Message processing method and device based on application layer gateway, equipment and medium

Abstract

The invention relates to the technical field of network communication, in particular to a message processing method and device based on an application layer gateway, equipment and a medium. The method comprises the following steps: when an IP message to be processed is detected, determining a forwarding state of the IP message, determining tuple parameter information under the condition that the forwarding state is to be forwarded and the message transmission direction is uplink, and matching the tuple parameter information with a preset access control configuration blacklist to the IP message, and matching the tuple parameter information in a preset forwarding rule table under the condition that the tuple parameter information is not hit, and forwarding the IP message according to a matching result. According to the invention, the dependence of the gateway function on a specific system or hardware is solved, any network interface on the support equipment can be flexibly configured as the WAN port or the LAN port, and any IP address can be designated as the IP address of the WAN port, so that the purposes of simplifying the gateway configuration process and reducing the configuration difficulty are achieved, and the functionality and flexibility of the gateway are improved at the same time.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a message processing method, device, equipment and medium based on an application layer gateway. Background Art

[0002] With the rapid development of network technology, modern communication networks are usually composed of multiple subnets, which may run on different address spaces or physical topologies. In order to achieve efficient communication between these subnets, the network needs a gateway device with powerful routing and traffic management capabilities. According to the application scenario and actual needs, it mainly includes hardware gateways and software gateways. Software gateways have different implementation methods due to different operating systems, which makes configuration difficult and troubleshooting difficult; hardware gateways rely on physical gateway devices, and the WAN and LAN ports of traditional gateways are often fixed, requiring the WAN port on the WAN side and the LAN port on the LAN side to be different network ports and in different network segments, resulting in low gateway configuration flexibility. Summary of the invention

[0003] In view of this, one of the technical problems solved by the embodiments of the present application is to provide a message processing method, device, electronic device and storage medium based on an application layer gateway, which solves the problem of low gateway configuration flexibility caused by the fixed WAN and LAN ports.

[0004] In a first aspect of an embodiment of the present application, a message processing method based on an application layer gateway is disclosed, the method comprising:

[0005] When an IP message to be processed is detected, the forwarding state of the IP message is determined;

[0006] If the forwarding state is forwarding required and the message transmission direction is uplink, determine the tuple parameter information of the IP message, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type;

[0007] The tuple parameter information is matched with the preset access control configuration blacklist. If no match is found, the tuple parameter information is matched in the preset forwarding rule table, and the IP message is forwarded according to the matching result.

[0008] In a second aspect of an embodiment of the present application, a message processing device based on an application layer gateway is disclosed, the device comprising:

[0009] A message filtering determination module is used to determine the forwarding state of the IP message when detecting the IP message to be processed;

[0010] A tuple information determination module, used to determine the tuple parameter information of the IP message if the forwarding state is to be forwarded and the message transmission direction is uplink, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type;

[0011] The message forwarding processing module is used to match the tuple parameter information with the preset access control configuration blacklist. If there is no hit, the tuple parameter information is matched in the preset forwarding rule table, and the IP message is forwarded according to the matching result.

[0012] In a third aspect of an embodiment of the present application, an electronic device is disclosed. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.

[0013] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is disclosed, which stores a computer program. When the computer program is executed by a processor, the steps of the above method are implemented.

[0014] The present application has the following advantages: when an IP message is detected, the forwarding state of the IP message is determined, and when the forwarding state is to be forwarded and the message transmission direction is upward, the tuple parameter information of the IP message is determined, wherein the tuple parameter information includes the source IP and port of the requesting client, the IP and port of the server, and the protocol type, so as to match the tuple parameter information with a preset access control configuration blacklist, and when the access control configuration blacklist is not hit, the tuple parameter information is matched in a preset forwarding rule table, and the IP message is forwarded and processed according to the matching result. This configuration of forwarding filtering, access control filtering, and forwarding rules realizes the gateway at the application layer, overcomes the restrictions of the operating system on the gateway configuration, solves the dependence of the gateway function on a specific system or hardware, supports that any network interface on the device can be flexibly configured as a WAN port or a LAN port, and any IP address can be specified as the IP address of the WAN port, thereby achieving the purpose of simplifying the gateway configuration process and reducing the configuration difficulty, while improving the functionality and flexibility of the gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flowchart of a method for processing packets based on an application layer gateway according to an embodiment of the present application;

