Control methods, devices and storage media for edge distributed firewall systems

Abstract

This application discloses a control method, device, and storage medium for an edge distributed firewall system, relating to the field of data processing technology. The method, upon receiving connection information from a mobile terminal, determines the connection event and corresponding connection event index of the mobile terminal based on the connection information. When the edge device receives an access request from the mobile terminal, it sends the corresponding connection event index and access request to a protocol parser. Upon receiving the connection event index and access request, the protocol parser loads the historical request and response data of the mobile terminal, extracts the HTTP protocol content from the historical request and response data to generate a security event index, and then sends the connection event index, security event index, and access request to the firewall. The firewall responds to the access request based on the connection event index and security event index, reducing its development cost.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to control methods, devices and storage media for edge distributed firewall systems. Background Technology

[0002] To facilitate employee and customer access to business systems, companies typically install numerous intranet access terminals within their campuses, covering the entire campus with an intranet. However, this increased intranet coverage also brings greater security risks and protection challenges, necessitating the installation of firewalls to protect user requests.

[0003] Traditional business firewalls rely on numerous rules for judgment. While they offer fast matching speeds, they are unable to prevent malicious access once the rules become invalid. To improve the accuracy of protection, enterprises typically introduce data analysis methods such as analyzing changes in transmitted data volume, content sensitivity, and request legitimacy for more precise protection. However, this approach often employs a centralized analysis and processing model, requiring the firewall to store large amounts of data and placing high demands on computing resources. This puts the security burden on the business firewall, resulting in high firewall development costs.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a control method, device and storage medium for an edge distributed firewall system, aiming to solve the technical problem of how to reduce the development cost of firewalls.

[0006] To achieve the above objectives, this application proposes a control method for an edge distributed firewall system, the edge distributed firewall system including an edge device, a protocol parser, and a firewall, and the control method for the edge distributed firewall system includes: After the edge device receives the connection information from the mobile terminal, it determines the connection events of the mobile terminal and the connection event indicators corresponding to the connection events within a preset time window based on the connection information. When the edge device receives an access request from the mobile terminal, it sends the connection event indicator corresponding to the mobile terminal and the access request to the protocol parser. Upon receiving the connection event indicator and the access request, the protocol parser loads the historical request data and historical response data of the mobile terminal within the preset time window, obtains the HTTP protocol content from the historical request data and the historical response data, generates a security event indicator based on the HTTP protocol content, and then sends the connection event indicator, the security event indicator, and the access request to the firewall. When the firewall receives the connection event indicator, the security event indicator, and the access request, it responds to the access request based on the connection event indicator and the security event indicator.

[0007] In one embodiment, the connection information includes the access time, IP address, and MAC address of the mobile terminal, and the connection event indicators include a first connection indicator, a second connection indicator, and a third connection indicator. The step of determining the connection events of the mobile terminal within a preset time window and the connection event indicators corresponding to the connection events based on the connection information includes: Based on the IP address and the MAC address, the edge device determines the traffic of the mobile terminal and uses the number of times the traffic exceeds a preset traffic threshold per unit time within the preset time window as the first connection indicator. Based on the access time, the IP address, and the MAC address, the edge device determines the connection events of the mobile terminal and uses the frequency of the connection events within the preset time window as the second connection index. Based on the access time, the IP address, and the MAC address, the edge device determines the disconnection and reconnection events of the mobile terminal, and uses the frequency of the disconnection and reconnection events within the preset time window as the third connection indicator.

[0008] In one embodiment, the security event indicators include a first security indicator and a second security indicator, and the step of generating security event indicators based on the HTTP protocol content includes: After the protocol parser obtains the password field from the request body of the HTTP protocol content, it determines the matching degree between the password field and the preset weak password vocabulary, which is used as the first security indicator. After the protocol parser obtains the response fields from the response body of the HTTP protocol content, it determines the matching degree between the response fields and the preset sensitive word library, which serves as the second security indicator.

[0009] In one embodiment, the security event indicators include a third security indicator and a fourth security indicator. Following the step of generating the security event indicators based on the HTTP protocol content, the method further includes: After the protocol parser determines the API corresponding to the historical request data and the historical response data, it determines the first similarity of the request line, request header and request body of each historical request corresponding to the same API, and the second similarity of the response line, response header and response body of each historical response corresponding to the same API. The ratio of the first similarity to the second similarity is used as the third security indicator. After the protocol parser determines the frequency of the mobile terminal's calls to different APIs within the preset time window, the call frequency is used as the fourth security indicator.

[0010] In one embodiment, before the step of sending the connection event indicator corresponding to the mobile terminal and the access request to the protocol parser when the edge device receives the access request from the mobile terminal, the method further includes: After obtaining the connection event index, the edge device compares the connection event index with a preset first index threshold. If any of the connection event indicators is greater than the preset first indicator threshold, a rejection message is sent to the mobile terminal. If all the connection event metrics are less than or equal to the preset first metric threshold, then when the edge device receives the access request from the mobile terminal, it performs the step of sending the connection event metrics corresponding to the mobile terminal and the access request to the protocol parser, or sends the connection event metrics to the firewall.

