing information, it can be confirmed that the data packet matches the routing information, that is, the routing information is hit. Among them, when at least one rule is multiple rules, there is a matching order between the multiple rules. When access control is performed on the data packet, according to the matching order, it is judged in sequence whether the data packet matches the multiple rules. Specifically, for two rules that are adjacent in the matching order, it is first judged whether the data packet matches the rule in the previous position. If they match, it is then judged whether the data packet matches the rule in the latter position. And so on. For a piece of routing information, whenever a rule does not match, the matching is interrupted, and a matching result indicating that the data packet does not match the routing information is obtained. Then, it is judged whether the data packet matches the next piece of routing information. And so on, until a matching result of a data packet matching a piece of routing information is obtained, or a matching result of a data packet not matching all routing information is obtained. In addition, access control based on ACL follows the "stop matching once hit" mechanism. Once a matching result of a data packet matching a piece of routing information is obtained, the matching is interrupted, and there is no need to judge whether the data packet matches other routing information. Among them, if the ACL is a whitelist, when the data packet does not match all routing information, the data packet is blocked from passing, that is, the data packet is blocked from accessing the corresponding resources. Correspondingly, when the data packet matches any routing information, the data packet is allowed to pass, that is, the data packet is allowed to access the corresponding resources. If the ACL is a blacklist, when the data packet matches any routing information, the data packet is blocked from passing. Correspondingly, when the data packet does not match all routing information, the data packet is allowed to pass. In addition, there is an implicit statement at the end of the ACL rule. Among them, when the ACL is a whitelist, the implicit statement indicates blocking. That is, when the data packet does not match all routing information, the implicit statement is executed to block the data packet from passing. When the ACL is a blacklist, the implicit statement indicates allowing. That is, when a data packet does not match any routing information, the implicit statement is executed to allow the data packet to pass.

[0047] Matching items: Matching items belong to rules and are used to determine whether a data packet matches the rule. Among them, matching items are used to determine whether a data packet matches a rule by determining whether the to-be-matched value in the data packet matches the rule. For example, the destination address consists of four bytes, each byte is used as a rule, and the destination address can be set to "192.167.1.1". Then the matching item of the first byte (i.e., the first rule of the destination address) is "192", and the matching item of the second byte (i.e., the second rule of the destination address) is "167", and the matching item of the third byte (i.e., the third rule of the destination address) is "1", and the matching item of the fourth byte (i.e., the fourth rule of the destination address) is "1".

[0048] Value to be matched: is the value carried by the data packet. The value to be matched corresponds to the rule of the ACL. The value to be matched is used to determine whether the data packet matches the rule. Among them, when the value to be matched is consistent with the matching item of the corresponding rule, it can be confirmed that the value to be matched matches the rule. The value to be matched matches the rule, indicating that the data packet matches the rule. For example, if the rule is the source Internet protocol (IP) address, the value to be matched is the value of the source IP address of the data packet. For another example, if the rule is the first byte in the destination address, the value to be matched is the value of the first byte in the destination address carried by the data packet.

[0049] Dictionary tree: also known as trie tree or prefix tree, is a tree data structure that can be used to count, sort, and save a large number of strings. The string recorded in the node in the dictionary tree is the prefix of the string recorded in the next hop node of the node, and the nodes that record the same string can be merged into one node. In other words, a node can have multiple next hop nodes, and the string recorded in the node is the common prefix of the strings recorded in multiple next hop nodes of the node. In this way, when performing a query, using the common prefix of multiple strings can reduce unnecessary string comparisons, which has higher query efficiency.

[0050] Just-in-time compilation (JIT): Also known as real-time compilation, it is a method of compiling computer code that is performed during the execution of the program. Compilation refers to the conversion of source code or bytecode into machine code that can be directly executed by the computer. Runtime compilation is performed by the JIT compiler.

[0051] The embodiment of the present application provides an access control method based on ACL. The method can include the matching items of the rules of the ACL into the target code of the rule, so that the processor can load the matching items when loading the target code of the rule. When performing access control on the target data packet, it is directly judged based on the matching items in the target code whether the to-be-matched value of the target data packet matches the corresponding rule, thereby obtaining the matching result of the matching value of the data packet and the rule. Then, based on the matching result, the target data packet can be allowed or blocked to pass. In this way, there is no need to read the matching items from the memory, which saves the memory reading operation and improves the efficiency of access control.

[0052] Next, the access control method provided in the embodiment of the present application is introduced.

[0053] Figure 1 The system architecture diagram of the access control method provided by the embodiment of the present application is shown. Figure 1 As shown, the system architecture may include a management terminal 110, an access terminal 120, an access control terminal 200, and a resource terminal 300. The management terminal 110 and the access terminal 120 may be any device, platform, or cluster with data processing and communication functions, such as a terminal device, a server, etc. The access control terminal 200 may be a cloud platform, a computing device, a computing device cluster, etc. In some embodiments, the access control terminal 200 may be a computing instance such as a virtual machine (VM) or a container deployed in a cloud platform, a computing device, or a computing device cluster. In some embodiments, the access control terminal 200 may be a hardware device such as a switch, a router, or a hardware firewall. In some embodiments, the access control terminal 200 may be a software system such as a virtual network or a software firewall. The resource terminal 300 is the destination terminal requested to be accessed by the access terminal 120. In some embodiments, the resource terminal 300 may be an intranet of an organization such as an enterprise. In some embodiments, the resource terminal 300 may be a file system. In some embodiments, the resource terminal 300 may be a cloud network, such as a virtual private cloud (VPC).

[0054] The administrator can configure the ACL for the resource terminal 300 on the management terminal 110 through configuration operations. The management terminal 110 can send the ACL to the access control terminal 200, so that the access control terminal 200 performs access control on the data stream sent to the resource terminal 300 based on the ACL. The user can trigger the access terminal 120 to send a data stream for accessing the resource terminal 300 through access operations. The data stream consists of multiple data packets sent in chronological order. The access control terminal 200 can perform access control on the data packets in the data stream, and send the data packets that have undergone access control (i.e., the data packets that have been filtered by the access control) to the resource terminal 300, thereby enabling the user to access the resource terminal 300.

[0055] Next, combine Figure 2 , introduces the functions of the access control terminal 200.

[0056] See also Figure 2 The access control terminal 200 may include a code generation module 220 and an access control module 230 .

[0057] In some embodiments, the code generation module 220 may generate a target code for at least one rule in the ACL. The ACL may include at least one routing information, each routing information includes at least one rule. The code generation module 220 may generate a target code for at least one rule of each routing information.