[0016] Figure 2 A schematic diagram of an embodiment of a forwarding rule table in a message processing method based on an application layer gateway provided in an embodiment of the present application;

[0017] Figure 3A schematic diagram of an embodiment of an access control configuration blacklist in a message processing method based on an application layer gateway provided in an embodiment of the present application;

[0018] Figure 4 A flowchart of a message processing method based on an application layer gateway provided in another embodiment of the present application;

[0019] Figure 5 A schematic diagram of the structure of an application layer gateway for applying a message processing method based on an application layer gateway provided by an embodiment of the present application;

[0020] Figure 6 A schematic diagram of an application layer gateway processing an IP message using an application layer gateway-based message processing method provided by an embodiment of the present application;

[0021] Figure 7 A schematic diagram of the structure of a message processing device based on an application layer gateway provided for one embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0024] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0025] According to an embodiment of the present application, a message processing method based on an application layer gateway is provided, such as Figure 1 As shown, the method includes step S101, step S102 and step S103.

[0026] Step S101: when an IP message to be processed is detected, the forwarding state and message transmission direction of the IP message are determined.

[0027] Specifically, when the application layer gateway detects an IP message to be processed initiated by the client, it can use the preset filtering rules to determine whether the client is prohibited from forwarding messages, that is, determine its forwarding status. More specifically, the IPv4 or IPv6 traffic is controlled and filtered through the filtering rules. When applied, the filtering rule can be a whitelist for running forwarding or a blacklist for restricting forwarding configured according to the source IP address and the target IP address information. The IP message is filtered and screened through the whitelist or the blacklist to determine the forwarding status. For example, assuming that the filtering rule is a blacklist, if it is determined that the destination IP of the IP message is the gateway LAN port IP, if the destination IP address of the IP message is the gateway LAN port IP, then the forwarding status of the IP message is no forwarding, otherwise it is to be forwarded.

[0028] Step S102: If the forwarding status is forwarding required, extract the tuple parameter information of the IP message, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type.

[0029] Step S103: Match the tuple parameter information with the preset access control configuration blacklist. If no match is found, match the tuple parameter information in the preset forwarding rule table, and forward the IP message according to the matching result.

[0030] Specifically, the access control configuration blacklist is generally an access control list ACL, which is an ordered set of rules consisting of a series of deny statements. The access control configuration blacklist identifies the source IP address, destination IP address, protocol type, source and destination ports and other elements in the IP message, so that the message can be matched according to the above elements. More specifically, each ACL rule can include a matching condition and a corresponding deny action.

[0031] In an embodiment of the present application, each ACL rule in the access control configuration blacklist is used to characterize the matching conditions for restricting forwarding. Specifically, the access control configuration blacklist may include basic ACL and custom ACI. For example, assuming that the basic ACL is configured to reject packets with a source IP address segment of 192.168.1.0 / 24, when the source IP address of the IP packet is detected to be 192.168.1.0 / 24, the operation of rejecting forwarding is performed.

[0032] Specifically, the forwarding rules are used to update the IP packets and forward them to different services.

[0033] When an IP message is detected in the embodiment of the present application, the forwarding status of the IP message is determined, and the tuple parameter information of the IP message is determined when the forwarding status is to be forwarded and the message transmission direction is upward, wherein the tuple parameter information includes the source IP and port of the requesting client, the IP and port of the server, and the protocol type, so as to match the tuple parameter information with the preset access control configuration blacklist, and when the access control configuration blacklist is not hit, the tuple parameter information is matched in the preset forwarding rule table, and the IP message is forwarded and processed according to the matching result. This configuration of forwarding filtering, access control filtering, and forwarding rules realizes the gateway at the application layer, overcomes the limitations of the operating system on the gateway configuration, solves the dependence of the gateway function on a specific system or hardware, supports any network interface on the device to be flexibly configured as a WAN port or a LAN port, and any IP address can be specified as the IP address of the WAN port, thereby simplifying the gateway configuration process and reducing the configuration difficulty, while improving the functionality and flexibility of the gateway.

