Data packet processing method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data packet processing method and system, and the method comprises the steps: obtaining a to-be-processed data packet; analyzing the data packet to obtain data identification information of the data packet; determining a corresponding target virtual firewall and a target matching rule of the target virtual firewall according to the data identification information; and processing the data packet based on the target virtual firewall and the target matching rule. According to the embodiment of the invention, a distributed processing scheme of the virtual firewall and the matching rule is adopted, so that service isolation, management flexibility and data security are enhanced while the processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a data packet processing method, a data packet processing system, an electronic device and a computer-readable storage medium. Background Art

[0002] In traditional network security architecture, firewalls are usually deployed as physical devices to protect the security of network boundaries through centralized data flow detection and forwarding. All data packets must be processed by the physical firewall, and the applicable rules are uniformly configured on the firewall and checked one by one. This method can meet basic needs at a certain scale, but as the number of users and departments increases, the disadvantages of this architecture gradually become apparent.

[0003] Configuring a large number of rules on a physical firewall will cause the system to be overloaded. Each data packet needs to match the rules one by one, resulting in a decrease in overall data processing efficiency, affecting network performance and user experience. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a method for processing a data packet, a system for processing a data packet, an electronic device, and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses a method for processing a data packet, the method comprising:

[0006] Get the data packet to be processed;

[0007] Analyzing the data packet to obtain data identification information of the data packet;

[0008] Determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information;

[0009] The data packet is processed based on the target virtual firewall and the target matching rule.

[0010] Optionally, before obtaining the data packet to be processed, the method further includes:

[0011] Create multiple virtual interfaces in the firewall application of the physical firewall;

[0012] In response to a creation operation based on a mapping rule, respectively corresponding virtual firewalls are created for the plurality of virtual interfaces, wherein the mapping rule indicates a corresponding relationship between the virtual interfaces and the virtual firewalls.

[0013] Optionally, after creating respective corresponding virtual firewalls for the plurality of virtual interfaces in response to the creation operation based on the mapping rule, the method further comprises:

[0014] Creating a respective virtual firewall process and matching rule for each virtual firewall, wherein the matching rule is a predefined rule for indicating that the virtual firewall process performs a specific processing operation under specific conditions;

[0015] A communication channel is established between the firewall application and the virtual firewall process.

[0016] Optionally, the analyzing the data packet to obtain data identification information of the data packet includes:

[0017] The data packet is analyzed to obtain the message type of the data packet.

[0018] Optionally, determining the corresponding target virtual firewall and a target matching rule of the target virtual firewall according to the data identification information includes:

[0019] When the message type is the first type, extracting first data packet forwarding information from the data packet;

[0020] Determine the target virtual firewall and the target matching rule according to the first data packet forwarding information;

[0021] The first data packet forwarding information includes at least one of the following:

[0022] User identification information, unicast address information, network address information, media access control information, transport layer protocol information, and port information.

[0023] Optionally, determining the corresponding target virtual firewall and a target matching rule of the target virtual firewall according to the data identification information includes:

[0024] When the message type is the second type, extracting second data packet forwarding information from the data packet;

[0025] Determine the target virtual firewall and the target matching rule according to the second data packet forwarding information;

[0026] The second data packet forwarding information includes at least one of the following:

[0027] User identification information, unicast address information, network address information, transport layer protocol information, and port information.

[0028] Optionally, the processing the data packet based on the target virtual firewall and the target matching rule includes:

[0029] The data packet is forwarded to the target virtual firewall through the communication channel and the virtual interface, so that the target virtual firewall process of the target virtual firewall processes the data packet according to the target matching rule.

[0030] The embodiment of the present invention further discloses a data packet processing system, the system comprising:

[0031] A data packet acquisition module, used to acquire data packets to be processed;

[0032] A data packet analysis module, used for analyzing the data packet to obtain data identification information of the data packet;

[0033] A virtual firewall and matching rule determination module, used to determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information;

[0034] The data packet processing module is used to process the data packet based on the target virtual firewall and the target matching rule.

[0035] Optionally, the system further comprises: a virtual interface creation module, configured to create a plurality of virtual interfaces in a firewall application of the physical firewall before the data packet acquisition module acquires the data packet to be processed;

[0036] The virtual firewall creation module is used to create virtual firewalls corresponding to the plurality of virtual interfaces in response to a creation operation based on a mapping rule, wherein the mapping rule represents a corresponding relationship between the virtual interface and the virtual firewall.

[0037] Optionally, the system further comprises: a process and rule creation module, configured to create a respective virtual firewall process and matching rule for each virtual firewall after the virtual firewall creation module creates respective corresponding virtual firewalls for the plurality of virtual interfaces in response to a creation operation based on a mapping rule, wherein the matching rule is a predefined rule for indicating that the virtual firewall process performs a specific processing operation under specific conditions;

[0038] The communication channel establishing module is used to establish a communication channel between the firewall application program and the virtual firewall process.

[0039] Optionally, the data packet analysis module is used to analyze the data packet to obtain the message type of the data packet.

[0040] Optionally, the virtual firewall and matching rule determination module includes:

[0041] A first extraction module, configured to extract first data packet forwarding information from the data packet when the message type is of the first type;

[0042] A first determination module, configured to determine the target virtual firewall and the target matching rule according to the first data packet forwarding information;

[0043] The first data packet forwarding information includes at least one of the following:

[0044] User identification information, unicast address information, network address information, media access control information, transport layer protocol information, and port information.

[0045] Optionally, the virtual firewall and matching rule determination module includes:

[0046] A second extraction module, configured to extract second data packet forwarding information from the data packet when the message type is the second type;

[0047] A second determination module, configured to determine the target virtual firewall and the target matching rule according to the second data packet forwarding information;

[0048] The second data packet forwarding information includes at least one of the following:

[0049] User identification information, unicast address information, network address information, transport layer protocol information, and port information.