[0011] In one embodiment, before the step of sending the connection event indicator, the security event indicator, and the access request to the firewall, the method further includes: After obtaining the connection event index and the security event index, the protocol parser compares the security event index with a preset second index threshold. If any of the security event indicators exceeds the preset second indicator threshold, a rejection message is sent to the mobile terminal. If all the security event indicators are less than or equal to the preset second indicator threshold, then the step of sending the connection event indicator, the security event indicator, and the access request to the firewall is executed.

[0012] In one embodiment, before the step of sending the connection event indicator, the security event indicator, and the access request to the firewall, the method further includes: After receiving the connection information sent by the edge device, the protocol parser determines the connection time and MAC address of each mobile terminal from the connection information, and aggregates the connection event indicators sent by each edge device according to the connection time and MAC address as the connection event indicators corresponding to the same mobile terminal.

[0013] In one embodiment, after the step of responding to the access request based on the connection event indicator and the security event indicator, the method further includes: After the firewall sends the response to the mobile terminal, it deletes the connection event indicator and the security event indicator corresponding to the mobile terminal; wherein, if the response is a request rejection, the connection event indicator and the security event indicator are deleted after the MAC address of the mobile terminal is written into the protection database.

[0014] Furthermore, to achieve the above objectives, this application also proposes a control device for an edge distributed firewall system, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the control method for the edge distributed firewall system as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the control method of the edge distributed firewall system as described above.

[0016] This application provides a control method for an edge distributed firewall system. After the edge device receives connection information from a mobile terminal, it determines the connection events of the mobile terminal and the corresponding connection event indicators within a preset time window based on the connection information. When the edge device receives an access request from the mobile terminal, it sends the corresponding connection event indicators and the access request to a protocol parser. Upon receiving the connection event indicators and the access request, the protocol parser loads the historical request data and historical response data of the mobile terminal within the preset time window, obtains the HTTP protocol content from the historical request data and historical response data, generates security event indicators based on the HTTP protocol content, and then sends the connection event indicators, security event indicators, and the access request to the firewall. When the firewall receives the connection event indicators, security event indicators, and the access request, it responds to the access request based on the connection event indicators and security event indicators.

[0017] This method constructs an edge-distributed firewall system, distributing protection functions to edge devices. Upon receiving an access request from a mobile terminal, the edge device sends connection event metrics and the access request to a protocol parser. The parser combines historical request and response data to generate security event metrics, which are then sent to the firewall. The firewall responds to the access request by integrating the connection event metrics and security event metrics. This distributed processing approach reduces the computational resource requirements of the firewall, thereby lowering its development costs. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating the control method of the edge distributed firewall system of this application (Example 1). Figure 2 This is a flowchart illustrating a second embodiment of the control method for an edge distributed firewall system according to this application. Figure 3 A flowchart illustrating the control method of the edge distributed firewall system of this application in Embodiment 3; Figure 4 This is a schematic diagram of the edge distributed firewall system architecture involved in the control method of the edge distributed firewall system in the embodiments of this application; Figure 5 This is a schematic diagram illustrating the deployment of the protocol parser involved in the control method of the edge distributed firewall system in this embodiment of the application. Figure 6 This is a protection example diagram of the edge distributed firewall system involved in the control method of the edge distributed firewall system in the embodiments of this application; Figure 7 This is a schematic diagram of the hardware operating environment involved in the control method of the edge distributed firewall system in this embodiment of the application.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific embodiments. It should be noted that all actions involving the acquisition of signals, information, or data in this application are performed in accordance with the relevant data protection laws and regulations of the country where the application is located, and with authorization from the owner of the corresponding device.

[0024] To facilitate employee and customer access to business systems, companies typically install numerous intranet access terminals within their campuses, covering the entire campus with an intranet. However, this increased intranet coverage also brings greater security risks and protection challenges, necessitating the installation of firewalls to protect user requests.

[0025] Traditional business firewalls rely on numerous rules for judgment. While they offer fast matching speeds, they are unable to prevent malicious access once the rules become invalid. To improve the accuracy of protection, enterprises typically introduce data analysis methods such as analyzing changes in transmitted data volume, content sensitivity, and request legitimacy for more precise protection. However, this approach often employs a centralized analysis and processing model, requiring the firewall to store large amounts of data and placing high demands on computing resources. This puts the security burden on the business firewall, resulting in high firewall development costs.

[0026] In view of the above problems, this application proposes a control method for an edge distributed firewall system. After the edge device receives connection information from a mobile terminal, it determines the connection events of the mobile terminal and the corresponding connection event indicators within a preset time window based on the connection information. When the edge device receives an access request from the mobile terminal, it sends the corresponding connection event indicators and access request to a protocol parser. Upon receiving the connection event indicators and access request, the protocol parser loads the historical request data and historical response data of the mobile terminal within the preset time window, obtains the HTTP protocol content from the historical request data and historical response data, generates security event indicators based on the HTTP protocol content, and then sends the connection event indicators, security event indicators, and access request to the firewall. When the firewall receives the connection event indicators, security event indicators, and access request, it responds to the access request based on the connection event indicators and security event indicators.