[0058] In some embodiments, the ACL may be set to include the three routing information shown in Table 1, and each routing message includes at least one rule. The access control for the target data packet may be set to determine whether the target data packet complies with the rules in the ACL based on the byte granularity. Then, each routing information is divided into 11 rules according to the byte granularity, that is, each routing information includes 11 rules. Among them, the protocol number is one byte, representing one rule; the source IP address is four bytes, which can be divided into four rules; the source port is two bytes, which can be divided into two rules; the destination IP address is four bytes, which can be divided into four rules; the destination port is two bytes, which can be divided into two rules. In this way, the routing information included in the ACL can be divided into at least one rule. There is a matching order between at least one rule, which is: protocol number, the first byte of the source IP address, the second byte of the source IP address, the third byte of the source IP address, the fourth byte of the source IP address, the first byte of the source port, the second byte of the source port, the first byte of the destination IP address, the second byte of the destination IP address, the third byte of the destination IP address, the fourth byte of the destination IP address, the first byte of the destination port, and the second byte of the destination port.

[0059] Table 1

[0060] Protocol Number Source IP address Source Port Destination IP address Destination Port 6 0.0.0.0 / 0 0.0 / 0 192.167.1.1 / 30 8.0 / 8 6 0.0.0.0 / 0 0.0 / 0 192.168.1.77 / 32 8.0 / 8 6 0.0.0.0 / 0 0.0 / 0 192.169.1.177 / 32 8.0 / 8

[0061] In some embodiments, the ACL may be set to include two pieces of routing information shown in Table 2, each piece of routing information including at least one rule. The protocol number is a preset value, and both the IP address and the port can be expressed as an interval. In this embodiment, the protocol number, source IP address, source port, destination IP address, and destination port in each piece of routing information may be used as rules in the ACL, respectively.

[0062] Table 2

[0063]

[0064] The code generation module 220 can generate a target code for each routing information based on at least one rule of the routing information. The target code of each rule can be generated one by one according to the matching order between the at least one rule to obtain the target code of the at least one rule. The target code of the at least one rule can be referred to as the target code of the routing information to which the at least one rule belongs. The target codes of the multiple routing information included in the ACL constitute the target code of the ACL.

[0065] In some embodiments, the code generation module 220 generates a target code for at least one rule in the ACL based on the dictionary tree corresponding to the ACL. Figure 2 As shown, the access control terminal 200 also includes a dictionary tree construction module 210. The dictionary tree construction module 210 can obtain the ACL and generate a dictionary tree based on the ACL. For example, the dictionary tree construction module 210 can generate a dictionary tree based on the ACL shown in Table 1 according to the dictionary tree generation algorithm. Figure 3 The dictionary tree shown.

[0066] like Figure 3 As shown, the ACL includes multiple rules, and the dictionary tree includes multiple nodes. The multiple rules correspond to nodes in the multiple nodes. In the matching order between the multiple rules, the rule corresponding to the node is before the rule corresponding to the next hop node of the node. The node records the matching items of the rule corresponding to the node.

[0067] In the traditional table lookup method, when access control is performed on a target data packet, jumps are made between multiple nodes. Each time a node is jumped to, the matching items recorded in the node are obtained, and based on the matching items, it is determined whether the target data packet is consistent with the rule. The jump order between the multiple nodes is consistent with the matching order of the multiple rules. The root node represents the protocol number, and when access control is performed on the target data packet, matching is performed starting from the root node.

[0068] More specifically, each node has 256 positions, each of which is used to record the matching items of the corresponding rule. If all 256 positions have values, this means that the matching items of the rule cover all possible values ​​of the target data packet to be matched, that is, the rule is not restricted (for example, the rule is "any"). For example, the first byte of the source IP address in each routing information shown in Table 1 records 0, 1, 2, ..., 255, which covers all possible values ​​of the first byte of the source IP address, which means that the rule represented by the first byte is not restricted.

[0069] As described above, the string recorded in the node in the dictionary tree is the prefix of the string recorded in the next hop node of the node, that is, the matching item recorded in the node is the prefix of the matching item recorded in the next hop node of the node. If the prefixes of the matching items of the corresponding rules in different routing information are the same, the prefix can be recorded in one node. And, if the matching items of the corresponding rules in different routing information are different, when the prefixes of these different matching items are the same, these different matching items are also recorded in the same node, specifically recorded in different positions of different nodes. For example, as shown in Table 1, the matching items of the rules represented by the second byte in the destination IP address in different routing information are different, which are respectively the preset value "167", the preset value "168", and the preset value "169". The matching item of the rule represented by the first byte in the destination IP address in each routing information is the preset value "192", that is, the matching items of the rules represented by the first byte in the destination IP address in different routing information are the same. Then the matching items of the rules represented by the second byte in the destination IP address in different routing information have a common prefix, and the common prefix is ​​the matching item of the rule represented by the first byte in the destination IP address.

[0070] In addition, if the matching items of the corresponding rules in different routing information are different, it means that these matching items are different prefixes, and the next hop nodes of the nodes recording the matching items of the rule are different, that is, branches are generated from the nodes recording the matching items of the rule. For example, the matching items of the rule represented by the second byte of the destination IP address shown in Table 1 are preset value "167", preset value "168" and preset value "169", respectively, pointing to different next hop nodes. In other words, the dictionary tree generates branches from the nodes recording the preset value "167", preset value "168" and preset value "169", and the nodes recording the preset value "167", preset value "168" and preset value "169" have multiple next hop nodes.

[0071] The specific method of generating a dictionary tree based on ACL can also refer to the introduction of the prior art, which will not be described here one by one.

[0072] The code generation module 220 can obtain the dictionary tree constructed by the dictionary tree construction module 210, and generate the target code of the ACL based on the dictionary tree. The specific generation process will be introduced below and will not be repeated here.

[0073] In some embodiments, the code generation module 220 may be implemented as a JIT compiler. In this way, the ability of the JIT compiler to compile source code or bytecode into machine code may be utilized to convert the rules in the ACL or the dictionary tree corresponding to the ACL into the target code of at least one rule in the ACL (i.e., generate the target code based on the dictionary tree).

[0074] The access control module 230 can obtain the target code generated by the code generation module 220, and perform access control on the data packets sent to the resource end 300 by executing the target code. The specific process of access control will be introduced below and will not be repeated here.

[0075] The above example introduces a system architecture that can be used to implement the access control method provided by the embodiment of the present application. Next, in conjunction with the system architecture, the specific process of the access control method provided by the embodiment of the present application is introduced.

[0076] First, the process of generating the target code of the ACL rules is introduced.