[0050] Optionally, the data packet processing module is used to forward the data packet to the target virtual firewall through the communication channel and the virtual interface, so that the target virtual firewall process of the target virtual firewall processes the data packet according to the target matching rule.

[0051] An embodiment of the present invention further discloses an electronic device, comprising: one or more processors; and one or more machine-readable media storing instructions thereon, which, when executed by the one or more processors, enable the electronic device to execute the method for processing data packets as described above.

[0052] The embodiment of the present invention further discloses a computer-readable storage medium, wherein a computer program stored in the storage medium enables a processor to execute the method for processing a data packet as described above.

[0053] The embodiments of the present invention include the following advantages:

[0054] The data packet processing scheme provided by the embodiment of the present invention obtains the data packet to be processed, and then analyzes the data packet to obtain the data identification information of the data packet. Next, the corresponding target virtual firewall and the target matching rule of the target virtual firewall are determined according to the data identification information. Finally, the data packet is processed based on the target virtual firewall and the target matching rule.

[0055] The embodiment of the present invention disperses the processing task of each data packet to the target virtual firewall, and each virtual firewall only needs to match its own matching rules, thereby reducing the number of rule matches and reducing the burden on the firewall system. It can avoid the performance bottleneck of checking all rules one by one, and significantly improve the data processing efficiency. Each virtual firewall is allowed to independently configure matching rules, and the data packets are routed to different target virtual firewalls according to the data identification information, thereby avoiding the interference of permissions between departments or users. This independent rule set management method ensures better business isolation and enhances network security. Different departments and users can have customized virtual firewalls and matching rule configurations without the need for administrators to centrally manage all rules on a single physical firewall. Not only does it reduce the dependence on centralized firewall rules, but it also simplifies the rule configuration and management process and improves management flexibility. Since the matching rules of each virtual firewall are only for its specific data packets, the possibility of administrators seeing the permissions of other users or departments is effectively reduced, and the risk of excessive information exposure is avoided, thereby improving data security.

[0056] In summary, the embodiments of the present invention adopt a distributed processing solution of virtual firewalls and matching rules, which improves processing efficiency while achieving enhanced service isolation, management flexibility and data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 is a flowchart of a method for processing a data packet according to an embodiment of the present invention;

[0058] Figure 2 This is a working principle diagram of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention;

[0059] Figure 3 It is a schematic diagram of the packet sending and receiving principle of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention;

[0060] Figure 4 It is a schematic diagram of a creation process of a lightweight virtual firewall based on a visual network according to an embodiment of the present invention;

[0061] Figure 5 It is a schematic diagram of a visual networking message data processing flow of a lightweight virtual firewall based on a visual networking according to an embodiment of the present invention;

[0062] Figure 6 It is a schematic diagram of the system architecture of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention;

[0063] Figure 7 This is a data flow diagram of a lightweight virtual firewall based on a visual network according to an embodiment of the present invention;

[0064] Figure 8 It is a structural block diagram of a data packet processing system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] The data packet processing scheme proposed in the embodiment of the present invention realizes efficient and secure data flow management through distributed processing of virtual firewalls. First, the data packet to be processed is received and its data identification information is extracted to determine the applicable target virtual firewall and the corresponding target matching rule. The data packet is then directed to the target virtual firewall and processed in the independent target matching rule environment of the target virtual firewall. In this way, the performance bottleneck of matching rules one by one on a centralized physical firewall is avoided, and the processing efficiency is significantly improved. At the same time, each virtual firewall is independently configured for a specific department or user, ensuring business isolation, reducing the exposure of permission information, and enhancing management flexibility and data security.

[0067] Reference Figure 1 , shows a flowchart of a method for processing a data packet according to an embodiment of the present invention. The method for processing a data packet can be applied to a firewall system, referred to as a system. The method for processing a data packet can specifically include the following steps:

[0068] Step 101, obtaining a data packet to be processed.

[0069] In an embodiment of the present invention, the firewall system acquires data packets flowing through the network and adds them to a queue to be processed. The firewall system usually needs to capture data packets from the network in real time, and these data packets may come from different user devices, applications or network nodes. The process of acquiring data packets is actually the initial link of firewall data packet processing. The main goal of this link is to ensure that all communication data passing through the network can be detected by the firewall for further analysis and processing.

[0070] There are many specific ways to obtain data packets. For example, the system may adopt a passive monitoring method to copy the data packets to the firewall system through port mirroring, switch or router configuration. It can also be an active method, such as setting the firewall system at the gateway position as the only way for network communication to directly receive all data streams. In this step, the firewall system does not conduct in-depth analysis and processing of the data packets, but simply ensures that the data packets are captured and passed to the next step of the processing flow.

[0071] For example, suppose an employee's computer is accessing an external website in a corporate network. When the computer sends a data packet request, the data packet is routed to the firewall system in the network. The firewall system captures the data packet and adds it to the queue for processing. At this point, the content of the data packet has not been analyzed, and the firewall has not decided whether to release or block the data packet. The system's task is only to ensure that the data packet successfully enters the analysis process.

[0072] Step 102: Analyze the data packet to obtain data identification information of the data packet.

[0073] In an embodiment of the present invention, after a data packet is successfully captured, the system will enter the analysis phase to extract the data identification information of the data packet. The data identification information refers to the relevant information in the data packet used to identify its source and destination and the data packet itself, such as the source IP address, destination IP address, source port, destination port, data packet type and protocol type. The purpose of analyzing the data packet is to extract key information such as the data identification information so as to match the applicable virtual firewall and matching rules in the next step.

[0074] Data identification information is crucial for subsequent virtual firewalls and rule matching. By extracting and parsing these data identification information, the system can identify the source, purpose, and type of the data packet, thereby understanding the basic characteristics of the data packet. The system will use deep packet inspection, fast packet analysis and other technologies to parse the packet header and payload information to ensure the accuracy of the data identification information. In this step, the firewall system will determine the initial classification of the data packet to help determine the applicable virtual firewall and matching rules.

