Flow security protection method and device

Abstract

The invention provides a traffic security protection method and device. The method comprises the following steps: receiving a service message from a first virtual router of a first service VPC; routing the service message to a firewall in the protection VPC, so that the firewall performs security detection on the service message; and after the security detection is passed, forwarding the service message to a second virtual router of the second service VPC, so that the second virtual router sends the service message to a second virtual machine. According to the method, on the premise that a VPC routing table is not modified, east-west flow is guided to a specified firewall through host routing and ARP proxy functions, and path reachability and safety protection of bidirectional flow are achieved. The firewall and other security resources are intensively deployed in the independent protection VPC, so that the protection range of the firewall is expanded, and the load balancing performance is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to a traffic security protection method and device. BACKGROUND

[0002] Cloud computing has become the core infrastructure in the field of information technology today, and is widely used in various deployment modes such as public cloud and private cloud. Under this background, the security protection of internal business of the cloud platform, especially the security protection of east-west traffic, has become a focus problem in the industry.

[0003] In the cloud platform, a security device such as a firewall is usually used to perform access control and security protection on the east-west traffic. A common traffic diversion scheme relies on editing the routing table of a VPC (Virtual Private Cloud) to point the next hop of the traffic to be protected to the firewall. However, there is a specific cloud platform architecture that does not allow external operations to directly intervene and edit the VPC-level routing table. In this restricted network environment, how to effectively guide the traffic to the firewall to achieve comprehensive east-west security protection has become a technical problem to be solved. SUMMARY

[0004] The present application provides a traffic security protection method and device for realizing security protection of east-west network traffic across VPCs in a restricted network environment where VPC routing is not allowed to be modified.

[0005] Specifically, the present application provides the following technical solutions: In a first aspect, the present application provides a traffic security protection method applied to a protection virtual router of a protection VPC, and the method comprises: receiving a service packet from a first virtual router of a first service VPC; wherein the service packet is sent from a first virtual machine in the first service VPC to a second virtual machine in a second service VPC; a gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is an address of a firewall in the protection VPC; the service packet is received by the first virtual router based on an ARP proxy function; routing the service packet to the firewall in the protection VPC to enable the firewall to perform security detection on the service packet; after the security detection, forwarding the service packet to a second virtual router of the second service VPC to enable the second virtual router to deliver the service packet to the second virtual machine.

[0006] In a second aspect, the present application provides a traffic security protection method applied to a virtual router of a service VPC, and the method comprises: receive an out-bound service packet sent by a first virtual machine in a current service VPC based on an ARP proxy function; wherein, a destination of the out-bound service packet is a second virtual machine in another service VPC; a gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is an address of a firewall in a protected VPC; forward the out-bound service packet to a protected virtual router of the protected VPC, so that the protected virtual router routes the out-bound service packet to the firewall for security detection, and sends the out-bound service packet passing the security detection to the second virtual machine via a virtual router of the another service VPC.

[0007] In a third aspect, the present application provides a traffic security protection device applied to a protected virtual router of a protected VPC, and the device comprises: a first module configured to receive a service packet from a first virtual router of a first service VPC; wherein, the service packet is sent by a first virtual machine in the first service VPC to a second virtual machine in a second service VPC; a gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is an address of a firewall in a protected VPC; and the service packet is received by the first virtual router based on an ARP proxy function; a second module configured to route the service packet to the firewall in the protected VPC, so that the firewall performs security detection on the service packet; a third module configured to, after passing the security detection, forward the service packet to a second virtual router of the second service VPC, so that the second virtual router sends the service packet to the second virtual machine.