[0077] See also Figure 4 After obtaining the ACL, the code generation module 220 may be started and run in step 401. In some embodiments, the code generation module 220 generates the target code of the ACL based on the ACL dictionary tree, and the code generation module 220 is started and run after the dictionary tree construction module 210 generates the dictionary tree.

[0078] In some embodiments, after the code generation module 220 is started, step 402 may be executed to generate an initialization code for access control.

[0079] In an example of this embodiment, the initialization code includes a code for performing a non-volatile register stack backup. The code can back up the caller information of the target code when the access control module 230 executes the target code to avoid damage to the caller information during the target code execution process.

[0080] In another example of this embodiment, the initialization code includes a code for allocating a register. The code is used to allocate a register pointing to the current rule and a register pointing to the current query string. The register pointing to the current rule is a register in a processor (e.g., a central processing unit (CPU)) for storing the target of the current rule. As described above, the access control performed on the data packet determines in turn whether the value to be matched in the data packet matches each rule in at least one rule according to the matching order between at least one rule. When it is necessary to determine whether the value to be matched matches the current rule according to the matching order, the target code of the current rule is obtained from the register pointing to the current rule, and the code is executed.

[0081] In one example, the register pointing to the current rule is specifically a register pointing to the current trie node. The current trie node refers to the trie node that records the matching item of the current rule.

[0082] The register pointing to the current query string is a register used by the processor to store the current query string. The current query string is a string in the data packet, that is, a value to be matched in the data packet. By judging whether the string is consistent with the matching item of the current rule, it is judged whether the data packet matches the current rule. The details will be introduced below in conjunction with the accompanying drawings, and will not be repeated here.

[0083] Continue reading Figure 4 , the code generation module 220 can execute step 403 to generate the target code for each rule in the ACL.

[0084] In step 403, the matching items of the rule may be obtained, and the matching logic instructions corresponding to the rule may be generated based on the matching items. Then, the target code of the rule may be generated based on the matching logic instructions corresponding to the rule and the matching items of the rule. For example, the matching logic instructions corresponding to the rule and the matching items of the rule may be combined to obtain the target code of the rule.

[0085] In some embodiments, the matching item of the rule can be a default value. Among them, the default value covers all possible values ​​of the to-be-matched value of the target data packet. Therefore, no matter what the value to be matched is, when judging whether the to-be-matched value matches the rule based on the matching item, the result of the to-be-matched value matching the rule is obtained. In this case, when performing access control on the target data packet, it is not necessary to judge whether the to-be-matched value of the target data packet matches the rule, and the matching result of the to-be-matched value matching the rule can be directly obtained. Therefore, a default code can be generated in step 403, and the default code is used to indicate skipping the matching logic instruction corresponding to the rule. When performing access control on the target data packet, the default code is executed to skip the matching logic instruction corresponding to the rule, that is, the matching logic instruction corresponding to the rule is not executed.

[0086] In some embodiments, the matching item of the rule is a preset value. In step 403, a judgment code F1 may be generated, which indicates whether the value to be matched of the target data packet is consistent with the matching item. The judgment code F1 may be used as a matching logic instruction corresponding to the rule. When access control is performed on the target data packet, the judgment code F1 is executed to determine whether the value to be matched of the target data packet is consistent with the matching item. If they are consistent, it means that the value to be matched of the target data packet matches the rule.

[0087] In some embodiments, the matching item of the rule is a continuous plurality of values, and the continuous plurality of values ​​constitute an interval. In step 403, a judgment code F2 may be generated. The judgment code F2 is used to indicate whether the value to be matched of the target data packet is within the interval. Among them, the judgment code F2 may be used as a matching logic instruction corresponding to the rule. When performing access control on the target data packet, the judgment code F2 is executed to determine whether the value to be matched of the target data packet is within the interval. If it is within the interval, it indicates that the value to be matched of the target data packet matches the rule.

[0088] In an example of this embodiment, the left endpoint of the interval is the minimum value of the value to be matched of the target data packet, that is, the left endpoint is the minimum value among all possible values ​​of the value to be matched. In other words, no matter what value the value to be matched is, it is greater than or equal to the left endpoint of the interval. Therefore, when the target data packet is subjected to access control, it is not necessary to judge whether the value to be matched is greater than or equal to the left endpoint of the interval, and it is only necessary to judge whether the value to be matched is less than or equal to the right endpoint of the interval to judge whether the value to be matched is within the interval. In this example, the judgment code F2 can only indicate to judge whether the value to be matched is less than or equal to the right endpoint of the interval. In this way, when performing access control, it is only necessary to judge whether the value to be matched is less than or equal to the right endpoint of the interval, thereby further improving the efficiency of access control.

[0089] In another example of this embodiment, the right endpoint of this interval is the maximum value of the value to be matched of the target data packet, that is, the right endpoint is the maximum value among all possible values ​​of the value to be matched. In other words, no matter what value the value to be matched is, it is less than or equal to the right endpoint of this interval. Therefore, when the target data packet is subjected to access control, it is not necessary to judge whether the value to be matched is less than or equal to the right endpoint of this interval, and it is only necessary to judge whether the value to be matched is greater than or equal to the left endpoint of the interval, so as to judge whether the value to be matched is within this interval. In this example, the judgment code F2 can only indicate to judge whether the value to be matched is greater than or equal to the left endpoint of the interval. In this way, when performing access control, it is only necessary to judge whether the value to be matched is greater than or equal to the left endpoint of the interval, thereby further improving the efficiency of access control.

[0090] In some embodiments, the ACL includes at least one rule, and the at least one rule can be traversed to generate a target code for each rule. The ACL may include multiple routing information, each routing information includes at least one rule, and the at least one rule of each routing information can be traversed to generate a target code for the at least one rule of each routing information. At least one rule of the same routing information has a matching order, and the at least one rule can be traversed according to the matching order to generate a target code.

[0091] Next, we will introduce the target code generation scheme in combination with specific rules.

[0092] Generally, routing information may include at least one of a protocol number, a source IP address, a source port, a destination IP address, and a destination port. The protocol number, source IP address, source port, destination IP address, and destination port in the same routing information each represent a rule. Generally speaking, the matching order between them is: protocol number, source IP address, source port, destination IP address, and destination port.

[0093] You can first generate the target code for the protocol number rule, which can be as follows: The value of the protocol number in the ACL is the matching item, and the value of the protocol number of the data packet is the value to be matched.