[0027] This method constructs an edge-distributed firewall system, distributing protection functions to edge devices. Upon receiving an access request from a mobile terminal, the edge device sends connection event metrics and the access request to a protocol parser. The parser combines historical request and response data to generate security event metrics, which are then sent to the firewall. The firewall responds to the access request by integrating the connection event metrics and security event metrics. This distributed processing approach reduces the computational resource requirements of the firewall, thereby lowering its development costs.

[0028] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or edge distributed firewall system capable of performing the above functions. The following description uses an edge distributed firewall system as an example to illustrate this embodiment and the subsequent embodiments.

[0029] Based on this, the first embodiment of this application provides a control method for an edge distributed firewall system, the edge distributed firewall system including an edge device, a protocol parser, and a firewall, referred to... Figure 1In this embodiment, the control method of the edge distributed firewall system includes steps S10 to S40: Step S10: After the edge device receives the connection information of the mobile terminal, it determines the connection events of the mobile terminal and the connection event indicators corresponding to the connection events within a preset time window based on the connection information.

[0030] It should be noted that connection information refers to the basic data generated when a mobile terminal accesses the campus intranet, serving as the basis for edge devices to identify the mobile terminal and determine its connection behavior. Connection events refer to specific interactive behaviors between the mobile terminal and the intranet within a preset time window, including state changes such as connection requests, successful connections, disconnections, and reconnections, generated by the edge device based on connection information parsing. Connection event metrics refer to characteristic parameters obtained after quantitatively analyzing connection events within the preset time window, such as disconnection / reconnection frequency and connection event frequency.

[0031] Optionally, when the edge device receives connection information from the mobile terminal, such as the mobile terminal's terminal device identifier, MAC address, IP address, access point identifier, access time, connection status code, signal strength, etc., it will store the connection information in the log module. When the mobile terminal is detected to connect again, the connection information of the mobile terminal stored in the log module will be aggregated.

[0032] For example, in the log module, the edge device can use the MAC address of the mobile terminal as the primary key to build a hash table. The hash table stores a list of connection information for each mobile terminal. A preset time interval can be set to trigger the log module to clean up data and delete historical connection information that exceeds the preset time window.

[0033] Preferably, the connection information includes the mobile terminal's access time, IP address, and MAC address. Based on this, step S10 includes steps S11-S13: Step S11: Based on the IP address and the MAC address, the edge device determines the traffic of the mobile terminal and uses the number of times the traffic exceeds a preset traffic threshold per unit time within the preset time window as the first connection indicator.

[0034] For example, the edge device captures network data packets of the mobile terminal in real time through the deep packet inspection module, establishes a terminal identifier by combining the IP address and MAC address, and extracts target fields from the network data packets based on the terminal identifier: data packet timestamp and data packet size, where the data packet size can be represented by the number of bytes to reflect the traffic volume of the mobile terminal.

[0035] After obtaining the data packet timestamp and data packet size corresponding to the mobile terminal, the target network data packets within a preset time window are determined based on the data packet timestamp. The total data packet size of the mobile terminal is accumulated in real time every unit of time, such as per second, and compared with a preset traffic threshold. Whenever the total data packet size exceeds the preset traffic threshold within the preset time window, a count is triggered, and the count value is used as the first connectivity indicator. The preset traffic threshold may also differ for edge devices located in different areas of the campus.

[0036] It should be noted that because the edge device's log module deletes historical connection information that exceeds the preset time window, this count value is also updated as the preset time window slides.

[0037] Step S12: Based on the access time, the IP address, and the MAC address, the edge device determines the connection events of the mobile terminal and uses the frequency of the connection events within the preset time window as the second connection index.

[0038] For example, mobile terminals with the same IP address and MAC address are considered as the same mobile terminal, and the connection frequency of the mobile terminal within a preset time window is counted based on its access time as a second connection indicator.

[0039] Step S13: Based on the access time, the IP address, and the MAC address, the edge device determines the disconnection and reconnection event of the mobile terminal, and uses the frequency of the disconnection and reconnection event within the preset time window as the third connection indicator.

[0040] For example, if a mobile device with the same IP address and MAC address makes two connection attempts within a preset time window, and the interval between the access times of the two connection attempts is less than a preset time, this can be considered a disconnection and reconnection event. Optionally, in other embodiments, two connections with the same access point identifier can be considered as one connection attempt to exclude normal reconnection events caused by physical location switching. Within the preset time window, the total number of disconnection and reconnection events is divided by the window duration to obtain the frequency of disconnection and reconnection events, which serves as a third connection indicator.

[0041] The first connection indicator, the second connection indicator, and the third connection indicator are used as connection event indicators for the mobile terminal and stored in the log module of the edge device.

[0042] Optionally, in other embodiments, the edge device may also extract multi-dimensional features from the connection information as connection event indicators. For example, the distribution of connection periods of the mobile terminal within a preset time window may be used as a temporal feature, the switching frequency of the access point identifier may be used as a spatial feature, and the data transmission volume of a single connection within the preset time window may be used as a state feature. Then, the aforementioned temporal features, spatial features, and state features may be used as connection event indicators.