[0075] For example: Continuing with the above example, after the firewall system captures the data packet of the employee's computer accessing the external website, it begins to analyze its data identification information. The system extracts the source IP (the IP of the employee's computer), the destination IP (the IP of the website server), the source port (the port used by the employee's computer to send the request), the destination port (the standard port 80 of the Hypertext Transfer Protocol (HTTP)), and the protocol type (Transmission Control Protocol (TCP)) from the data packet. This data identification information will be used to identify the type, flow direction, and destination of the data packet, thereby providing a basis for matching the virtual firewall.

[0076] Step 103: Determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information.

[0077] In the embodiment of the present invention, after determining the data identification information, the system uses the data identification information to find the target virtual firewall and its corresponding target matching rule. The role of the virtual firewall is similar to dividing independent firewall instances for different user groups, network segments or business needs. In this way, the traffic of different departments or users can be controlled by the applicable virtual firewall respectively, ensuring the flexibility and security of network access.

[0078] Specifically, the system will find the applicable virtual firewall based on the source, destination, and type of the data packet. For example, the system may match a specific virtual firewall based on the IP address range or protocol type of the data packet, and apply the corresponding matching rules in the virtual firewall. These matching rules can include allow, deny, redirect, or other security policies to apply different security controls to different data packets.

[0079] For example: Assume that different virtual firewalls are defined in the enterprise network to isolate department traffic. External requests from employee computers will be assigned to the "employee access to external resources" virtual firewall by the system. Based on the IP address and destination IP address of the employee computer, the system determines that the data packet belongs to the traffic category of employee access to external resources, and then calls the matching rules of the virtual firewall. At this time, the system will decide whether to allow employees to access the specific website and whether further operations such as traffic recording are required based on the set matching rules.

[0080] Step 104: Process the data packet based on the target virtual firewall and the target matching rule.

[0081] In an embodiment of the present invention, the system performs corresponding processing on the data packet according to the target matching rules in the target virtual firewall. Matching rules can be regarded as a combination of a set of conditions and behaviors, which are used to indicate the processing measures that the system should take in a specific situation. For example, matching rules can determine whether to allow a data packet to pass, prevent it from being sent to the target network, or modify its content. The core of this step is to ensure that each data packet is properly processed according to its specific virtual firewall policy to achieve security goals such as isolation, monitoring, or interception.

[0082] The specific execution of this step includes rule matching, behavior execution, and logging. For example, the system checks whether the data packet meets the predefined target matching rules. If it meets the rules, the corresponding policy behavior is executed, such as release, blocking, or redirection to another node; if it does not meet the rules, the system may directly discard the data packet or record the violation for auditing.

[0083] For example: Assume that the system detects that the website that the employee's computer is trying to access is on the company's blacklist. According to the matching rules in the "employee access to external resources" virtual firewall, the system finds that the destination IP of the data packet conflicts with the blacklist rules, so it decides to block the transmission of the data packet and generate a log. If the data packet meets the rules (that is, the external website visited is in the list of allowed access), the system allows the data packet to pass and records the transmission information of the data packet for future review or audit.

[0084] The data packet processing scheme provided by the embodiment of the present invention obtains the data packet to be processed, and then analyzes the data packet to obtain the data identification information of the data packet. Next, the corresponding target virtual firewall and the target matching rule of the target virtual firewall are determined according to the data identification information. Finally, the data packet is processed based on the target virtual firewall and the target matching rule.

[0085] The embodiment of the present invention disperses the processing task of each data packet to the target virtual firewall, and each virtual firewall only needs to match its own matching rules, thereby reducing the number of rule matches and reducing the burden on the firewall system. It can avoid the performance bottleneck of checking all rules one by one, and significantly improve the data processing efficiency. Each virtual firewall is allowed to independently configure matching rules, and the data packets are routed to different target virtual firewalls according to the data identification information, thereby avoiding the interference of permissions between departments or users. This independent rule set management method ensures better business isolation and enhances network security. Different departments and users can have customized virtual firewalls and matching rule configurations without the need for administrators to centrally manage all rules on a single physical firewall. Not only does it reduce the dependence on centralized firewall rules, but it also simplifies the rule configuration and management process and improves management flexibility. Since the matching rules of each virtual firewall are only for its specific data packets, the possibility of administrators seeing the permissions of other users or departments is effectively reduced, and the risk of excessive information exposure is avoided, thereby improving data security.

[0086] In summary, the embodiments of the present invention adopt a distributed processing solution of virtual firewalls and matching rules, which improves processing efficiency while achieving enhanced service isolation, management flexibility and data security.

[0087] In an exemplary embodiment of the present invention, an implementation method before obtaining a data packet to be processed is to create multiple virtual interfaces in a firewall application of a physical firewall; in response to a creation operation based on a mapping rule, create corresponding virtual firewalls for the multiple virtual interfaces. The mapping rule represents the correspondence between the virtual interface and the virtual firewall. In this implementation method, before the processing flow of the data packet begins, the system creates multiple virtual interfaces in the firewall application of the physical firewall, and creates a corresponding virtual firewall for each virtual interface. This process is based on the mapping rules to establish a correspondence between the virtual interface and the virtual firewall, ensuring that the data traffic of each virtual interface can be directed to a specific virtual firewall for processing. This architecture enables different traffic to be processed independently in their respective virtual firewalls, thereby improving the security, isolation and management efficiency of the system.

[0088] In actual application, multiple virtual interfaces are created in the firewall application of the physical firewall. These virtual interfaces are used as logical network interfaces to distribute data traffic from different sources to different virtual firewalls. Each virtual interface can represent a different network partition or user group, such as different departments within the enterprise (such as the finance department, R&D department, etc.) or different subnets. After this virtual interface is created, the system can divide data packets from the physical network port to the virtual interface as needed to achieve isolated management of different data packets. The virtual interface in this process is a logical interface and does not require additional physical port support. This method not only saves hardware costs, but also improves the flexibility of system configuration.