[0034] In some embodiments, the forwarding rule table includes each source port requested by the requesting client that is allowed to be forwarded, and multiple forwarding rules corresponding to each source port and their respective corresponding key values; step S103 further includes: step S1031 (not shown in the figure): matching the source port of the requesting client with each source port of the requesting client that is allowed to be forwarded; step S1032 (not shown in the figure): if the match is successful, determining the corresponding hash value of the IP message based on the source port of the requesting client, the IP and port of the server, and the protocol type; step S1033 (not shown in the figure): using the hash value as an index of the key value to query, obtain the corresponding target forwarding rule, and update the IP message according to the target forwarding rule for forwarding.

[0035] Specifically, the updated message is forwarded through the WAN interface. The updated message includes PORT-S (client request source port), PORT-E (client request destination port), IP-W (gateway WAN side IP), IP-E (server IP), MAC-W (gateway WAN port physical MAC address), MAC-E (WAN port next physical MAC address).

[0036] Specifically, the key value corresponding to any forwarding rule is generally the hash value of the matching condition of the forwarding rule. More specifically, the matching condition of each forwarding rule is generally obtained according to the hash value of the tuple parameter information.

[0037] Specifically, the forwarding rule table can be as follows Figure 2 shown. Figure 2The forwarding rule table shown includes multiple ports, each port corresponds to multiple keys, and each key corresponds to a forwarding rule. When applied, first compare the source port of the requesting client with Figure 2 Each port in the forwarding rule table shown is matched, and when the match is successful, the corresponding multiple key values ​​and their respective forwarding rules are determined. After the source port of the requesting client, the IP and port of the server, and the protocol type are hashed and the corresponding hash value is obtained, it is used as the index of each key value for query, and the IP message is updated according to the forwarding rule found for forwarding processing. Since the port port is 16bit2 bytes, it is relatively simple and much less than the number of IPs, so the number of rules corresponding to each port can be recorded using a very small amount of memory. Therefore, the forwarding rule table uses a port port that is easy to store and query for a first-level query; at the same time, since the destination port is likely to be repeated when the gateway forwards, the forwarding rule table used in this application uses the source port as the first-level query, and searches for the corresponding second-level rules through the source port, that is, searches for the corresponding key, and then searches for the corresponding forwarding rules by hashing the four-tuple (i.e., the source port of the requesting client, the IP and port of the server, and the protocol type), which has the effect of accelerating the forwarding processing of the message through the second-level search.

[0038] In some embodiments, step S103 further includes:

[0039] If the target forwarding rule corresponding to the index query using the hash value as the key value fails, a new forwarding rule is constructed, and the IP message is updated according to the new forwarding rule before forwarding.

[0040] Specifically, a new port forwarding rule can be created by calling CreateNetworkRules, such as forwarding port number (such as 456), forwarding protocol type (such as tcp), etc.

[0041] In some embodiments, step S103 further includes:

[0042] If it is detected that any forwarding processing rule has not been used within a predetermined time period, a deletion process is performed on the forwarding processing rule.

[0043] Specifically, a pre-created scheduled task can be used to periodically scan to determine whether each forwarding rule is used within a predetermined time period, thereby completing the management of each forwarding rule in the forwarding rule table and preventing invalid forwarding rules from occupying memory.

[0044] In some embodiments, the access control configuration blacklist includes a first-level record, a second-level record, and a third-level record, the first-level record includes multiple major rules for protocol types and IP types, the second-level record corresponding to any major rule includes multiple tuple parameter combinations for tuple parameter information, any tuple parameter combination corresponds to a third-level record for the access control rule ACL, the tuple parameter combination includes at least one of the source IP and source port of the requesting client and the IP and port of the server; matching the tuple parameter information with the preset access control configuration blacklist in step S103 further includes: determining the target major rule corresponding to the protocol type in sequence according to the major category rules whose total number of control rules records in the first-level record are not zero; determining each tuple parameter combination whose total number of control rules records in the second-level record corresponding to the target major rule; extracting information from the IP message according to each tuple parameter combination whose total number of control rules records in the second-level record are not zero, and matching the access control rule ACL included in the third-level record corresponding to each tuple parameter combination whose total number of control rules records in the second-level record are not zero according to the extracted information.

[0045] When applied, the access control configuration blacklist can be Figure 3 shown.