[0094] In case D1, the matching item of the protocol number of a certain routing information is the default value, that is, the value of the protocol number of the routing information covers all possible values ​​of the protocol number of the target data packet. In other words, no matter what the value of the protocol number of the target data packet is, the protocol number of the target data packet is consistent with the protocol number of the routing information. In this case, the protocol number of the target data packet matches the protocol number in the routing information by default. Then, in step 403, a default code can be generated for the protocol number, and the default code is used to indicate to skip executing the matching logic instruction corresponding to the protocol number. When performing access control, the default code is executed without judging whether the protocol number of the target data packet matches the protocol number in the routing information.

[0095] In case D2, when the number of matching items of the protocol number of a certain routing information is one, that is, when the matching item of the protocol number of the routing information is a preset value, a judgment code F1 can be generated for the protocol number, and the judgment code F1 indicates whether the value of the protocol number of the target data packet is consistent with the matching item of the protocol number. Among them, the judgment code F1 can be used as a matching logic instruction corresponding to the protocol number. When access control is performed on the target data packet, the judgment code F1 is executed to determine whether the value of the protocol number of the target data packet is consistent with the matching item of the protocol number. If they are consistent, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0096] Case D3, when the matching item of the protocol number of a certain routing information is a continuous multiple values. An interval can be generated based on the multiple values, and the interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the protocol number. The judgment code F2 is used to indicate whether the value of the protocol number of the target data packet is within the interval. When access control is performed on the target data packet, the judgment code F2 is executed to determine whether the value of the protocol number of the target data packet is within the interval. If it is within the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0097] In an example of this embodiment, the left endpoint of the interval is the minimum value of the protocol number of the target data packet, that is, the left endpoint is the minimum value of all possible values ​​of the protocol number of the target data packet. In this example, the judgment code F2 can only indicate whether the value of the protocol number of the target data packet is less than or equal to the right endpoint of the interval. When the target data packet is access controlled, only the value of the protocol number of the target data packet is judged to be less than or equal to the right endpoint of the interval. If the value of the protocol number of the target data packet is less than or equal to the right endpoint of the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0098] In another example of this embodiment, the right endpoint of this interval is the maximum value of the protocol number of the target data packet, that is, the right endpoint is the maximum value among all possible values ​​of the protocol number of the target data packet. In this example, the judgment code F2 can only indicate whether the value of the protocol number of the target data packet is greater than or equal to the left endpoint of the interval. When the target data packet is access controlled, only the value of the protocol number of the target data packet is greater than or equal to the left endpoint of the interval. If the value of the protocol number of the target data packet is greater than or equal to the left endpoint of the interval, it means that the protocol number of the target data packet matches the protocol number of the routing information.

[0099] Next, the target code can be generated for the source IP address rule, and the specific situation may be as follows: the value of the source IP address in the ACL is the matching item, and the value of the source IP address in the data packet is the value to be matched.

[0100] In case E1, the matching item of the source IP address of a certain routing information is the default value, that is, the value of the source IP address of the routing information covers all possible values ​​of the source IP address of the target data packet. In other words, no matter what the value of the source IP address of the target data packet is, the source IP address of the target data packet is consistent with the source IP address of the routing information. For example, the source IP address "0.0.0.0 / 0" shown in Table 2 is equivalent to "0-0xFFFFFFFF", which covers all possible values ​​of the source IP address of the target data packet. In this case, the source IP address of the target data packet matches the source IP address in the routing information by default. Then, in step 403, a default code can be generated for the source IP address, and the default code is used to indicate skipping the execution of the matching logic instruction corresponding to the source IP address. When performing access control, the default code is executed without judging whether the source IP address of the target data packet matches the source IP address in the routing information.

[0101] Case E2, when the number of matching items of the source IP address of a certain routing information is one, that is, when the matching item of the source IP address of the routing information is a preset value, a judgment code F1 can be generated for the source IP address, and the judgment code F1 indicates whether the value of the source IP address of the target data packet is consistent with the matching item of the source IP address. Among them, the judgment code F1 can be used as a matching logic instruction corresponding to the source IP address. When performing access control on the target data packet, the judgment code F1 is executed to determine whether the value of the source IP address of the target data packet is consistent with the matching item of the source IP address. If consistent, it means that the source IP address of the target data packet matches the source IP address of the routing information.

[0102] Case E3, when the matching item of the source IP address of a certain routing information is a continuous multiple values. An interval can be generated based on the multiple values, and the interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the source IP address. When access control is performed on the target data packet, the judgment code F2 is executed to determine whether the value of the source IP address of the target data packet is within the interval. If it is within the interval, it means that the source IP address of the target data packet matches the source IP address of the routing information.

[0103] In an example of this embodiment, the left endpoint of this interval is the minimum value (0) of the source IP address of the target data packet, that is, the left endpoint is the minimum value among all possible values ​​of the source IP address. In this example, the judgment code F2 can only indicate whether the value of the source IP address of the target data packet is less than or equal to the right endpoint of the interval. When the target data packet is access controlled, only the value of the source IP address of the target data packet is judged to be less than or equal to the right endpoint of the interval. The value of the source IP address of the target data packet is less than or equal to the right endpoint of the interval, indicating that the source IP address of the target data packet matches the source IP address of the routing information.

[0104] In another example of this embodiment, the right endpoint of this interval is the maximum value (0xFFFFFFFF) of the source IP address of the target data packet, and namely the right endpoint is the maximum value among all possible values ​​of the source IP address.In this example, judgment code F2 can only indicate whether the value of the source IP address of the target data packet is greater than or equal to the left endpoint of the interval.When the target data packet is carried out access control, the value of the source IP address of the target data packet is only judged to be greater than or equal to the left endpoint of the interval.The value of the source IP address of the target data packet is greater than or equal to the left endpoint of the interval, indicating that the source IP address of the target data packet matches the source IP address of the routing information.

[0105] Next, target codes can be generated for the source port, destination IP address, destination port and other rules. Among them, the matching items of the source port, destination IP address and destination port also have the above-mentioned situation E1, situation E2 and situation E3. According to the matching items of the source port, destination IP address and destination port, the target codes can be generated for the source port, destination IP address and destination port respectively with reference to the method described above, which will not be repeated here. Among them, in the relevant communication protocol, the maximum value of the port is "65535" (i.e. 2 to the 16th power - 1), and the minimum value is "0".

[0106] The above method can generate target codes for the protocol number, source IP address, source port, destination IP address, and destination port in the routing information, and these codes constitute the target code of the routing information. In the target code of the same routing information, the execution order of the target codes of the protocol number, source IP address, source port, destination IP address, and destination port is consistent with the matching order between them.