[0089] When creating a virtual interface, the system responds to the creation operation based on the mapping rules and creates a corresponding virtual firewall for each virtual interface. As an independent protection instance, the virtual firewall can run on the physical firewall, and its internal rules and policies can be configured independently of other virtual firewalls. Mapping rules are rules used to indicate the relationship between the virtual interface and the virtual firewall, ensuring that the data traffic of each virtual interface can only be processed in the corresponding virtual firewall. These mapping rules can be set in a variety of ways. For example, the corresponding relationship between the virtual interface and the virtual firewall can be defined by conditions such as IP address range, port number or protocol type. This refined rule can be flexibly adjusted according to changes in the network structure to achieve precise traffic control.

[0090] For example, suppose that in a company's network, a physical firewall is used to protect the network security of different departments within the company. The company's network administrator creates three virtual interfaces for the Finance Department, R&D Department, and Human Resources Department in the firewall application. According to the mapping rules, the network traffic of the Finance Department is mapped to Virtual Firewall 1, the traffic of the R&D Department is mapped to Virtual Firewall 2, and the traffic of the Human Resources Department is mapped to Virtual Firewall 3. The mapping rules between these virtual interfaces and virtual firewalls may be determined based on the IP segments used by the departments. For example, the IP segment of the Finance Department is 192.168.1.0 / 24, which is mapped to Virtual Firewall 1; the IP segment of the R&D Department is 192.168.2.0 / 24, which is mapped to Virtual Firewall 2. The system creates each virtual interface and the corresponding virtual firewall according to the mapping rules, thereby ensuring that the traffic of the Finance Department is only processed in Virtual Firewall 1, without affecting the data flow of the R&D Department or the Human Resources Department. This configuration not only isolates the traffic of each department, but also ensures the independent security policies of each department.

[0091] In the embodiment of the present invention, by configuring a corresponding virtual firewall for each virtual interface, the network traffic of each department or user group is processed independently, and the security policies of different departments can be configured independently in their respective virtual firewalls. This isolation ensures that even if the protection policy of one department changes, it will not affect the network traffic of other departments, thereby improving business isolation and network security. The management of the firewall is made more flexible, and the administrator can configure the security rules of each virtual firewall separately according to the needs of different users or departments, without the need to configure them uniformly on a physical firewall. In addition, by defining the relationship between the virtual interface and the virtual firewall through mapping rules, the system can flexibly adjust the mapping rules when the network topology changes, thereby avoiding the complexity of large-scale reconstruction of the network structure. After each virtual interface is associated with an independent virtual firewall, the processing of data traffic can be run in parallel on different virtual firewalls, avoiding the performance bottleneck of matching rules one by one on a single physical firewall, thereby improving the efficiency of data packet processing. Since each virtual firewall only needs to process the amount of data related to its own virtual interface, the overall load of the physical firewall is reduced and the response speed of the system is improved. The mapping rules ensure that the data packets of each virtual interface can only flow to the corresponding virtual firewall, thereby avoiding the risk of cross-access or leakage of data from different departments. Administrators can only manage the rule configuration of a specific virtual firewall and will not be able to view data flow information from other departments, thus protecting the data privacy of each department.

[0092] In an exemplary embodiment of the present invention, after creating respective virtual firewalls for multiple virtual interfaces in response to a creation operation based on a mapping rule, an implementation method is to create respective virtual firewall processes and matching rules for each virtual firewall, the matching rules being used to indicate predefined rules for the virtual firewall process to perform specific processing operations under specific conditions; and establish a communication channel between the firewall application and the virtual firewall process. In this implementation, after creating respective virtual firewalls for multiple virtual interfaces, the system continues to further optimize the configuration of each virtual firewall. Specifically, an independent virtual firewall process and corresponding matching rules are created for each virtual firewall to ensure that the security policies and processing operations of each virtual firewall can be executed flexibly and independently. Then, the system establishes a communication channel between the firewall application and these virtual firewall processes to ensure that control and data flows can be effectively transmitted, thereby achieving effective data protection and real-time management of policies.

[0093] In actual application, an independent virtual firewall process is created for each virtual firewall, making it a logically independent working unit. These virtual firewall processes run separately in the system, and each process is responsible for managing the security policy and data processing operations of a virtual firewall. This design ensures that the processing between different virtual firewalls will not interfere with each other. Even in the case of high traffic or multiple departments transmitting data at the same time, each virtual firewall process can run efficiently in an independent environment and will not be affected by the system load or the behavior of other virtual firewalls.

[0094] A matching rule is a set of predefined conditions that instructs the virtual firewall process to take processing actions under specific conditions, such as allowing, blocking, or logging a certain type of data packet. The purpose of this matching rule is to ensure that the data packets flowing through each virtual firewall can be properly processed in accordance with the security policy. The matching rule can be set based on conditions such as IP address, port, protocol type, data source, etc., thereby ensuring the refinement of security policies. Different matching rules can be configured for different virtual firewalls to meet the security needs of different departments or users.

[0095] The communication channel is the key path for the firewall application to interact with the virtual firewall process. The establishment of this communication channel enables centralized management and control of the virtual firewall process. For example, when a security incident occurs, the matching rules of the virtual firewall process can be updated remotely, or log information can be obtained in real time. The communication channel also ensures seamless transmission of data flows between the virtual interface and the virtual firewall.

[0096] For example, in a large enterprise network, the technical department configures multiple virtual interfaces and corresponding virtual firewalls according to different business needs. For the virtual firewall of the finance department, the system creates an independent virtual firewall process and configures strict matching rules to block all packets from untrusted IP segments, while allowing finance personnel to access specific websites such as banks and payments. The virtual firewall of the R&D department corresponds to another virtual firewall process, and the matching rules mainly allow access to technology-related resources and strictly restrict external access. With the support of the communication channel between the firewall application and the virtual firewall process, the administrator can centrally manage these matching rules and monitor the running status of the virtual firewall process in real time to ensure that the access rights of the finance and R&D departments are independent and comply with security policies.