[0046] Specifically, the major rules can be represented by a preset identifier. For example, the identifier tcp-v4 indicates that the IP type is IPv4 and the protocol type is TCP. The embodiment of the present application divides the first-level records into 6 major rules according to the IP type and protocol type, namely tcp-v4, udp-v4, other-v4, tcp-v6, udp-v6, and other-v6, wherein tcp-v4, udp-v4, and other-v4 respectively indicate that the IP type is IPv4, and the protocol type is TCP, UDP, and other major rules, and tcp-v6, udp-v6, and other-v6 respectively indicate that the IP type is IPv6, and the protocol type is TCP, UDP, and other protocol types (such as ARP / ICMP, etc.). When applied, the total number of access control rules corresponding to different major rules can be recorded, so that when performing a first-level query based on the use of the access control configuration blacklist, the major rules that are not configured with access control rules can be quickly filtered to improve the query efficiency of the first-level records.

[0047] Specifically, the tuple parameter combination includes at least one of the source IP and source port of the requesting client, and the IP and port of the server, that is, according to the source IP and source port of the requesting client, and the IP and port of the server, a total of 15 tuple parameter combinations can be obtained, namely, there are 4 combinations that match one element, 6 combinations that match two elements, 4 combinations that match three elements, and 1 combination that matches four elements. The matching accuracy is gradually refined and accurate by gradually matching from one element to four elements. When applied, each tuple parameter combination in the secondary record can be represented by a preset number, and the number of access control rules corresponding to each tuple parameter combination can be recorded at the same time. In this way, when matching the secondary records, the tuple parameter combinations that are not configured with access control rules can be quickly filtered, thereby improving the query efficiency of the secondary records.

[0048] When applied, the protocol type and IP type are extracted through the specific offset of the message, so as to determine the general rule corresponding to the IP message. For example, if the corresponding general rule is tcp-v4, after finding the 15 tuple parameter combinations corresponding to the rule, first check whether the total number of rules corresponding to each tuple parameter combination is not zero. If it is, the combination of at least one of the source IP and source port of the requesting client and the IP and port of the server is used to match the secondary record, so as to match the access control rule corresponding to the corresponding secondary record. If it is matched, the IP message is discarded. Since different element parameter combinations may correspond to multiple access control rules, when comparing with the rules corresponding to the secondary record, if the first rule is not matched, the next access control rule is matched.

[0049] Since TCP and UDP packets account for the vast majority of IP packets, and other types such as ARP / ICMP account for a relatively small proportion, the embodiment of the present application sets the major category rules to 3 categories according to the four-layer network protocol type, so as to quickly find out the type that needs to be matched. When applied, first determine the IP type, that is, whether the network traffic is IPv4 or IPv6, and reduce unnecessary matches by determining the IP type. Finally, according to the matching items, compare the element parameter combination, which plays a role in narrowing the scope of the rules to be matched while making the matching gradually more accurate.

[0050] In some embodiments, determining the forwarding status and message transmission direction of the IP message in step S101 further includes: step S1011 (not shown in the figure) offsetting a specific length from the message starting position of the IP message to obtain the IP type; step S1012 (not shown in the figure) offsetting according to the IP type to obtain the message IP; step S1013 (not shown in the figure) determining the forwarding status of the IP message based on the message IP and pre-configured filtering rules.

[0051] Specifically, the IP type can be obtained by offsetting a specific length from the starting position of the IP message, and then offset according to the IP type to obtain the source IP address of the requesting client and the IP of the server; at the same time, the message transmission direction can be determined based on the network port where the message is received (i.e., the message input interface).

[0052] Specifically, the matching conditions included in the filtering rules generally include at least one of the source IP and the destination IP. When applied, a specific length is offset from the beginning of the message to obtain the IP type, i.e., IPv4 or IPv6, and then a specific offset is taken for different types of messages to obtain the source IP or the destination IP, thereby matching it with the IP in the filtering rules. When applied, if the source IP or the destination IP hits the rule, step S102 is executed. The communication between subnets is judged and evaluated through the configuration of the filtering rules to determine whether forwarding is allowed. For example, when communicating between an internal network and an external network, the application layer gateway can act as a proxy server to evaluate the message and determine whether to allow it to pass according to the filtering rules.