[0107] The target codes of all routing information of the ACL constitute the target code of the ACL. Among them, the target codes of different routing information are executed in series, that is, when the target code of one routing information is executed, the target code of another routing information is executed.

[0108] In one example, the following target code may be generated for the routing information with sequence number 1 shown in Table 2.

[0109] if(protocol number = 6&&0xc0a80000<=destination IP&&destination IP<=0xc0a800ff&&destination port<=80)

[0110] return 1; / / If the conditions required by this rule are met, the routing information with sequence number 1 will be returned.

[0111] Among them, the rules in the routing information of sequence number 2 are all default matching rules. Therefore, the target code of the routing information of sequence number 2 is "return 2; / / The second rule can match all situations by default, and it returns directly after executing here.

[0112] After JIT compilation, the target code corresponding to the two routing information shown in Table 2 includes the following code:

[0113] if(protocol number = 6&&0xc0a80000<=destination IP&&destination IP<=0xc0a800ff&&destination port<=80)

[0114] return 1;

[0115] return 2;"

[0116] In some embodiments, the target code of the ACL may be generated based on the dictionary tree corresponding to the ACL. In step 403, the dictionary tree may be traversed starting from the root node of the dictionary tree to generate the target code for each node.

[0117] As described above, the node corresponds to the rule and records the matching items of the rule corresponding to the node. The target code of the rule corresponding to the node can be generated based on the number of nodes of the next hop of the node and the matching items recorded by the node. Specifically, it can be divided into the following situations.

[0118] In case A1, each position in the node has a value, and the number of next-hop nodes of the node in the dictionary tree is one. Each position in the node has a value, which means that the node records all possible matching items of the rule, that is, the matching items recorded by the node cover all possible values ​​of the target data packet to be matched, that is, the rule corresponding to the node is not restricted, and the matching item of the rule is the default value, and the value to be matched of the default data packet matches the rule corresponding to the node. For case A1, a default code is generated for the rule corresponding to the node in step 404, and the default code is used to indicate to skip executing the matching logic instruction corresponding to the rule. When access control is performed on the target data packet, the default code is executed without judging whether the value to be matched of the target data packet matches the rule, and the matching result of the matching value of the target data packet matching the rule is directly obtained.

[0119] For example, Figure 5As shown, each position in the node corresponding to the rule of the second byte of the source port has a value, and the number of next-hop nodes of the node in the dictionary tree is one. A default code is generated for the rule of the second byte of the source port. When access control is performed on the target data packet, the default code is executed without judging whether the to-be-matched value of the target data packet matches the rule of the second byte of the source port, and the matching result that the matching value of the target data packet matches the rule is directly obtained.

[0120] In case A2, the node records one or more matching items, and the matching items recorded by the node do not cover all possible values ​​of the value to be matched of the data packet, and the number of next-hop nodes of the node in the dictionary tree is one. In this case, a judgment instruction can be generated to determine whether the value to be matched of the data packet is consistent with the matching items recorded by the node. Then, based on the judgment instruction and the matching items recorded by the node, the target code of the rule corresponding to the node is obtained. When performing access control on the target data packet, the judgment instruction is executed to determine whether the value to be matched of the target data packet matches the rule corresponding to the node.

[0121] Among them, situation A2 may include the following two situations.

[0122] Case A21, the number of next-hop nodes of the node in the dictionary tree is one, and the number of matching items recorded by the node is one. In the network ACL, when the protocol number is fixed or several bytes in the IP address are fixed, the dictionary tree has case A21. In case A21, the node has a value recorded in only one position, and the other positions are empty. The value recorded by the node points to a next-hop node. In step 403, a judgment code F1 can be generated for the rule corresponding to the node. Judgment code F1 is used to indicate whether the value to be matched of the target data packet is consistent with the matching item recorded by the node. When access control is performed on the target data packet, judgment code F1 is executed to determine whether the value to be matched of the target data packet is consistent with the matching item recorded by the node. If consistent, it indicates whether the value to be matched of the target data packet matches the rule corresponding to the node.

[0123] For example, Figure 6 As shown, the value of the first byte of the destination IP address is "192", that is, the node corresponding to the first byte of the destination IP address only records the value "192". In step 403, a judgment code F1 can be generated, wherein the judgment code F1 is used to indicate whether the value of the first byte of the destination IP address of the target data packet is consistent with "192".

[0124] In case A22, the number of next-hop nodes of the node in the dictionary tree is one, and the node records multiple matching items, wherein the multiple matching items are multiple continuous preset values. In case A22, the multiple preset values ​​can be obtained, and an interval can be generated based on the multiple preset values. Among them, the interval is a closed interval, and the right endpoint of the interval is the maximum value among the multiple values, and the left endpoint of the interval is the minimum value among the multiple values. In step 403, a judgment code F2 can be generated for the node. Judgment code F2 is used to indicate whether the value to be matched of the target data packet is within the interval. When access control is performed on the target data packet, the judgment code F2 is executed to determine whether the value to be matched of the target data packet is within the interval. If it is within the interval, it means that the value to be matched of the target data packet matches the rule corresponding to the node.

[0125] For example, Figure 7 As shown, the value of the fourth byte of the destination IP address can be any one of 0, 1, 2, and 3, that is, the node corresponding to the fourth byte of the destination IP address records 0, 1, 2, and 3. Based on 0, 1, 2, and 3, the interval [0, 3] can be obtained. A judgment code F2 can be generated for the node. The judgment code F2 is used to indicate whether the to-be-matched value of the target data packet is within the interval [0, 3].

[0126] In addition, when the left endpoint of the interval is the minimum value of the value to be matched of the target data packet, that is, when the left endpoint is the minimum value of all possible values ​​of the value to be matched. The judgment code F2 can only indicate whether the value to be matched of the target data packet is less than or equal to the right endpoint of the interval. When performing access control on the target data packet, only judge whether the value to be matched of the target data packet is less than or equal to the right endpoint of the interval. If the value to be matched of the target data packet is less than or equal to the right endpoint of the interval, it means that the value to be matched of the target data packet matches the rule corresponding to the node.

[0127] When the right endpoint of the interval is the maximum value of the value to be matched of the target data packet, that is, when the right endpoint is the maximum value of all possible values ​​of the value to be matched. In this example, the judgment code F2 can only indicate whether the value to be matched of the target data packet is greater than or equal to the left endpoint of the interval. When access control is performed on the target data packet, it is only judged that the value to be matched of the target data packet is greater than or equal to the left endpoint of the interval. The value to be matched of the target data packet is greater than or equal to the left endpoint of the interval, indicating that the value to be matched of the target data packet matches the rule corresponding to the node.