[0097] In the embodiment of the present invention, different virtual firewalls can independently define their own matching rules and flexibly adjust them without affecting other virtual firewalls, meeting the diverse needs of multiple departments and multiple users. By making the operation of each virtual firewall independent of its own virtual firewall process, the system is more stable under high concurrency or high load conditions, reducing the risk of system crash or performance degradation. In addition, this design facilitates the system to add new virtual interfaces or virtual firewalls when the business is expanded without interfering with the original configuration. Independent matching rules enable virtual firewalls to achieve refined data control and ensure that different data types are processed in a personalized manner. For example, more stringent matching rules can be configured for sensitive data while allowing regular access data to pass smoothly. This refined control improves the security of the system and optimizes the transmission efficiency of data streams. The establishment of a communication channel enables the firewall application to centrally manage each virtual firewall process, thereby achieving real-time security policy updates, log monitoring and exception handling. This centralized management not only improves the speed at which the system responds to security incidents, but also reduces management complexity, which helps to maintain the efficient operation of the overall system.

[0098] In an exemplary embodiment of the present invention, an implementation method of analyzing a data packet to obtain data identification information of the data packet is to analyze the data packet to obtain the message type of the data packet. In this implementation, the system obtains the message type of the data packet by analyzing the content of the data packet, and on this basis more accurately matches and executes specific security rules in subsequent processes. The core of this analysis step is to extract the message type of the data packet, identify its communication nature and data content by parsing the data packet header and related fields, so as to specify corresponding protection measures and transmission strategies for it.

[0099] In actual applications, the message type of a data packet is one of the important identification information of the data packet. It not only indicates the basic communication properties of the data packet, but also reveals its transmission purpose and communication mode. For example, the TCP message type is often used for reliable data transmission, such as web page loading, file transfer, etc., to ensure the accuracy and order of data packet arrival. Therefore, analyzing the data packet to obtain its message type helps the system distinguish different types of data packets, so as to configure special security rules for different business needs and optimize traffic processing efficiency and transmission security.

[0100] When analyzing the message type of a data packet, the system will start with the header information of the data packet. The packet header contains the protocol field, which can directly indicate the message type of the data packet. For example, when the IP protocol field value is "6", it indicates the TCP protocol.

[0101] For example: If the firewall captures a data packet, the system will first analyze its header information and find that the protocol field value is 6, confirming that it is a TCP message type. Further inspection finds that its destination port is 80, which indicates that the packet is an HTTP request, which may come from an employee accessing a web page. At this point, the system can execute specific matching rules based on the HTTP message type, such as checking whether allowed web resources are accessed, or applying content filtering rules to prevent non-compliant access. Through these detailed message type analyses, the firewall system can more finely manage security policies for different communication types.

[0102] By analyzing the message type of a data packet, the embodiment of the present invention can formulate a more sophisticated security policy for different types of data packets. This policy can set different matching rules for message types such as TCP, so that the system has stronger recognition and response capabilities when dealing with different types of attacks. After identifying the message type, the system can process the data packet more efficiently, reducing unnecessary rule matching and resource consumption. Message type analysis enables the firewall to flexibly respond to different types of business needs. Different policies can be provided for specific message types in a targeted manner to adapt to diverse network business needs. By identifying the message type and applying appropriate security policies to it, unnecessary data blocking is avoided and the reasonable allocation of network resources is guaranteed.

[0103] In an exemplary embodiment of the present invention, an implementation method of determining the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information is that, when the message type is the first type, the first data packet forwarding information is extracted from the data packet; the target virtual firewall and the target matching rule are determined according to the first data packet forwarding information; wherein the first data packet forwarding information includes at least one of the following: user identification information, unicast address information, network address information, media access control information, transport layer protocol information, port information. In this implementation, the system determines the target virtual firewall and the corresponding matching rule according to the message type by analyzing the content of the data packet, thereby realizing accurate data flow forwarding and security processing. Specifically, when the message type of the data packet meets specific requirements (such as HTTP request, etc.), the system extracts the first data packet forwarding information from the data packet, and determines the target virtual firewall and matching rule of the data packet according to the first data packet forwarding information. The first data packet forwarding information is a set of specific fields or parameters, including but not limited to user identification information, unicast address, network address, media access control information (such as (Media Access Control, referred to as MAC) address), transport layer protocol information and port information, etc., which can help the system identify the source, destination and communication protocol of the data packet.

[0104] In actual application, the identification of message type is a key step. When the system receives a data packet, it first determines the message type of the data packet. When the message type meets the preset conditions, the system starts to extract the first data packet forwarding information. The extraction process is mainly completed from the header and transport layer information of the data packet. Taking HTTP request as an example, the system can extract forwarding information including the user identification information of the requester, the unicast address and port number of the request from the data packet. This information helps the system determine the specific transmission requirements and business needs of the data packet.

[0105] After extracting the forwarding information of the first data packet, the system uses this information to determine the target virtual firewall of the data packet and the corresponding matching rules. For example, based on the user identification information, the system can route the data packet to the virtual firewall corresponding to a specific user or department; based on the unicast address information, the system can determine the target device or network location of the data packet to decide which virtual firewall to process it through. Assuming that a data packet contains user identification information of a specific department, the system can forward it to the virtual firewall of the department to apply matching rules that comply with the security policy of the department. Matching rules are used to further instruct the virtual firewall on how to process the data packet, and matching rules can include multiple policies such as access control and content review. For example, the system can identify whether the data packet allows external access based on the port number, and make processing decisions to allow, deny, or record based on the matching rules.