[0008] In a fourth aspect, the present application provides a traffic security protection device applied to a virtual router of a service VPC, and the device comprises: a fourth module configured to receive an out-bound service packet sent by a first virtual machine in a current service VPC based on an ARP proxy function; wherein, a destination of the out-bound service packet is a second virtual machine in another service VPC; a gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is an address of a firewall in a protected VPC; a fifth module configured to forward the out-bound service packet to a protected virtual router of the protected VPC, so that the protected virtual router routes the out-bound service packet to the firewall for security detection, and sends the out-bound service packet passing the security detection to the second virtual machine via a virtual router of the another service VPC.

[0009] In a fifth aspect, the present application provides a traffic security protection system, comprising a protected VPC, a first service VPC and a second service VPC; The protected VPC is equipped with a protective virtual router and firewall. The first service VPC is equipped with a first virtual machine and a first virtual router. The gateway address of the first virtual machine is a virtual IP address, which is the address of the firewall protecting the VPC. The first virtual router has ARP proxy function enabled. The second service VPC is equipped with a second virtual machine and a second virtual router. The first virtual router is used to receive service packets from the first virtual machine based on the ARP proxy function and forward them to the protection virtual router. The destination of the service packets is the second virtual machine in the second service VPC. The protection virtual router is used to route the service packets to the firewall for security detection and to send the security-detected service packets to the second virtual machine via the second virtual router.

[0010] In a sixth aspect, this application provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform the method described above.

[0011] In a seventh aspect, this application provides a computer program product that, when run on a computer, causes the computer to perform the method described above.

[0012] The technical solution provided in this application has the following beneficial effects: This application's traffic security protection solution, without modifying the VPC routing table, uses host routing and ARP proxy functions to direct east-west traffic to a designated firewall, achieving path reachability and security protection for bidirectional traffic. By centrally deploying security resources such as firewalls in a dedicated protected VPC, the firewall's protection scope is expanded, and load balancing performance is improved.

[0013] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0014] The accompanying drawings, which are incorporated in and form part of this application, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0015] Figure 1 A network diagram illustrating a traditional east-west traffic security protection scheme. Figure 2 This is a schematic diagram of the first flow of the traffic security protection method provided in the embodiments of this application; Figure 3 This is a second flowchart illustrating the traffic security protection method provided in the embodiments of this application; Figure 4 This is a schematic diagram of the third flow of the traffic security protection method provided in the embodiments of this application; Figure 5 This is a network diagram illustrating the traffic security protection method provided in the embodiments of this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the embodiments of this application is only used to describe specific embodiments of this application and is not intended to limit this application.

[0017] In the fields of cloud computing and network security technology, there is a type of cloud platform architecture that does not support users directly editing VPC routing tables. In such cloud platforms, VPC-level routing policies are uniformly managed or strictly locked by the cloud service provider. Users cannot modify the VPC routing table through regular operations, and therefore cannot use traditional methods of modifying routes to direct east-west traffic (i.e., cross-VPC business traffic) to designated security devices.

[0018] Traditional solutions such as Figure 1 As shown, this solution deploys a firewall (such as...) in the VPC1 subnet. Figure 1 The example illustrates a firewall (FW), which attempts to force traffic through the firewall by configuring host routing on virtual machines with communication needs (such as vm1 in VPC1 and vm4 in VPC2) and pointing their default gateways to the firewall's IP address. However, this traditional approach has the following significant drawbacks: (1) Return message path unreachable. The request message can be delivered to the destination virtual machine through the firewall, but the next hop of the return message returned by the destination virtual machine is set to the firewall. Since the firewall address and the source address are not in the same network segment, ARP (Address Resolution Protocol) resolution fails, resulting in the failure of return message delivery.

[0019] (2) Firewall protection scope is limited. Firewalls can only protect traffic within their own subnet and cannot cover other subnets.

[0020] (3) Uneven traffic distribution. The traditional traffic diversion method causes all cross-VPC traffic to be concentrated in a specific subnet with a firewall deployed, resulting in uneven network link load and affecting overall network performance.

[0021] (4) Occupying business network resources. Firewalls are deployed in business VPCs, occupying the subnet IP resources of business VPCs and being deployed mixed with business virtual machines, wasting valuable business network address resources, and may also affect the stability of services due to security equipment failure or maintenance.