[0053] Specifically, the filtering rules include uplink filtering rules and downlink filtering rules. Among them, the uplink filtering rules are generated according to the user configuration and added or deleted together with the user configuration. For example, after the LAN interface configuration is completed, that is, after the LAN port is specified, the source IP segment or the destination IP segment can be configured to limit the source IP-S of the requesting client and the IP of the server. For example, when the message input interface is a pre-configured LAN interface, the IP address of the IP message and the IP of the LAN interface are in different segments, indicating that the message needs to be forwarded; when the message input interface is a pre-configured WAN interface, the destination IP of the IP message and the IP of the WAN interface are in different segments, indicating that the message needs to be forwarded. The uplink filtering rules prevent abnormal external connections and play a role in ensuring the security of the internal network. The downlink filtering rules are generated when the new flow is forwarded for the first time, and each filtering rule in the downlink filtering rule table is configured with a validity period. When applying, if it is detected that any downstream filtering rule is not hit within the validity period, the downstream filtering rule will be deleted to avoid invalid filtering rules occupying memory, thus playing a role in dynamically managing the filtering rule table.

[0054] In some embodiments, Figure 4As shown, the method also includes: steps S201 to S205. Among them, step S201 determines the transmission direction of the IP message to be processed after detecting the IP message to be processed. When it is determined that the transmission direction is uplink, step S202 is executed, otherwise step S205 is executed. Step S202 can be processed with reference to the above steps S1011 to S1013. The steps of step S205 can be processed with reference to the above steps S1031 to S1033. After the execution of step S202, if the forwarding state of the IP message is to be forwarded, step S203 is executed to determine the tuple parameter information and match it with the preset access control configuration blacklist. If the access control configuration blacklist is not hit, step S204 is executed to match the tuple parameter information in the preset forwarding rule table, and forward the IP message according to the matching result. Step S205 determines the forwarding rule for the downstream IP message, and updates the IP message according to the forwarding rule for the downstream IP message and then forwards it. The updated downlink message includes PORT-S (client request source port), PORT-E (client request destination port), IP-S (client request IP), IP-E (server IP), MAC-S (client source physical MAC address), and MAC-L (gateway LAN port physical MAC address).

[0055] Combine the following Figure 5 and Figure 6 The application layer gateway of the method provided by the embodiment of the present application is described in detail. First, the management module of the application layer gateway is used to configure the LAN interface of the local area network (configure the network port, that is, specify the LAN port; configure the client source IP / request destination IP, that is, limit the source IP (IP-S) of the requesting client, the server IP (IP-E), and configure the WAN interface of the wide area network (configure the network port, that is, specify the WAN port; configure the gateway IP corresponding to the WAN port, that is, specify the WAN port and the gateway WAN side IP). At the same time, the access control configuration blacklist can be set (such as configuring the source IP / destination IP, source port / destination port, that is, limit the client request IP (IP-S), server IP (IP-E), client request source port PORT (PORT-S), client request destination port PORT (PORT-E). After completing the configuration of custom filtering rules, custom access control rules and custom forwarding rules, as shown in the figure, Figure 5 The packets are sent to the filtering module, access control module and processing module of the application layer gateway respectively. In this way, the application layer gateway updates the packet content of different interfaces of the IP packet. Figure 6As shown. Execute steps S101 to S103 on the IP message and forward it. The message content updated by the WAN port communication includes PORT-S (source port of the requesting client), PORT-E (port of the server), IP-W (IP of the gateway WAN side), IP-E (IP of the server), MAC-W (physical MAC address of the gateway WAN port), MAC-E (physical MAC address of the next line of the WAN port) and the third and fourth layer header checksum (not shown in the figure). Figure 6 As shown, when forwarding the downlink IP message to be processed, the update message forwarded by the LAN port side communication includes PORT-S (source port of the requesting client), PORT-E (port of the server), IP-S (source IP of the requesting client), IP-E (IP of the server), MAC-S (source physical MAC address of the client), MAC-L (physical MAC address of the gateway LAN port) and the third and fourth layer header checksum (not shown in the figure).

[0056] An embodiment of the present application provides a message processing device based on an application layer gateway, such as Figure 7 As shown, the device 70 includes: a message filtering determination module 701, a tuple information determination module 702 and a message forwarding processing module 703.