[0106] For example: Assume that a data packet in a company's internal network comes from a user in the finance department, and the user's request type is HTTP. The system first determines that the message type of the data packet is HTTP, and then extracts the first data packet forwarding information, which contains user identification information, destination unicast address, and HTTP protocol port. Based on this information, the system recognizes that the data packet comes from the finance department and should be assigned to the finance department's virtual firewall to ensure data isolation and security. The system further confirms the location of the target server based on the unicast address and selects the appropriate port matching rule to ensure the legitimacy of the data packet. Through these operations, the system ensures secure data forwarding and policy consistency.

[0107] The embodiment of the present invention ensures that the system has higher accuracy in determining the target virtual firewall and the target matching rules by extracting multiple forwarding information from the data packet. Whether based on user identification information or network address information, the system can accurately forward the data packet to the target virtual firewall, ensuring that the traffic of different departments or user groups is processed independently, reducing the risk of mis-forwarding. By extracting multiple forwarding information, the system can flexibly configure the matching rules of the virtual firewall according to different business needs and security requirements. By extracting forwarding information only on data packets that meet specific conditions, unnecessary data packet analysis processes are avoided and the consumption of system resources is reduced. At the same time, by accurately matching the target virtual firewall and the target matching rules, the system reduces redundant data packet inspection steps, improves the overall efficiency of data processing, and thus optimizes network performance.

[0108] In an exemplary embodiment of the present invention, another implementation method of determining the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information is that when the message type is the second type, the second data packet forwarding information is extracted from the data packet; the target virtual firewall and the target matching rule are determined according to the second data packet forwarding information; wherein the second data packet forwarding information includes at least one of the following: user identification information, unicast address information, network address information, transport layer protocol information, port information. In this implementation method, the system further extracts the second data packet forwarding information according to the situation that the message type of the data packet is the second type, so as to accurately identify the attributes of the data packet and determine the appropriate target virtual firewall and the corresponding target matching rule. Different from the first type of message (such as HTTP, etc.), the second type of message usually involves other transmission requirements and requires special traffic control and policy management.

[0109] In actual application, when the system receives the second type of data packet, it will first identify its message type, such as multicast traffic or high-frequency real-time data packet. Next, the system extracts the second data packet forwarding information from the data packet. The second data packet forwarding information may include user identification information, unicast address information, network address information, transport layer protocol information, and port information. These information fields may be slightly different in different message types, and the specific content is determined by the actual application scenario of the data packet.

[0110] By extracting the second data packet forwarding information, the system can accurately match the target virtual firewall of the data packet. At the same time, through the port or transport layer protocol in the second data packet forwarding information, the system can further select a target rule that matches the data packet.

[0111] For example: Assume that the conference system in a company needs to provide real-time video stream data to all employees. The message type of the video stream data packet is identified as a multicast type (second type), and the system then extracts the second data packet forwarding information. This second data packet forwarding information may contain the user ID of the initiator of the video stream, the multicast address and port information of the video stream, etc. The system can select an appropriate target virtual firewall (such as a specially configured video stream firewall) to ensure that the video traffic is isolated in a specified network area and does not interfere with other business traffic. Furthermore, through the port information, the system can apply special video stream transmission rules, such as increasing the transmission bandwidth or setting a lower latency strategy to ensure the continuity and quality of the video stream. In this case, through the combined application of the target virtual firewall and the target matching rule, the data packets of the video stream are managed more appropriately, which not only guarantees the real-time communication needs, but also realizes the isolation of other business traffic.

[0112] By identifying the second type of data packet and extracting the second data packet forwarding information, the system of the embodiment of the present invention can realize the precise management of special data packets such as multicast traffic. This refined traffic management effectively avoids the mutual interference between different types of business traffic, and ensures that various types of traffic receive the most suitable policy support in the virtual firewall, especially for data with high real-time requirements. By identifying the message type and characteristic field of the data packet, the system can divide different data packets into different virtual firewalls for isolation, and apply matching rules based on demand. It not only improves the data processing efficiency, but also effectively guarantees the security of multicast data or real-time streams.

[0113] In an exemplary embodiment of the present invention, an implementation method for processing data packets based on a target virtual firewall and a target matching rule is to forward the data packet to the target virtual firewall through a communication channel and a virtual interface so that the target virtual firewall process of the target virtual firewall processes the data packet according to the target matching rule. In this implementation, the system accurately forwards the data packet to the specified target virtual firewall through the communication channel and the virtual interface, thereby ensuring that the target virtual firewall process can further process the data packet according to the target matching rule. This method combines the functions of the communication channel and the virtual interface to guide the data packet to the appropriate firewall instance in an efficient and stable manner, avoiding unnecessary traffic interference and improving the performance and security of the system. After receiving the data packet, the target virtual firewall process can perform multi-level operations on the data packet according to the preset target matching rules, including permission checking, content filtering, data auditing, and forwarding control.

[0114] After the data packet arrives at the communication channel, the system forwards it to the corresponding target virtual firewall according to the configuration information of the virtual interface. The communication channel here is equivalent to a secure transmission path, ensuring that the data packet is isolated and transmitted between different virtual firewalls of the physical firewall, and will not be mixed with other business traffic. The virtual interface is responsible for identifying each virtual firewall instance. Forwarding data packets through the virtual interface can accurately locate a specific virtual firewall, thereby achieving clear distribution of data traffic.

[0115] In the target virtual firewall, the target virtual firewall process performs refined processing on data packets according to the target matching rules. The target matching rules cover various traffic control and data inspection requirements, and are applicable to a variety of network environments and security requirements. For example, the target matching rules can include IP address filtering, port control, protocol restrictions, etc., so that the corresponding security policies can be flexibly applied according to the characteristics of the data packet. This multi-level rule design allows the system to implement specific filtering and inspection on data packets, ensuring that only data that meets the requirements can pass through the firewall, while intercepting traffic that does not meet the security requirements, further improving network security.