[0128] In some embodiments, if the node does not belong to the above-mentioned situation A1, nor does it belong to the above-mentioned situation A2, a code for implementing a traditional table lookup method is generated for the node, that is, the code is used to determine whether the to-be-matched value of the target data packet matches the rule corresponding to the node according to the traditional table lookup method. In other words, when determining whether the to-be-matched value of the target data packet matches the rule corresponding to the node, the code is used to read the matching item from the memory address corresponding to the node, and based on the read matching item, determine whether the data packet matches the rule corresponding to the node.

[0129] In some embodiments, an instruction for returning indication information is generated for each node in the dictionary tree. That is, the target code of each node also includes an instruction for returning indication information, and the indication information is used to indicate that the value to be matched of the data packet does not match the rule corresponding to the node. In other words, when it is determined that the value to be matched of the data packet does not match the rule corresponding to the node, the instruction for returning indication information corresponding to the node is executed.

[0130] In some embodiments, epilogue code may also be generated, wherein the epilogue code is the last executed code, and the epilogue code is used to restore the non-volatile register from the stack, write the matching result back to the return value register, and execute the matching result return instruction.

[0131] The target code of each node generated above, the code for returning the indication information, the closing code, etc. constitute the target code of ACL. Among them, in the target code of ACL, the execution order between the target codes of the rules corresponding to each node is consistent with the jump order of each node in the dictionary tree. Among them, the jump order of each node in the dictionary tree is consistent with the matching order between the rules corresponding to each node. Therefore, the execution order between the target codes of the rules corresponding to each node is consistent with the matching order between the rules corresponding to each node.

[0132] The above describes the process of generating the target code of the ACL. Next, the method of using the target code to perform access control on the target data packet is introduced.

[0133] The access control terminal 200 can use the target code of the ACL to perform access control on the target data packet. Figure 8 As shown, the method includes the following steps.

[0134] Step 801 : receiving a target data packet, wherein the target data packet includes a value to be matched, wherein the target data packet may be a data packet sent to the resource end 300 .

[0135] The value to be matched may be at least one of the protocol number, source port, source IP address, destination port and destination IP address. In other words, the value to be matched may be at least one of the value of the protocol number, source port, source IP address, destination port and destination IP address of the target data packet.

[0136] After receiving the target data packet, the access control terminal 200 may parse the target data packet to obtain the value to be matched.

[0137] Step 802, obtain the target code of at least one rule in the ACL, the target code includes the matching logic instruction and matching item corresponding to each rule, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item. The determination can be specifically performed by the matching logic instruction. That is, the access control terminal 200 determines whether the matching value matches the rule corresponding to the matching item by executing the matching logic instruction.

[0138] The ACL may include one or more pieces of routing information, and the at least one rule may be a rule of one of the pieces of routing information.

[0139] The matching logic instructions and matching items corresponding to each rule are included in the target code. In this way, when the processor of the access control terminal 200 loads the target code from the memory, it can load the matching items. In this way, there is no need to obtain the matching items from the memory during the matching process, which reduces the memory access operation.

[0140] In some embodiments, before step 801, the target code of the at least one rule may be generated. Among them, the matching items of the at least one rule may be obtained. Then, based on the matching logic instructions and matching items corresponding to the at least one rule, the target code of the at least one rule is generated. Figure 4 The description of the illustrated embodiment will not be repeated here.

[0141] Step 802 is performed by the access control module 230 in the access control terminal 200. The target code of at least one rule is generated by the code generation module 220. When the access control module 230 and the code generation module 220 run in the same computing device (for example, the access control terminal 200 can be a computing device cluster, and the access control module 230 and the code generation module 220 run in the same computing device of the computing device cluster), the access control module 230 can obtain the target code generated by the code generation module 220 through shared memory and other means.

[0142] When the access control module 230 and the code generation module 220 run on different computing devices (for example, the access control terminal 200 may be a computing device cluster, and the access control module 230 and the code generation module 220 run in different computing devices of the computing device cluster), the computing device running the code generation module 220 may send the target code to the computing device running the access control module 230 via a network, etc., so that the access control module 230 obtains the target code.

[0143] When the access control module 230 obtains the target code, the access control module 230 may apply for an executable memory from the operating system of the access control terminal 200. For example, when the operating system has a portable operating system interface (POSIX), the access control module 230 may apply for an executable memory from the operating system through the memory mapping function mmap. For another example, when the operating system is When access control module 230 uses the virtualalloc function to request executable memory from the operating system.

[0144] When applying for executable memory, the access control module 230 can copy the target code to the executable memory and remove the write permission of the executable memory to prevent the target code from being tampered with. The access control module 230 can return the first address of the executable memory to the processor. The first address of the executable memory is used as the address of the target code for the processor to call the target code.

[0145] Step 803: Based on the matching item and the value to be matched, the matching logic instruction is executed to obtain the matching result of the rule corresponding to the value to be matched and the matching item.

[0146] The matching logic instruction is used to determine whether the matching item and the value to be matched are consistent. If they are consistent, it means that the value to be matched matches the rule corresponding to the matching item, and a matching result indicating a match is obtained. If they are inconsistent, it means that the value to be matched does not match the rule corresponding to the matching item, and a matching result indicating a mismatch is obtained.

[0147] In some embodiments, as described above, the matching item of the rule may be a default value, and the target code of the rule includes a default code, which indicates to skip executing the matching logic instruction corresponding to the rule. In step 803, when the matching item is the default value, the default code is executed to skip executing the matching logic instruction corresponding to the rule, thereby reducing the execution operation of the logic instruction and improving the efficiency of access control. In this embodiment, a matching result indicating a match is obtained by default.

[0148] In some embodiments, as described above, the matching item of the rule may be a preset value, and the target code of the rule includes a judgment instruction F1. The judgment instruction F1 indicates whether the value to be matched is consistent with the matching item. Executing the matching logic instruction corresponding to the rule includes: executing the judgment instruction F1 of the rule to obtain a judgment result of whether the value to be matched is consistent with the matching item. If the judgment result indicates that the value to be matched is consistent with the matching item, a matching result indicating a match is obtained. If the judgment result indicates that the value to be matched is inconsistent with the matching item, a matching result indicating a mismatch is obtained.