[0022] Therefore, how to build a stable, reliable, and comprehensive east-west traffic security detection path without relying on VPC routing policies, solely through the coordinated use of cloud host-level routing configuration and network functions, has become a technical challenge in this field.

[0023] To address the aforementioned issues, this application provides a traffic security protection solution that, without modifying the VPC routing table, uses host routing and ARP proxy functions to direct east-west traffic to a designated firewall, effectively overcoming problems such as unreachable return paths, limited protection scope, uneven traffic distribution, and occupation of business network resources.

[0024] The practical application of this application will be described in detail below through specific embodiments.

[0025] Example 1 This embodiment provides a traffic security protection method, which uses a protected virtual router for VPCs as the execution entity. For example... Figure 2 As shown, the method includes: Step 210: Receive service packets from the first virtual router of the first service VPC; The service message in this step refers to the service message sent from the first virtual machine in the first service VPC to the second virtual machine in the second service VPC. This service message is sent by the first virtual machine, forwarded by the first virtual router, and finally arrives at the protection virtual router.

[0026] Specifically, the gateway address of the first virtual machine is pre-configured as a virtual IP address, which is the address of the firewall within the VPC. The first virtual router has ARP enabled. When the first virtual machine attempts to send data to its gateway, since the gateway and the first virtual machine are not on the same network segment, the first virtual machine first initiates an ARP request to resolve the gateway's MAC address. At this time, the first virtual router, with ARP proxy enabled, recognizes that the virtual IP address is reachable and responds to the ARP request with its own MAC address. After receiving this response, the first virtual machine encapsulates a service packet with the destination MAC address being the first virtual router's MAC address and sends it, thus enabling the first virtual router to successfully receive the service packet. Because the first virtual router supports forwarding packets with next-hop addresses not in its directly connected network segment, it then forwards the service packet to the protecting virtual router. Therefore, the aforementioned service packet was received by the first virtual router based on its ARP proxy function.

[0027] Step 220: Route the service packet to the firewall within the protected VPC so that the firewall can perform security checks on the service packet; After successfully receiving a service packet, the protection virtual router will, according to its internal routing or policy configuration, route the service packet to protect only the virtual IP address preset within the VPC. This virtual IP address is associated with the firewall, thus triggering the firewall to perform security checks on the service packet.

[0028] Optionally, the firewall can perform deep inspection and filtering of business packets based on its built-in security policy set (such as access control lists, intrusion prevention rules, etc.) to determine whether to allow them to pass.

[0029] Step 230: After passing the security test, forward the service message to the second virtual router of the second service VPC so that the second virtual router can deliver the service message to the second virtual machine.

[0030] Once the service packet successfully passes the firewall's security check and is allowed to pass, the protective virtual router will forward the service packet to the second virtual router of the second service VPC according to the packet's destination. After receiving the service packet, the second virtual router will perform standard network routing operations and deliver the service packet to the second virtual machine according to the subnet information where the second virtual machine is located, thus completing a complete, secure east-west communication process.

[0031] In this embodiment, the firewall associated with the virtual IP address refers to a logical unit or set of computing resources that performs firewall functions (such as stateful inspection, access control, intrusion prevention, etc.) in a cloud environment. Specifically, the firewall can be a single firewall instance, i.e., an independent virtual machine or container with firewall software installed, or a firewall cluster composed of two or more firewall instances, which together provide highly available firewall services to the outside world.

[0032] Optionally, the firewall in step 220 can be a firewall cluster, and the virtual IP address is the load balancing address provided by the firewall cluster to the outside world.

[0033] Furthermore, the firewall cluster can specifically consist of a primary firewall instance and a backup firewall instance, with the virtual IP address being a highly available address provided to the outside world by the primary and backup firewall instances.