[0116] For example: Suppose a company wants to strictly control the internal data flow of the finance department to prevent unauthorized data packets from accessing its private network. With this implementation, the company sets up a virtual firewall for the finance department on the physical firewall and configures strict matching rules for the virtual firewall. First, the data packet of the finance department is directed to the virtual firewall of the finance department through the communication channel. Then, through the virtual interface of the virtual firewall, the data packet enters the virtual firewall process of the finance department. The process processes the data packet according to the target matching rules, such as IP address filtering, port restriction, and access permission control. If the data packet meets these security requirements, it is allowed to be forwarded to the network of the finance department, otherwise it will be blocked or recorded in the log. This process ensures the security and isolation of financial data while providing strict protection for external data packets.

[0117] In the embodiment of the present invention, through the communication channel and the virtual interface, the system can ensure that the data packet is accurately guided to the target virtual firewall and the target matching rules are applied. Clear traffic separation is achieved between different virtual firewalls to ensure the accuracy of data packet processing. The system can design special virtual firewalls for different business departments, user groups or network requirements, and apply diversified matching rules, so as to flexibly meet the needs of various scenarios. Due to the use of communication channels, data packets are highly isolated during transmission, avoiding the risk of data packet leakage or tampering. At the same time, the configuration of the virtual interface ensures that the data packet enters the correct virtual firewall, realizes strict access control, and thus improves the security and reliability of the system. By allocating data packets to different virtual firewalls, the system can effectively avoid over-reliance on the resources of the physical firewall and reduce its load. At the same time, through the distributed processing of the virtual firewall process, the transmission and response of the data packet can be accelerated and the processing delay can be reduced.

[0118] Based on the above description of the embodiment of a method for processing a data packet, a lightweight virtual firewall based on a visual network is introduced below. Figure 2 , showing a working principle diagram of a lightweight virtual firewall based on a visual network according to an embodiment of the present invention. The lightweight virtual firewall based on the visual network generates multiple virtual firewalls (vfw) on the visual network firewall (physical firewall) through virtual technology. Each virtual firewall has an independent configuration and is managed by an independent administrator. The traffic is isolated and does not affect each other. The virtual firewall is located between user 1, user 2 and server 1, server 2. The virtual firewall is different from the IP firewall. The virtual firewall is not bound to the physical interface or virtual local area network (Virtual Local Area Network, referred to as VLAN).

[0119] Reference Figure 3 , shows a schematic diagram of the packet receiving and sending principle of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention. The physical firewall / root wall receives the packet, and then the received data packet is diverted to the corresponding virtual firewall through the flow classification module, and then the virtual firewall sends the data packet according to the matching rules.

[0120] Reference Figure 4 , showing a schematic diagram of the creation process of a lightweight virtual firewall based on visual networking in an embodiment of the present invention.

[0121] Step 401, start the firewall main program of the physical firewall.

[0122] Step 402: Create multiple virtual interfaces according to configuration requirements.

[0123] Step 403: Create multiple virtual firewall processes with the same functions.

[0124] Each virtual firewall process can be bound to a corresponding virtual interface and receive data packets from the virtual interface to implement the virtual firewall function.

[0125] Step 404, establishing a communication channel between the firewall main program and the virtual firewall process.

[0126] Reference Figure 5 , showing a schematic diagram of a visual networking message data processing flow of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention.

[0127] Step 501, the physical firewall / root wall receives visual network message data.

[0128] Step 502, determine whether the visual networking message data is a visual networking control message.

[0129] If the visual networking message data is a visual networking control message, execute step 503; if the visual networking message data is not a visual networking control message, execute step 504.

[0130] Step 503, the visual networking protocol stack of the physical firewall processes the visual networking message data.

[0131] Step 504, extracting the message type of the visual network message data.

[0132] Step 505, determining whether the message type is an Ethernet message.

[0133] If the message type is an Ethernet message, execute step 506 ; if the message type is not an Ethernet message, execute step 507 .

[0134] Step 506, extract the visual network unicast address, MAC address, IP address, transport layer protocol and port number.

[0135] Step 508, matching the virtual firewall, and obtaining the firewall identifier of the virtual firewall.

[0136] Step 509, determine whether the virtual firewall rule is matched.

[0137] If the virtual firewall rule is matched, step 510 is executed; if the virtual firewall rule is not matched, step 511 is executed.

[0138] Step 510, transfer the visual network message data to the virtual firewall for processing through the virtual interface.

[0139] Step 511, process the visual network message data through the physical firewall.

[0140] Step 507, determine whether the message type is an IP message.

[0141] If the message type is an IP message, execute step 512; if the message type is not an IP message, execute step 511.

[0142] Step 512: extract the visual network unicast address, IP address, transport layer protocol and port number. Then execute step 508.

[0143] Reference Figure 6 , showing a schematic diagram of the system architecture of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention.

[0144] The lightweight virtual firewall is deployed in the physical firewall and connected to two or more core servers. Each core server is also connected to a video router. The video router can connect to video network terminals and / or video network servers, such as application servers and content servers.

[0145] Reference Figure 7 , showing a data flow diagram of a lightweight virtual firewall based on visual networking according to an embodiment of the present invention.

[0146] The security control (administrator) sends the mapping virtual firewall rules (mapping rules) and each virtual firewall rule (matching rules) to the firewall master process (firewall application). The firewall master process creates a virtual firewall process according to the mapping rules, and configures rules for each virtual firewall process, specifically configuring matching rules. When the firewall master process receives a message, if the received message is a control message, the control message protocol stack of the physical firewall processes the control message. If the received message matches the virtual firewall rule (matching rule), it is sent to the virtual firewall for processing. Specifically, the firewall master process sends the message to the virtual firewall through the virtual interface, and the virtual firewall process processes the message.

[0147] It should be noted that mapping rules and matching rules can be manually configured according to deployment needs. If no virtual firewall is created in the physical firewall or no virtual firewall rules are configured, all business data is processed by the firewall master process of the physical firewall. After the virtual firewall rules are configured, the business data of different users can be diverted to different virtual firewalls for processing according to the diversion rules, without interfering with each other. Moreover, administrators with permissions for a certain virtual firewall can only see the data information of this virtual firewall and cannot obtain information from other virtual firewalls. In actual application, the diversion rules can be used for diversion based on the source unicast address in the visual networking protocol.