[0057] The message filtering determination module 701 is used to determine the forwarding state of the IP message when detecting the IP message to be processed;

[0058] Tuple information determination module 702, for determining tuple parameter information of the IP message if the forwarding state is to be forwarded and the message transmission direction is uplink, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type;

[0059] The message forwarding processing module 703 is used to match the tuple parameter information with the preset access control configuration blacklist. If there is no match, the tuple parameter information is matched in the preset forwarding rule table, and the IP message is forwarded according to the matching result.

[0060] When an IP message is detected in the embodiment of the present application, the forwarding status of the IP message is determined, and the tuple parameter information of the IP message is determined when the forwarding status is to be forwarded and the message transmission direction is upward, wherein the tuple parameter information includes the source IP and port of the requesting client, the IP and port of the server, and the protocol type, so as to match the tuple parameter information with the preset access control configuration blacklist, and when the access control configuration blacklist is not hit, the tuple parameter information is matched in the preset forwarding rule table, and the IP message is forwarded and processed according to the matching result. This configuration of forwarding filtering, access control filtering, and forwarding rules realizes the gateway at the application layer, overcomes the limitations of the operating system on the gateway configuration, solves the dependence of the gateway function on a specific system or hardware, supports any network interface on the device to be flexibly configured as a WAN port or a LAN port, and any IP address can be specified as the IP address of the WAN port, thereby simplifying the gateway configuration process and reducing the configuration difficulty, while improving the functionality and flexibility of the gateway.

[0061] Furthermore, the forwarding rule table includes a plurality of client request source ports that are allowed to be forwarded, and a plurality of forwarding rules corresponding to each of the client request source ports that are allowed to be forwarded and their respective corresponding key values; the message forwarding processing module includes:

[0062] The port matching submodule is used to match the source port of the requesting client with each source port included in the forwarding rule table;

[0063] The hash value determination submodule is used to determine the hash value of the IP message based on the source port of the requesting client, the IP and port of the server, and the protocol type if the match is successful;

[0064] The first forwarding processing submodule is used to query the hash value as the index of the key value, obtain the corresponding target forwarding rule, and update the IP message according to the target forwarding rule before forwarding.

[0065] Furthermore, the message forwarding processing module also includes:

[0066] The second forwarding processing submodule is used to construct a new forwarding rule if the target forwarding rule corresponding to the index query using the hash value as the key value fails, and to forward the packet after updating the IP message according to the new forwarding rule.

[0067] Furthermore, the message forwarding processing module also includes:

[0068] The forwarding rule dynamic management submodule is used to detect that any forwarding processing rule has not been used within a predetermined time period, and then perform deletion processing on the forwarding processing rule.

[0069] Further, the access control configuration blacklist includes a first-level record, a second-level record and a third-level record, the first-level record includes a plurality of major rules for protocol types and IP types, the second-level record corresponding to any major rule includes a plurality of tuple parameter combinations for tuple parameter information, the third-level record corresponding to any tuple parameter combination includes an access control rule ACL list, and the tuple parameter combination includes at least one of a source IP and a source port of a requesting client and an IP and a port of a server;

[0070] The tuple information determination module includes:

[0071] The first-level matching submodule is used to sequentially determine the target major category rules corresponding to the protocol type according to the major category rules whose total number of control rules in the first-level records is not zero;

[0072] A secondary record determination submodule is used to determine each tuple parameter combination in which the total number of control rule records in the secondary record corresponding to the target major category rule is not zero;

[0073] The secondary matching submodule is used to match the tuple parameter information according to the access control rule ACL of the third-level record corresponding to each tuple parameter combination whose total number of control rules in the secondary record is not zero.

[0074] Further, the message filtering determination module includes:

[0075] An IP type determination submodule, used to offset a specific length from the start position of the IP message to obtain the IP type;

[0076] The IP address determination submodule is used to offset according to the IP type and obtain the message IP;

[0077] The filtering rule identification submodule is used to determine the forwarding status of the IP message based on the message IP and pre-configured filtering rules.

[0078] Furthermore, the device also includes:

[0079] The downlink message processing module is used to determine the forwarding rule for the downlink IP message if the forwarding state is to be forwarded and the transmission direction of the IP message is downlink, and update the IP message according to the forwarding rule for the downlink IP message before forwarding processing.