[0034] Optionally, the aforementioned service message can be either a request message or a response message. Specifically, when the first virtual machine, as the communication initiator, accesses the second virtual machine, the aforementioned service message is a request message sent from the first virtual machine to the second virtual machine; when the first virtual machine, as the response provider, returns data to the second virtual machine, the aforementioned service message is a response message sent from the first virtual machine to the second virtual machine.

[0035] The protection processes for request and response messages are symmetrical, and the protection mechanism in this embodiment is effective for both bidirectional service messages.

[0036] This embodiment protects the VPC as an independent logical entity by utilizing ARP proxy and virtual IP technology to reconstruct the east-west traffic path between VPCs, ensuring it passes through the firewall, without modifying the VPC routing table. It possesses at least the following technical advantages: (a) Path reachability and security protection for bidirectional traffic were achieved. By configuring the virtual machine's gateway address to the address of the firewall within the protection VPC, and by enabling ARP proxy on the virtual routers of the business VPC and the protection VPC, a logically closed, complete, and reliable security detection path was constructed. Whether it's a request or response packet, all next-hop addresses on its path can be successfully resolved to MAC addresses through the ARP proxy function, completely solving the problem of unreachable return packets and ensuring the stability of bidirectional communication.

[0037] (b) Expanded firewall protection scope. An innovative independent protection VPC was introduced, and the firewall was deployed within this protection VPC. Through gateway configuration and ARP proxy, east-west traffic between any business VPCs can be diverted to the centralized protection VPC for security inspection. This expands the firewall's protection scope beyond a single subnet to all business VPCs connected to this architecture.

[0038] (c) Improved load balancing performance. All cross-VPC business traffic is routed to a dedicated protected VPC, facilitating horizontal scaling of processing capacity through firewall clustering technology and load balancing mechanisms, thus avoiding single points of failure.

[0039] (d) By creating an independent protection VPC, all security resources (such as firewalls) are deployed inside the protection VPC, so that the firewall no longer occupies any IP address resources of the business VPC, thus avoiding resource competition between security resources and business VPCs.

[0040] Example 2 This embodiment provides a traffic security protection method, which uses the virtual router of the service VPC as the execution entity. For example... Figure 3 As shown, the method includes: Step 310: Based on the ARP proxy function, receive the outbound service packets sent by the first virtual machine in the current service VPC; In this embodiment, the current business VPC refers to the business VPC that acts as the execution entity.

[0041] When the first virtual machine in the current business VPC needs to access the second virtual machine in another business VPC, a directional service packet is generated. The gateway address of the first virtual machine is pre-configured as a virtual IP address, which is the address of the firewall within the VPC. Therefore, the first virtual machine sends all traffic destined for non-subnets (including cross-VPCs) to this virtual IP address.

[0042] When the first virtual machine attempts to send data to the second virtual machine, it initiates an ARP request for the gateway address. Although the virtual IP address is not located in the same network segment as the first virtual machine, the virtual router in the current service VPC has ARP proxy enabled. Therefore, after listening to the ARP request, the virtual router recognizes that the virtual IP address is reachable by its own route and responds with its own MAC address. The first virtual machine then encapsulates a service packet with the destination MAC address as the virtual router's MAC address and sends it, thus enabling the virtual router in the current service VPC to successfully receive the outgoing service packet.

[0043] Step 320: Forward the outbound service packets to the protection virtual router of the protection VPC, so that the protection virtual router routes the outbound service packets to the firewall for security detection, and sends the outbound service packets that pass the security detection to the second virtual machine via the virtual router of another service VPC.

[0044] After receiving outbound service packets, the virtual router does not directly forward them to another service VPC. Instead, it forwards them to the protection virtual router within the protected VPC. This operation aims to channel traffic to a centralized security inspection node. The protection virtual router then routes the packets to the firewall associated with the virtual IP address. The firewall performs security checks on the packets. If the security check passes, the protection virtual router forwards the packets to the virtual router of the other service VPC, ultimately ensuring that the packets reach the second virtual machine.