[0043] The above steps involve localizing the connection data of each mobile terminal on edge devices, transforming raw connection information into structured connection events and quantifying connection event metrics. This achieves edge-side traffic offloading for data preprocessing, alleviating the storage and computing burden on the firewall. Furthermore, the localized processing on edge devices allows the system to scale linearly with the number of connected terminals in the campus, avoiding single-point-of-failure risks and improving security.

[0044] Step S20: When the edge device receives the access request from the mobile terminal, it sends the connection event indicator corresponding to the mobile terminal and the access request to the protocol parser.

[0045] When an edge device receives a service request, such as an HTTP request, from a mobile terminal, it first parses the terminal identification information in the request header, such as the mobile terminal's IP address and MAC address. Then, it quickly locates the connection event indicators cached locally by the mobile terminal on the edge device through hash mapping, encapsulates the connection event indicators and access request according to a preset data format, and sends them to the protocol parser.

[0046] After receiving the data, the protocol parser returns an acknowledgment frame. If the edge device does not receive the acknowledgment frame within a preset time, it retransmits the data; or it directly sends the encapsulated connection event metrics and access request to the firewall, which then responds to the access request based on the connection event metrics.

[0047] Step S30: Upon receiving the connection event indicator and the access request, the protocol parser loads the historical request data and historical response data of the mobile terminal within the preset time window, obtains the HTTP protocol content from the historical request data and the historical response data, generates a security event indicator based on the HTTP protocol content, and then sends the connection event indicator, the security event indicator, and the access request to the firewall.

[0048] Understandably, after receiving an access request from a mobile terminal sent by an edge device, the protocol parser stores the request in the log module. Simultaneously, upon receiving the response data corresponding to the access request from the firewall, the protocol parser also associates and stores the response data with the request data. Thus, the next time the protocol parser receives an access request from the edge device for the same mobile terminal, it extracts historical request and response data within a preset time window from the log module and determines the mobile terminal's security event indicators based on this historical data.

[0049] For example, after receiving the connection event indicators and access requests transmitted by the edge device, the protocol parser uses the IP address and MAC address of the mobile terminal as the terminal identifier, queries the historical request data and historical response data of the mobile terminal from the log module, performs structured parsing of the HTTP protocol content in the historical request data and historical response data, and extracts the corresponding field information based on preset rules to calculate the security event indicators of the mobile terminal.

[0050] In one feasible implementation, the step of generating security event indicators based on the HTTP protocol content includes steps S31-S32: Step S31: After the protocol parser obtains the password field from the request body of the HTTP protocol content, it determines the matching degree between the password field and the preset weak password vocabulary, and uses it as the first security indicator.

[0051] For example, the protocol parser first locates the password field in the HTTP request body, such as by matching keywords like "password=" or "pwd=". After extracting the password field value, it can be preprocessed, such as removing leading and trailing spaces and special characters. After preprocessing, the password field value's length, character type, and sequence pattern are determined. These features are then matched against typical weak password feature combinations stored in a preset weak password vocabulary, calculating the overlap between the password field and the preset weak password vocabulary: overlap = number of matched features / total number of features. Then, the overlap is multiplied by the weight of the corresponding number of matched features in the preset weak password vocabulary, and the product is used as the matching degree, i.e., the first security indicator.

[0052] Step S32: After the protocol parser obtains the response field from the response body of the HTTP protocol content, it determines the matching degree between the response field and the preset sensitive word library, which is used as the second security indicator.

[0053] Optionally, the content under response fields such as the data and result nodes is extracted from the response body of the HTTP protocol content. The response field content is then segmented to obtain the segmentation results. The segmentation results are matched with sensitive words in a preset sensitive word library. The number of successful matches and the category to which the corresponding matched sensitive word belongs are recorded. The product of the number of successful matches and the sensitivity weight corresponding to the category is used as the matching degree between the response field and the preset sensitive word library.

[0054] Optionally, the response field is converted into a response vector using the BERT (Bidirectional Encoder Representations from Transformers) model. A preset sensitive word library is used to store vector features and category labels for typical sensitive content. Then, the cosine similarity between the response vector and the vector features in the preset sensitive word library is calculated. If the cosine similarity is greater than or equal to the category threshold corresponding to the category label of the vector feature, it is determined to match that category of sensitive content. The number of matches and the category label are recorded. The product of the number of matches and the sensitivity weight corresponding to the category label is used as the matching degree between the response field and the preset sensitive word library.

[0055] Finally, the aforementioned first and second security indicators will be used as security event indicators for mobile terminals.

[0056] In another feasible implementation, after the step of generating security event indicators based on the HTTP protocol content, steps S33-S34 are further included: Step S33: After the protocol parser determines the API corresponding to the historical request data and the historical response data, it determines the first similarity of the request line, request header and request body of each historical request corresponding to the same API, and the second similarity of the response line, response header and response body of each historical response corresponding to the same API, and uses the ratio of the first similarity to the second similarity as the third security indicator.