[0149] In some embodiments, as described above, the matching item of the rule may be a preset interval, and the target code of the rule includes a judgment instruction F2. The judgment instruction F2 indicates whether the value to be matched is within the preset interval. Among them, the matching logic instruction corresponding to the execution rule includes: executing the judgment instruction F2 of the rule to obtain a judgment result of whether the value to be matched is within the preset interval. If the judgment result indicates that the value to be matched is within the preset interval, a matching result indicating a match is obtained. If the judgment result indicates that the value to be matched is not within the preset interval, a matching result indicating a mismatch is obtained. In this way, the matching result can be obtained without comparing the value to be matched with each matching item of the rule one by one, thereby improving the efficiency of access control.

[0150] In an example of this embodiment, if the left endpoint of the preset interval is the minimum value of the matching value, the judgment instruction F2 only instructs to judge whether the value to be matched is less than or equal to the right endpoint of the preset interval. That is to say, in step 803, it can only be judged whether the value to be matched is less than or equal to the right endpoint of the preset interval. When the value to be matched is less than or equal to the right endpoint of the preset interval, a matching result indicating a match can be obtained. Otherwise, a matching result indicating a mismatch is obtained. In this way, when the left endpoint of the preset interval is the minimum value of the matching value, it is not necessary to judge whether the value to be matched is greater than or equal to the left endpoint of the preset interval, which saves the judgment operation and further improves the efficiency of access control.

[0151] In another example of this embodiment, if the right endpoint of the preset interval is the maximum value of the matching value, the judgment instruction F2 only instructs to judge whether the value to be matched is greater than or equal to the left endpoint of the preset interval. That is to say, in step 803, it can only be judged whether the value to be matched is greater than or equal to the left endpoint of the preset interval. When the value to be matched is greater than or equal to the left endpoint of the preset interval, a matching result indicating a match can be obtained. Otherwise, a matching result indicating a mismatch is obtained. In this way, when the right endpoint of the preset interval is the maximum value of the matching value, it is not necessary to judge whether the value to be matched is less than or equal to the right endpoint of the preset interval, which saves the judgment operation and further improves the efficiency of access control.

[0152] When a matching result is obtained, the access control terminal 200 may allow or block the target data packet to pass based on the matching result in step 804. The target data packet is a data packet sent to the resource terminal 300. In step 804, the access control terminal 200 may allow or block the target data packet from being sent to the resource terminal 300 based on the matching result.

[0153] If the matching result indicates that the value to be matched matches the rule, it means that the target data packet hits the routing information in the ACL. When the ACL is a whitelist, the access control terminal 200 allows the target data packet to pass through to send the target data packet to the resource terminal 300. Among them, the access control terminal 200 can put the target data packet into the interface between the access control terminal 200 and the resource terminal 300 to send the target data packet to the resource terminal 300 through the interface. When the ACL is a blacklist, the access control terminal 200 blocks the target data packet from passing through to avoid sending the target data packet to the resource terminal 300. Among them, the access control terminal 200 can discard the target data packet.

[0154] In some embodiments, the ACL includes multiple routing information. In step 803, the access control terminal 200 can determine whether the target data packet matches the routing information one by one. When a matching result is obtained that the target data packet matches a routing information, the access control terminal 200 can execute step 804. When a matching result is not obtained that the target data packet matches a routing information, the access control terminal 200 can continue to determine whether the target data packet matches the next routing information.

[0155] When the target data packet does not match the multiple routing information, the access control terminal 200 may execute step 804. When the ACL is a white list, the access control terminal 200 blocks the target data packet from passing through. When the ACL is a black list, the access control terminal 200 allows the target data packet to pass through.

[0156] In summary, the access control method provided by the present application includes matching items in the code used to execute access control, and the matching items can be loaded when the processor loads the code from the memory. In this way, when determining whether the target data packet matches the rule, there is no need to obtain the matching items from the memory, which reduces the number of memory accesses, saves memory access operations, and improves the efficiency of access control.

[0157] The present application embodiment also provides an access control terminal 900. Fig. 9 As shown, the access control terminal 900 includes:

[0158] A receiving module 910 is used to receive a target data packet, wherein the target data packet includes a value to be matched;

[0159] The acquisition module 920 is used to acquire the target code of at least one rule in the access control list ACL, wherein the target code includes a matching logic instruction and a matching item corresponding to each of the rules, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item;

[0160] An execution module 930 is used to execute the matching logic instruction based on the matching item and the value to be matched, and obtain a matching result of the rule corresponding to the value to be matched and the matching item;

[0161] The control module 940 is used to allow or prevent the target data packet from passing based on the matching result.

[0162] In some embodiments, the value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

[0163] In some embodiments, before receiving the target data packet, the acquisition module 920 is used to: acquire the matching item; and generate the target code based on the matching logic instruction corresponding to the at least one rule and the matching item.

[0164] In an example of this embodiment, the matching item is a default value, and the acquisition module 920 is used to generate a default code based on the matching logic instruction of the at least one rule and the matching item, and the default code indicates to skip executing the matching logic instruction.

[0165] In an example of this embodiment, the matching item is a preset value, and the acquisition module 920 is used to: generate a first judgment code based on the matching logic instruction of the at least one rule and the matching item, and the first judgment code indicates whether the value to be matched is consistent with the matching item.

[0166] In an example of this embodiment, the matching item is a preset interval, and the preset interval includes a left endpoint and a right endpoint. The acquisition module 920 is used to: determine that the left endpoint is the minimum value of the value to be matched, and based on the matching logic instruction of the at least one rule and the matching item, generate a second judgment code, and the second judgment code indicates whether the value to be matched is less than or equal to the right endpoint; or, determine that the right endpoint is the maximum value of the value to be matched, and based on the matching logic instruction of the at least one rule and the matching item, generate a third judgment code, and the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

[0167] In some embodiments, the target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to a dictionary tree structure.

[0168] Among them, the receiving module 910, the acquisition module 920, the execution module 930 and the control module 940 can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the receiving module 910 is introduced below by taking the receiving module 910 as an example. Similarly, the implementation of the acquisition module 920, the execution module 930 and the control module 9400 can refer to the implementation of the receiving module 910.

[0169] As an example of a software functional unit, the receiving module 910 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the receiving module 910 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0170] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0171] As an example of a hardware functional unit, the receiving module 910 may include at least one computing device, such as a server, etc. Alternatively, the receiving module 910 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0172] The multiple computing devices included in the receiving module 910 can be distributed in the same region or in different regions. The multiple computing devices included in the receiving module 910 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the receiving module 910 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0173] It should be noted that, in other embodiments, the receiving module 910 may be used to execute Figure 8 In any step of the method shown, the acquisition module 920 can be used to perform Figure 8 For any step in the method shown, the execution module 930 can be used to execute Figure 8 In any step of the method shown, the control module 940 can be used to perform Figure 8 The steps implemented by the receiving module 910, the acquisition module 920, the execution module 930 and the control module 940 can be specified as needed, and the steps implemented by the receiving module 910, the acquisition module 920, the execution module 930 and the control module 940 can be specified as needed. Figure 8 The different steps in the method shown are used to implement all functions of the access control terminal 900.