[0045] As can be seen, this embodiment achieves secure traffic redirection across VPCs in a restricted network environment where the VPC routing table cannot be modified, by leveraging the capabilities of the virtual router itself.

[0046] The protection mechanism in this embodiment also applies to inbound service packets returning from the outside to the current service VPC. Specifically, such as... Figure 4 As shown, it includes the following steps: Step 410: Receive inbound service packets from the protection virtual router of the protection VPC; wherein, the inbound service packets are service packets sent to the target virtual machine in the current service VPC after passing the security inspection of the firewall in the protection VPC. The aforementioned inbound service packets have completed a full security inspection process before reaching the current service VPC. Specifically, the packets initially originate from other service VPCs, are diverted to the protection VPC, and after successfully passing the security inspection of the firewall within the protection VPC, are confirmed as safe traffic before being sent to the current service VPC by the protection virtual router of the protection VPC.

[0047] Step 420: Deliver the inbound service message to the target virtual machine.

[0048] After receiving the inbound service message, the virtual router of the current service VPC performs a routine route lookup. Since the target virtual machine is within its directly connected network range, the message is directly sent to the target virtual machine, thus completing the return path of this communication.

[0049] As can be seen, this embodiment achieves bidirectional, closed-loop security protection for east-west traffic. Whether it's outbound traffic originating from the current business VPC or inbound traffic returning to the current business VPC, it must undergo security inspection by the firewall centrally deployed in the protected VPC, ensuring the full-path, consistent application of security policies and improving the security level of the cloud platform's internal network.

[0050] Example 3 This embodiment illustrates the practical application of this application through a specific example.

[0051] The following is combined with Figure 5 The network parameters shown are described in detail in this embodiment: 1. Create and configure a VPC Create a service VPC named VPC1 and enable the ARP proxy function of its virtual router. Create two subnets under VPC1: 192.168.1.0 / 24 and 192.168.2.0 / 24; Create a service VPC named VPC2 and enable its virtual router's ARP proxy function. Create two subnets under VPC2: 10.10.1.0 / 24 and 10.10.2.0 / 24. Create a dedicated protected VPC, named Protected VPC, to deploy security resources (such as firewalls) and enable cross-VPC traffic redirection. Create a subnet within the Protected VPC: 192.168.10.0 / 24.

[0052] 2. Deploy virtual machines Deploy a virtual machine vm1 in the subnet 192.168.1.0 / 24 of VPC1, assign it the IP address 192.168.1.1, and point its initial gateway to the virtual router vroute1 of VPC1; Deploy a virtual machine vm3 in subnet 10.10.1.0 / 24 of VPC2, assign it the IP address 10.10.1.1, and set its initial gateway to the virtual router vroute2 of VPC2.

[0053] 3. Deploy a firewall Deploy two firewall virtual machines, FW1 and FW2, in the subnet 192.168.10.0 / 24 under the protected VPC. Configure them as a high-availability cluster in primary / standby mode, and assign the virtual machine IP address 192.168.10.99 to this cluster. Configure the firewall gateway as the virtual router protection vroute within the protected VPC.

[0054] 4. Network interconnection and routing learning Establish a peering connection between vroute1 and the protected vroute, and simultaneously establish a peering connection between vroute2 and the protected vroute, so that the virtual routers can automatically learn routing information.

[0055] 5. Virtual machine routing configuration Change the default gateway of vm1 to the virtual IP address of the firewall cluster, 192.168.10.99, to ensure that traffic from VPC1 to other VPCs is redirected to the firewall.

[0056] Add a host route in the VM1 operating system: destination network segment 192.168.2.0 / 24, next hop address of vroute1. Ensure normal cross-subnet traffic communication within VPC1.