[0057] For example, the protocol parser determines the API identifier through the URL path in the HTTP request line or the X-API-Name request header marked by the API gateway, and categorizes the historical request data and historical response data of the same API within a preset time window into the request set of that API. Then, for all historical requests of the same API, the similarity of the request line, request header, and request body is calculated respectively, and the first similarity is obtained by weighted summation.

[0058] Request line similarity can be calculated by comparing request methods such as "GET" and "POST", URL parameters such as "id=123", and HTTP versions such as "HTTP / 1.1", using an edit distance algorithm to calculate the similarity of each string. Request header similarity can be obtained by extracting key header fields such as "Content-Type", "Authorization", and "User-Agent" and calculating the repetition rate of these key header fields. If the request body is form data, request body similarity can be obtained by calculating the intersection ratio of key-value pairs; if the request body is JSON data, JSON structure similarity algorithms can be used to determine request body similarity.

[0059] Similarly, for all historical response data of the same API, the similarity of the response line, response header, and response body is calculated using logic corresponding to the request body, and then weighted and summed to obtain a second similarity. The ratio of the first similarity to the second similarity is then used as the third security indicator.

[0060] Understandably, the third security indicator reflects the consistency between request and response data for the same API. In normal business scenarios, request and response data for the same API typically exhibit a stable correlation: similar request data should return structurally similar response data; for example, query requests with only different user ID parameters should return user information in the same field. In this case, the first similarity and second similarity will remain close to 1. If this ratio is much greater than 1 or much less than 1, it indicates that the matching relationship between request and response data has been broken, suggesting an anomaly. For example, when an attacker sends structurally similar malicious SQL injection, XSS (Cross-Site Scripting), or command injection requests to the same API to disguise a normal response but induce an abnormal attack, the third security indicator will be much greater than 1. When an attacker tries multiple requests, such as trying different usernames and passwords but returning the same "login failed" page, the request data consistency is low, but the response data consistency is high, and the third security indicator will be much less than 1. Therefore, the third security indicator can easily and quickly identify abnormal user requests.

[0061] Step S34: After the protocol parser determines the frequency of the mobile terminal's calls to different APIs within the preset time window, the call frequency is used as the fourth security indicator.

[0062] For example, the protocol parser categorizes mobile terminal access requests using a pre-defined API classification library, extracts all API call records within a pre-defined time window, groups them by API identifier, and counts the total number of calls within the pre-defined time window. The ratio of the total number of calls to the window duration is used as the call frequency, i.e., the fourth security indicator. When the fourth security indicator is too high, it indicates an abnormal API call frequency, which can provide early warning of abnormal request behaviors such as brute-force attacks and bulk data crawling.

[0063] Finally, the first, second, third, and fourth security indicators mentioned above will be used as security event indicators for mobile terminals.

[0064] Optionally, in the steps of generating security event indicators described above, current request data, historical request data, and historical response data can also be obtained. When processing and analyzing historical request data, the same method can be used to process the current request data to generate the corresponding security event indicators.

[0065] Step S40: After the firewall receives the connection event indicator, the security event indicator, and the access request, it responds to the access request based on the connection event indicator and the security event indicator.

[0066] The firewall has a built-in lightweight comparison engine that uses single-index threshold or multi-index combined threshold judgment logic to compare the above connection event index and security event index with the corresponding index threshold. All index thresholds can be statically configured or dynamically adjusted through the management platform, such as reducing the API call frequency threshold during peak periods.

[0067] It should be noted that the firewall device itself does not store the aggregated connection event metrics and security event metrics. It receives these metrics only for threshold comparison, requiring minimal memory and CPU resources. The connection event metrics and security event metrics are stored in the edge device and protocol parser, respectively. When a mobile terminal initiates an access request, the edge device and protocol parser transmit the connection event metrics and security event metrics within a preset time window to the firewall layer by layer.

[0068] Optionally, the firewall can be configured with different risk levels and different threshold ranges for different indicators, and take different responses according to the different risk levels, including directly returning "403 Forbidden", resetting the connection, requesting rate limiting control, redirecting to the verification page, rewriting the response content to encrypt sensitive information, etc.

[0069] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2Before step S20, the control method of the edge distributed firewall system further includes steps S50 to S70: Step S50: After obtaining the connection event index, the edge device compares the connection event index with a preset first index threshold.

[0070] Step S60: If any of the connection event indicators is greater than the preset first indicator threshold, a rejection message is sent to the mobile terminal.

[0071] For example, the edge device can store a preset first indicator threshold locally via a configuration file, containing the critical values ​​for each connection event indicator. After generating a connection event indicator, the edge device compares the connection event indicator with the preset first indicator threshold. If any connection event indicator exceeds the preset first indicator threshold, a rejection message is immediately generated to quickly intercept the access request, and the rejection message is returned to the mobile terminal through the original connection link. By intercepting access requests from high-risk mobile terminals at the edge in advance, the transmission of invalid data to the protocol parser and firewall can be reduced, thus reducing the protection pressure on the firewall and protocol parser.