[0174] The present application also provides a computing device 1000. Fig.10 As shown, computing device 1000 includes: bus 1002, processor 1004, memory 1006 and communication interface 1008. Processor 1004, memory 1006 and communication interface 1008 communicate through bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 1000.

[0175] The bus 1002 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (eg, the memory 1006, the processor 1004, and the communication interface 1008).

[0176] The processor 1004 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0177] The memory 1006 may include a volatile memory, such as a random access memory (RAM). The memory 1006 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0178] The memory 1006 stores executable program codes, and the processor 1004 executes the executable program codes to respectively implement the functions of the aforementioned receiving module 910, the acquisition module 920, the execution module 930, and the control module 940, thereby implementing Figure 8 That is, the memory 1006 stores the method for executing Figure 8 Instructions for the method shown.

[0179] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0180] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0181] like Fig.11 As shown, the computing device cluster includes at least one computing device 1000. The memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same Figure 8 Instructions for the method shown.

[0182] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store a memory for executing Figure 8 In other words, a combination of one or more computing devices 1000 can jointly execute instructions for executing Figure 8 Instructions for the method shown.

[0183] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the access control terminal 900. That is, the instructions stored in the memory 1006 in different computing devices 1000 can implement the functions of one or more modules of the receiving module 910, the obtaining module 920, the executing module 930 and the controlling module 940.

[0184] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.12 A possible implementation is shown. Fig.12 As shown, two computing devices 1000A and 1000B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1006 in the computing device 1000A stores instructions for executing the functions of the receiving module 910 and the acquiring module 920. At the same time, the memory 1006 in the computing device 1000B stores instructions for executing the functions of the executing module 930 and the controlling module 940.

[0185] It should be understood that Fig.12 The functions of the computing device 1000A shown in FIG. 1000A may also be completed by multiple computing devices 1000. Similarly, the functions of the computing device 1000B may also be completed by multiple computing devices 1000.

[0186] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Fig.11 and Fig.12 The difference is that the memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same memory for executing Figure 8 Instructions for the method shown.

[0187] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store a memory for executing Figure 8 In other words, a combination of one or more computing devices 1000 can jointly execute instructions for executing Figure 8 Instructions for the method shown.

[0188] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes Figure 8 The method shown.

[0189] The present application also provides a computer-readable storage medium. The computer-readable storage medium may be any available medium that can be stored by a computing device or a host migration device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute Figure 8 The method shown.

[0190] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An access control method, characterized in that: The method comprises: receiving a target data packet, wherein the target data packet includes a value to be matched; Obtaining a target code of at least one rule in an access control list (ACL), wherein the target code includes a matching logic instruction and a matching item corresponding to each of the rules, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; Based on the matching item and the value to be matched, the matching logic instruction is executed to obtain a matching result of the rule corresponding to the value to be matched and the matching item; Based on the matching result, the target data packet is allowed or blocked from passing.

2. The method according to claim 1, characterized in that The value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

3. The method according to claim 1 or 2, characterized in that: Before receiving the target data packet, the method further includes: Obtaining the matching item; The target code is generated based on the matching logic instructions corresponding to the at least one rule and the matching items.

4. The method according to claim 3, characterized in that The matching item is a default value, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Based on the matching logic instruction of the at least one rule and the matching item, a default code is generated, wherein the default code indicates to skip executing the matching logic instruction.

5. The method according to claim 3, characterized in that: The matching item is a preset value, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Based on the matching logic instruction of the at least one rule and the matching item, a first judgment code is generated, wherein the first judgment code indicates whether the to-be-matched value is consistent with the matching item.

6. The method according to claim 3, characterized in that The matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and the generating the target code based on the matching logic instruction corresponding to the at least one rule and the matching item includes: Determine that the left endpoint is the minimum value of the to-be-matched value, and generate a second judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the second judgment code indicates whether the to-be-matched value is less than or equal to the right endpoint; or, Determine that the right endpoint is the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

7. The method according to any one of claims 1 to 6, characterized in that: The target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

8. An access control terminal, characterized in that: The access control terminal includes: A receiving module, used for receiving a target data packet, wherein the target data packet includes a value to be matched; An acquisition module, used to acquire a target code of at least one rule in an access control list ACL, wherein the target code includes a matching logic instruction and a matching item corresponding to each of the rules, wherein the matching item is used to determine whether the value to be matched matches the rule corresponding to the matching item; An execution module, configured to execute the matching logic instruction based on the matching item and the value to be matched, and obtain a matching result of a rule corresponding to the value to be matched and the matching item; The control module is used to allow or prevent the target data packet from passing based on the matching result.

9. The access control terminal according to claim 8, characterized in that: The value to be matched includes at least one of a protocol number, a source port, a source Internet Protocol IP address, a destination port, and a destination IP address.

10. The access control terminal according to claim 8 or 9, characterized in that: Before receiving the target data packet, the acquisition module is used to: Obtaining the matching item; The target code is generated based on the matching logic instructions corresponding to the at least one rule and the matching items.

11. The access control terminal according to claim 10, characterized in that: The matching item is a default value, and the acquisition module is used to: Based on the matching logic instruction of the at least one rule and the matching item, a default code is generated, wherein the default code indicates to skip executing the matching logic instruction.

12. The access control terminal according to claim 10, characterized in that: The matching item is a preset value, and the acquisition module is used to: Based on the matching logic instruction of the at least one rule and the matching item, a first judgment code is generated, wherein the first judgment code indicates whether the to-be-matched value is consistent with the matching item.

13. The access control terminal according to claim 10, characterized in that: The matching item is a preset interval, the preset interval includes a left endpoint and a right endpoint, and the acquisition module is used to: Determine that the left endpoint is the minimum value of the to-be-matched value, and generate a second judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the second judgment code indicates whether the to-be-matched value is less than or equal to the right endpoint; or, Determine that the right endpoint is the maximum value of the value to be matched, and generate a third judgment code based on the matching logic instruction of the at least one rule and the matching item, wherein the third judgment code indicates whether the value to be matched is greater than or equal to the left endpoint.

14. The access control terminal according to any one of claims 8 to 13, characterized in that: The target code of at least one rule in the ACL is generated by a runtime compilation JIT compiler according to the dictionary tree structure.

15. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 7.

16. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 7.

17. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 7.

Images