[0080] The message processing device based on the application layer gateway of this embodiment can execute the message processing method based on the application layer gateway provided in the embodiment of the present application. The implementation principle is similar and will not be repeated here.

[0081] Yet another embodiment of the present application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the above method.

[0082] Specifically, the processor may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0083] Specifically, the processor is connected to the memory via a bus, and the bus may include a path for transmitting information. The bus may be a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0084] The memory can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0085] Optionally, the memory is used to store the code of the computer program for executing the solution of the present application, and the execution is controlled by the processor. The processor is used to execute the application program code stored in the memory to implement the actions of the device provided in the above embodiment.

[0086] Yet another embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the above when executed by a processor.

[0087] The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0088] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0089] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present application. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A message processing method based on an application layer gateway, characterized in that: include: When a to-be-processed IP message is detected, determining a forwarding state of the IP message; If the forwarding state is to be forwarded and the message transmission direction is uplink, determine the tuple parameter information of the IP message, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type; The tuple parameter information is matched with a preset access control configuration blacklist. If no match is found, the tuple parameter information is matched in a preset forwarding rule table, and the IP message is forwarded according to the matching result.

2. The method according to claim 1, characterized in that The forwarding rule table includes each source port of the requesting client that is allowed to forward, and a plurality of forwarding rules corresponding to each source port and their respective corresponding key values; matching the tuple parameter information in the preset forwarding rule table, and forwarding the IP message according to the matching result, including: Matching the source port of the requesting client with each source port included in the forwarding rule table; If the match is successful, the hash value of the IP message is determined based on the source port of the requesting client, the IP and port of the server, and the protocol type; The hash value is used as an index of the key value to query, a corresponding target forwarding rule is obtained, and the IP message is updated according to the target forwarding rule and then forwarded.

3. The method according to claim 2, characterized in that The step of matching the tuple parameter information in a preset forwarding rule table and forwarding the IP message according to the matching result further includes: If the target forwarding rule corresponding to the index query using the hash value as the key value fails, a new forwarding rule is constructed, and the IP message is updated according to the new forwarding rule before forwarding.

4. The method according to claim 2, characterized in that: The method further comprises: If it is detected that any forwarding processing rule has not been used within a predetermined time period, a deletion process is performed on the forwarding processing rule.

5. The method according to claim 1, characterized in that The access control configuration blacklist includes a first-level record, a second-level record and a third-level record, wherein the first-level record includes a plurality of major rules for protocol types and IP types, the second-level record corresponding to any major rule includes a plurality of tuple parameter combinations, the third-level record corresponding to any tuple parameter combination includes an access control rule ACL list, and the tuple parameter combination includes at least one of the source IP and source port of the requesting client and the IP and port of the server; The matching of the tuple parameter information with a preset access control configuration blacklist includes: Determine the target major category rule corresponding to the protocol type according to the major category rules whose total number of control rules in the first-level record is not zero; Determine each tuple parameter combination in which the total number of control rule records in the secondary record corresponding to the target major category rule is not zero; The tuple parameter information is matched with the access control rule ACL of the third-level record corresponding to each tuple parameter combination whose total number of control rules in the second-level record is not zero.

6. The method according to claim 1, characterized in that The determining of the forwarding state and the message transmission direction of the IP message includes: The IP type is obtained by offsetting a specific length from the start position of the IP packet; Perform an offset according to the IP type to obtain the message IP; The forwarding status of the IP message is determined based on the message IP and pre-configured filtering rules.

7. The method according to claim 1, characterized in that The method further comprises: If the forwarding state is forwarding required and the transmission direction of the IP message is downlink, a forwarding rule for the downlink IP message is determined, and the IP message is updated according to the forwarding rule for the downlink IP message before forwarding processing.

8. A message processing device based on an application layer gateway, characterized in that: include: A message filtering determination module, used for determining the forwarding state of the IP message when a to-be-processed IP message is detected; A tuple information determination module, used for determining the tuple parameter information of the IP message if the forwarding state is to be forwarded and the message transmission direction is uplink, wherein the tuple parameter information includes the source IP and source port of the requesting client, the IP and port of the server, and the protocol type; The message forwarding processing module is used to match the tuple parameter information with a preset access control configuration blacklist. If no match is found, the tuple parameter information is matched in a preset forwarding rule table, and the IP message is forwarded according to the matching result.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images