[0072] Step S70: If all the connection event indicators are less than or equal to the preset first indicator threshold, then when the edge device receives the access request from the mobile terminal, it executes the step of sending the connection event indicators corresponding to the mobile terminal and the access request to the protocol parser, or sends the connection event indicators to the firewall.

[0073] If all connection event metrics are less than or equal to a preset first metric threshold, proceed to step S20, sending the connection event metrics and access requests to the protocol parser for in-depth analysis. Optionally, the connection event metrics and access requests can also be sent directly to the firewall.

[0074] Based on the above embodiments of this application, in the third embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Furthermore, before the step of sending the connection event indicator, the security event indicator, and the access request to the firewall, the control method of the edge distributed firewall system further includes steps S80~S100: In step S80, after obtaining the connection event index and the security event index, the protocol parser compares the security event index with a preset second index threshold.

[0075] Step S90: If any of the security event indicators is greater than the preset second indicator threshold, a rejection message is sent to the mobile terminal.

[0076] Optionally, the protocol parser stores a preset second indicator threshold in a local configuration file, setting thresholds for different security event indicators. After generating a security event indicator, the protocol parser compares it with the preset second indicator threshold. If any of the security event indicators exceeds the preset second indicator threshold, a standardized rejection message is generated and returned to the mobile terminal via the original transmission link. Compared to edge devices filtering based solely on connection behavior, the protocol parser combines security event indicators such as weak password matching and sensitive content identification for further verification, improving the accuracy of identifying high-risk requests.

[0077] Step S100: If all the security event indicators are less than or equal to the preset second indicator threshold, then the step of sending the connection event indicator, the security event indicator, and the access request to the firewall is executed.

[0078] If all security event indicators are less than or equal to the preset second indicator threshold, the protocol parser will encapsulate the connection event indicators, security event indicators, and the original access request into a standard format data packet and send it to the specified port of the firewall, from which the firewall will respond.

[0079] Optionally, before sending the connection event metrics, security event metrics, and access requests to the firewall, after receiving the connection information sent by the edge device, the protocol parser determines the connection time and MAC address of each mobile terminal from the connection information, and aggregates the connection event metrics sent by each edge device according to the connection time and MAC address as the connection event metrics corresponding to the same mobile terminal.

[0080] Understandably, in a distributed firewall system, multiple edge devices are typically deployed within a campus to cover different areas, such as office buildings, workshops, and parking lots. When a mobile terminal moves within the campus, it may switch from the coverage area of ​​one edge device to another. In this case, each edge device independently records the connection event metrics of that mobile terminal. After receiving this connection information from different edge devices, the protocol parser needs to merge the connection event metrics scattered across multiple edge devices into a complete metric for the mobile terminal. This prevents the firewall from misjudging the connection event metrics of the same mobile terminal on different edge devices as "multiple independent terminals," leading to misjudgments.

[0081] Optionally, when a mobile terminal switches connections between different edge device access points within the same subnet, the IP address of the mobile terminal will not change because the subnet remains the same, but it may connect to different wireless network names. The MAC address, as the unique identifier of the mobile terminal's physical hardware, remains fixed. Access time is used to limit access behavior within the same time period, avoiding erroneous associations across time periods. Therefore, by combining these four elements—access time, IP address, MAC address, and wireless network name—connection event indicators sent by various edge devices can be aggregated to accurately identify access behavior when the same mobile terminal switches access points within the same subnet.

[0082] Optionally, if the mobile terminal switches connections between different edge device access points within the same subnet, and the different edge device access points do not have wireless network name differentiation enabled (e.g., all access points share the same wireless network name), then the connection event indicators sent by each edge device can be aggregated by combining the three elements of access time, IP address, and MAC address.

[0083] Optionally, if a mobile terminal switches between different subnets, such as switching from an office subnet to a conference room subnet, and these two subnets belong to different network segments, the mobile terminal's IP address will change due to the subnet change, and the wireless network name may also be different. However, the MAC address, as the mobile terminal's physical unique identifier, remains unchanged. Therefore, connection event indicators sent by various edge devices can be aggregated using connection time and MAC address.

[0084] Based on the above embodiments of this application, in the third embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, refer to... Figure 3 After step S40, the control method of the edge distributed firewall system further includes step S110: Step S110: After the firewall sends the response to the mobile terminal, the connection event indicator and the security event indicator corresponding to the mobile terminal are deleted.

[0085] Since the connection event metrics and security event metrics mentioned above are only used for metric threshold comparison, once the firewall has completed its response to the mobile access request, the connection event metrics and security event metrics associated with this access request of the mobile terminal have completed their function, so they are deleted to keep the firewall running light.

[0086] Optionally, if the above response is a rejection request, the connection event indicators and security event indicators of the mobile terminal are deleted after the MAC address of the mobile terminal is written into the protection database.

[0087] If the firewall responds with a denial, indicating that the mobile terminal's access request is risky, it first writes the mobile terminal's MAC address into the protection database and then deletes its index. Subsequent times when the mobile terminal initiates an access request, the firewall can quickly identify and block it directly using the MAC address in the protection database, eliminating the need to repeatedly rely on edge devices and protocol resolvers to generate indicators, significantly shortening the response chain for subsequent protection.