[0148] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0149] Reference Figure 8 , shows a structural block diagram of a data packet processing system according to an embodiment of the present invention. The data packet processing system may specifically include the following modules.

[0150] The data packet acquisition module 81 is used to acquire the data packet to be processed;

[0151] A data packet analysis module 82, used for analyzing the data packet to obtain data identification information of the data packet;

[0152] A virtual firewall and matching rule determination module 83, used to determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information;

[0153] The data packet processing module 84 is used to process the data packet based on the target virtual firewall and the target matching rule.

[0154] In an exemplary embodiment of the present invention, the system further comprises: a virtual interface creation module, which is used to create a plurality of virtual interfaces in a firewall application of the physical firewall before the data packet acquisition module 81 acquires the data packet to be processed;

[0155] The virtual firewall creation module is used to create virtual firewalls corresponding to the plurality of virtual interfaces in response to a creation operation based on a mapping rule, wherein the mapping rule represents a corresponding relationship between the virtual interface and the virtual firewall.

[0156] In an exemplary embodiment of the present invention, the system further comprises: a process and rule creation module, which is used to create a respective virtual firewall process and matching rule for each virtual firewall after the virtual firewall creation module creates respective corresponding virtual firewalls for the plurality of virtual interfaces in response to a creation operation based on a mapping rule, wherein the matching rule is a predefined rule for indicating that the virtual firewall process performs a specific processing operation under specific conditions;

[0157] The communication channel establishing module is used to establish a communication channel between the firewall application program and the virtual firewall process.

[0158] In an exemplary embodiment of the present invention, the data packet analysis module 82 is used to analyze the data packet to obtain the message type of the data packet.

[0159] In an exemplary embodiment of the present invention, the virtual firewall and matching rule determination module 83 includes:

[0160] A first extraction module, configured to extract first data packet forwarding information from the data packet when the message type is of the first type;

[0161] A first determination module, configured to determine the target virtual firewall and the target matching rule according to the first data packet forwarding information;

[0162] The first data packet forwarding information includes at least one of the following:

[0163] User identification information, unicast address information, network address information, media access control information, transport layer protocol information, and port information.

[0164] In an exemplary embodiment of the present invention, the virtual firewall and matching rule determination module 83 includes:

[0165] A second extraction module, configured to extract second data packet forwarding information from the data packet when the message type is the second type;

[0166] A second determination module, configured to determine the target virtual firewall and the target matching rule according to the second data packet forwarding information;

[0167] The second data packet forwarding information includes at least one of the following:

[0168] User identification information, unicast address information, network address information, transport layer protocol information, and port information.

[0169] In an exemplary embodiment of the present invention, the data packet processing module 84 is used to forward the data packet to the target virtual firewall through the communication channel and the virtual interface, so that the target virtual firewall process of the target virtual firewall processes the data packet according to the target matching rule.

[0170] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0171] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0172] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0173] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0176] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0177] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0178] The above is a detailed introduction to a data packet processing method and a data packet processing system provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for processing a data packet, characterized in that: The method comprises: Get the data packet to be processed; Analyzing the data packet to obtain data identification information of the data packet; Determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information; The data packet is processed based on the target virtual firewall and the target matching rule.

2. The method according to claim 1, characterized in that Before obtaining the data packet to be processed, the method further includes: Create multiple virtual interfaces in the firewall application of the physical firewall; In response to a creation operation based on a mapping rule, respectively corresponding virtual firewalls are created for the plurality of virtual interfaces, wherein the mapping rule indicates a corresponding relationship between the virtual interfaces and the virtual firewalls.

3. The method according to claim 2, characterized in that After creating respective corresponding virtual firewalls for the plurality of virtual interfaces in response to the creation operation based on the mapping rule, the method further includes: Creating a respective virtual firewall process and matching rule for each virtual firewall, wherein the matching rule is a predefined rule for indicating that the virtual firewall process performs a specific processing operation under specific conditions; A communication channel is established between the firewall application and the virtual firewall process.

4. The method according to claim 1, characterized in that: The step of analyzing the data packet to obtain data identification information of the data packet includes: The data packet is analyzed to obtain the message type of the data packet.

5. The method according to claim 4, characterized in that The determining, according to the data identification information, a corresponding target virtual firewall and a target matching rule of the target virtual firewall includes: When the message type is the first type, extracting first data packet forwarding information from the data packet; Determine the target virtual firewall and the target matching rule according to the first data packet forwarding information; The first data packet forwarding information includes at least one of the following: User identification information, unicast address information, network address information, media access control information, transport layer protocol information, and port information.

6. The method according to claim 4, characterized in that The determining, according to the data identification information, a corresponding target virtual firewall and a target matching rule of the target virtual firewall includes: When the message type is the second type, extracting second data packet forwarding information from the data packet; Determine the target virtual firewall and the target matching rule according to the second data packet forwarding information; The second data packet forwarding information includes at least one of the following: User identification information, unicast address information, network address information, transport layer protocol information, and port information.

7. The method according to claim 3, characterized in that The processing of the data packet based on the target virtual firewall and the target matching rule includes: The data packet is forwarded to the target virtual firewall through the communication channel and the virtual interface, so that the target virtual firewall process of the target virtual firewall processes the data packet according to the target matching rule.

8. A data packet processing system, characterized in that: The system comprises: A data packet acquisition module, used to acquire data packets to be processed; A data packet analysis module, used for analyzing the data packet to obtain data identification information of the data packet; A virtual firewall and matching rule determination module, used to determine the corresponding target virtual firewall and the target matching rule of the target virtual firewall according to the data identification information; The data packet processing module is used to process the data packet based on the target virtual firewall and the target matching rule.

9. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, enable the electronic device to execute the method for processing a data packet as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the data packet processing method as described in any one of claims 1 to 7.

Images