[0088] For example, refer to Figure 4 Edge devices can be placed as lightweight front-ends at the primary node. Their computing power is limited, and they are only responsible for simple connection metric statistics at the connection and network layers, requiring no complex calculations. Protocol parsers, on the other hand, possess stronger computing power and storage, and can be deployed in series with edge devices as intermediate-level devices to perform HTTP protocol parsing and extract data security event metrics from the protocol content. Multiple levels of protocol parsers can be configured on intermediate-level devices, and they can connect to edge devices in other areas of the network. When a mobile terminal switches its connection from edge device A to edge device B, the mobile terminal's historical metric data remains on the intermediate-level device closest to the firewall and remains valid within a preset time window. Each intermediate-level device stores different aggregated data; when a mobile terminal initiates an access request, it triggers the tiered aggregation of metric data to the firewall.

[0089] With this architecture, if a mobile terminal's access request poses a threat after successfully accessing the campus network for the first time, such as obtaining confidential data, the firewall can respond accordingly and provide protection based on its previous historical request and response data when it attempts to obtain the data again.

[0090] Alternatively, the protocol parser can also be deployed in bypass mode with edge devices.

[0091] Reference Figure 5 In the serial mode, the mobile terminal sends an access request to the edge device. The edge device analyzes the connection event indicators based on the access request. After determining the security event indicators, the protocol parser forwards the received access request and connection event indicators together with the security event indicators to the firewall.

[0092] In bypass mode, the mobile terminal first executes the steps. An access request is sent to the edge device. After analyzing the connection event metrics based on the access request, the edge device executes the following steps. The edge device sends access requests and connection event metrics analysis to the firewall. Simultaneously, it sends the mobile terminal's current request data to the protocol resolver. The protocol resolver analyzes the security event metrics using the current request data, historical request data, and historical response data, and then forwards the security event metrics to the firewall. If the edge device receives a response from the switch in step N, it will execute step N+1 to forward the response to the mobile terminal, and simultaneously send the current response data corresponding to this access request to the protocol resolver.

[0093] It should be noted that in the serial mode, the protocol parser participates in the forwarding of access requests, while in the bypass mode, the protocol parser only uses the current request data, historical request data, and historical response data of the mobile terminal for analysis and to generate security event indicators, and does not participate in the forwarding of access requests.

[0094] For example, refer to Figure 6 Taking bypass mode as an example, after a malicious mobile terminal successfully accesses the campus network and obtains confidential data for the first time, when the malicious mobile terminal initiates a second request, the protocol parser can analyze the HTTP protocol response body to match and discover sensitive data, thus forming a corresponding second security indicator. Then, after the second security indicator is transmitted to the firewall, the firewall encrypts the response content of this request. At this point, the response content no longer contains confidential data; the confidential data has been offloaded, therefore, confidential data will not be leaked to the malicious user terminal. When the malicious mobile terminal initiates a third request, based on the previously accumulated time indicator data, the firewall determines that its request is high-risk and returns a rejection message to the malicious mobile terminal, and the request is blocked.

[0095] This application provides a control device for an edge distributed firewall system. The control device for the edge distributed firewall system includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the control method of the edge distributed firewall system in the first embodiment described above.

[0096] The following is for reference. Figure 7 The diagram illustrates a structural schematic of a control device suitable for implementing an edge distributed firewall system according to embodiments of this application. The control device for the edge distributed firewall system in embodiments of this application may include, but is not limited to, mobile terminals such as digital broadcast receivers and fixed terminals such as desktop computers. Figure 7 The control device of the edge distributed firewall system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0097] like Figure 7As shown, the control device of the edge distributed firewall system may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the control device of the edge distributed firewall system. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the control device of the edge distributed firewall system to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows the control device of an edge distributed firewall system with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented or possessed alternatively.

[0098] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0099] The control device for the edge distributed firewall system provided in this application, employing the control method of the edge distributed firewall system in the above embodiments, can solve the technical problem of how to reduce the development cost of firewalls. Compared with the prior art, the beneficial effects of the control device for the edge distributed firewall system provided in this application are the same as the beneficial effects of the control method for the edge distributed firewall system provided in the above embodiments, and other technical features in the control device for the edge distributed firewall system are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0100] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0101] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0102] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the control method of the edge distributed firewall system in the above embodiments.

[0103] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0104] The aforementioned computer-readable storage medium may be included in the control device of the edge distributed firewall system; or it may exist independently and not be assembled into the control device of the edge distributed firewall system.

[0105] The aforementioned computer-readable storage medium carries one or more programs that, when executed by the control device of the edge distributed firewall system, enable the control device to write computer program code for performing the operations of this application in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, or as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0106] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0107] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0108] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the control method of the aforementioned edge distributed firewall system, thereby solving the technical problem of how to reduce the development cost of firewalls. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the control method of the edge distributed firewall system provided in the above embodiments, and will not be repeated here.

[0109] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the control method for the edge distributed firewall system described above.

[0110] The computer program product provided in this application solves the technical problem of how to reduce the development cost of firewalls. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the control method of the edge distributed firewall system provided in the above embodiments, and will not be repeated here.

[0111] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A control method for an edge distributed firewall system, characterized in that, The edge distributed firewall system includes edge devices, a protocol parser, and a firewall. The control method for the edge distributed firewall system includes: After the edge device receives the connection information from the mobile terminal, it determines the connection events of the mobile terminal and the connection event indicators corresponding to the connection events within a preset time window based on the connection information. When the edge device receives an access request from the mobile terminal, it sends the connection event indicator corresponding to the mobile terminal and the access request to the protocol parser. Upon receiving the connection event indicator and the access request, the protocol parser loads the historical request data and historical response data of the mobile terminal within the preset time window as needed, obtains the HTTP protocol content from the historical request data and the historical response data, generates a security event indicator based on the HTTP protocol content, and then sends the connection event indicator, the security event indicator, and the access request to the firewall. When the firewall receives the connection event indicator, the security event indicator, and the access request, it responds to the access request based on the connection event indicator and the security event indicator. The connection information includes the access time, IP address, and MAC address of the mobile terminal. The connection event indicators include a first connection indicator, a second connection indicator, and a third connection indicator. The step of determining the connection events of the mobile terminal and the corresponding connection event indicators within a preset time window based on the connection information includes: Based on the IP address and the MAC address, the edge device determines the traffic of the mobile terminal and uses the number of times the traffic exceeds a preset traffic threshold per unit time within the preset time window as the first connection indicator. Based on the access time, the IP address, and the MAC address, the edge device determines the connection events of the mobile terminal and uses the frequency of the connection events within the preset time window as the second connection index. Based on the access time, the IP address, and the MAC address, the edge device determines the disconnection and reconnection events of the mobile terminal, and uses the frequency of the disconnection and reconnection events within the preset time window as the third connection indicator. The security event indicators include a first security indicator and a second security indicator. The step of generating security event indicators based on the HTTP protocol content includes: After the protocol parser obtains the password field from the request body of the HTTP protocol content, it determines the matching degree between the password field and the preset weak password vocabulary, which is used as the first security indicator. After the protocol parser obtains the response fields from the response body of the HTTP protocol content, it determines the matching degree between the response fields and the preset sensitive word library, which serves as the second security indicator.

2. The control method for the edge distributed firewall system as described in claim 1, characterized in that, The security event indicators include a third security indicator and a fourth security indicator. Following the step of generating security event indicators based on the HTTP protocol content, the method further includes: After the protocol parser determines the API corresponding to the historical request data and the historical response data, it determines the first similarity of the request line, request header and request body of each historical request corresponding to the same API, and the second similarity of the response line, response header and response body of each historical response corresponding to the same API. The ratio of the first similarity to the second similarity is used as the third security indicator. After the protocol parser determines the frequency of the mobile terminal's calls to different APIs within the preset time window, the call frequency is used as the fourth security indicator.

3. The control method for the edge distributed firewall system as described in claim 1, characterized in that, Before the step of sending the connection event indicator corresponding to the mobile terminal and the access request to the protocol parser when the edge device receives the access request from the mobile terminal, the method further includes: After obtaining the connection event index, the edge device compares the connection event index with a preset first index threshold. If any of the connection event indicators is greater than the preset first indicator threshold, a rejection message is sent to the mobile terminal. If all the connection event metrics are less than or equal to the preset first metric threshold, then when the edge device receives the access request from the mobile terminal, it executes the step of sending the connection event metrics corresponding to the mobile terminal and the access request to the protocol parser, or sends the connection event metrics to the firewall.

4. The control method for the edge distributed firewall system as described in claim 1, characterized in that, Before the step of sending the connection event indicator, the security event indicator, and the access request to the firewall, the method further includes: After obtaining the connection event index and the security event index, the protocol parser compares the security event index with a preset second index threshold. If any of the security event indicators exceeds the preset second indicator threshold, a rejection message is sent to the mobile terminal. If all the security event indicators are less than or equal to the preset second indicator threshold, then the step of sending the connection event indicator, the security event indicator, and the access request to the firewall is executed.

5. The control method for the edge distributed firewall system as described in claim 1, characterized in that, Before the step of sending the connection event indicator, the security event indicator, and the access request to the firewall, the method further includes: After receiving the connection information sent by the edge device, the protocol parser determines the connection time and MAC address of each mobile terminal from the connection information, and aggregates the connection event indicators sent by each edge device according to the connection time and MAC address as the connection event indicators corresponding to the same mobile terminal.

6. The control method for the edge distributed firewall system as described in claim 1, characterized in that, After the step of responding to the access request based on the connection event indicator and the security event indicator, the method further includes: After the firewall sends the response to the mobile terminal, it deletes the connection event indicator and the security event indicator corresponding to the mobile terminal; wherein, if the response is a request rejection, the connection event indicator and the security event indicator are deleted after the MAC address of the mobile terminal is written into the protection database.

7. A control device for an edge distributed firewall system, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the control method for the edge distributed firewall system as described in any one of claims 1 to 6.

8. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the control method of the edge distributed firewall system as described in any one of claims 1 to 6.

Images