[0057] Change the default gateway of VM3 to the virtual IP address of the firewall cluster, 192.168.10.99, to ensure that traffic from VPC2 to other VPCs is redirected to the firewall.

[0058] Add a host route in the VM3 operating system: destination network segment 10.10.2.0 / 24, next hop address of vroute2. Ensure normal cross-subnet traffic communication within VPC2.

[0059] The above configuration establishes a complete traffic security protection system. All cross-VPC business traffic is routed to the protected VPC, where it undergoes unified security inspection by the firewall cluster before being forwarded. Simultaneously, host routing ensures direct communication between subnets within the VPC, achieving a balance between security protection and communication efficiency.

[0060] The following describes the request message transmission path: (A1) vm1 in VPC1 initiates access to vm3 in VPC2, generating a request message with a source address of 192.168.1.1 and a destination address of 10.10.1.1.

[0061] (A2) According to the gateway configuration of VM1, the next hop for the request packet is the firewall address 192.168.10.99. VM1 initiates an ARP request to resolve the MAC address corresponding to IP address 192.168.10.99. Since IP address 192.168.10.99 is not in the subnet where VM1 is located, and vroute1 of VPC1 discovers that the next hop address 192.168.10.99 is reachable by itself based on the ARP proxy function, it replies to the ARP request with its own MAC address.

[0062] (A3) vm1 assembles Ethernet frames accordingly, with the source MAC being the MAC of vm1 and the destination MAC being the MAC of vroute1.

[0063] (A4) vm1 will send the encapsulated request message to vroute1.

[0064] (A5) vroute1 supports forwarding of non-directly connected network segments, forwarding packets to the protected VPC. Specifically, vroute1 forwards packets to the protected vroute of the protected VPC, and the protected vroute routes the packets to the firewall for security inspection.

[0065] (A6) After the firewall completes the security test, it will return the request message to the protection vroute according to the gateway settings.

[0066] (A7) Based on the learned routing information, the protection vroute identifies that the destination network segment 10.10.1.0 / 24 of the request packet belongs to VPC2, so it sends the request packet to vroute2.

[0067] (A8) vroute2 confirms that the destination network segment of the request message is the internal subnet of this VPC and delivers the request message to vm3.

[0068] The transmission path of the response message will be explained below: (B9) After processing the request message, VM3 generates a response message. The source address of the response message is 10.10.1.1, and the destination address is 192.168.1.1.

[0069] (B10) According to the gateway configuration of VM3, the next hop of the reply packet is the firewall address 192.168.10.99. VM3 initiates an ARP request to resolve the MAC address corresponding to IP address 192.168.10.99. Since IP address 192.168.10.99 is not on the subnet where VM3 is located, and vroute2 of VPC2 discovers that the next hop address 192.168.10.99 vroute1 itself is reachable based on the ARP proxy function, it replies to the ARP request with its own MAC address.

[0070] (B11) vm3 assembles Ethernet frames accordingly, with the source MAC being the MAC of vm3 and the destination MAC being the MAC of vroute2.

[0071] (B12) vm3 will send the encapsulated response message to vroute2.

[0072] (B13) The virtual router vroute2 supports forwarding packets whose next-hop address is not in its directly connected network segment. It forwards the packets to the protected VPC. Specifically, vroute2 forwards the packets to the protected vroute within the protected VPC, and the protected vroute routes the packets to the firewall for security inspection.

[0073] (B14) After the firewall completes the security test, it will return the request message to the protection vroute according to the gateway settings.

[0074] (B15) Based on the learned routes, the protection vroute identifies that the destination network segment 192.168.1.0 / 24 of the reply message belongs to VPC1, and then sends the reply message to vroute1.

[0075] (B16) vroute1 confirms that the destination network segment of the response message is the internal subnet of this VPC and sends the response message to vm1.

[0076] This embodiment provides a traffic security protection method. In a cloud platform architecture that does not support users to directly edit the VPC routing table and only supports modifying the host routing within the operating system of a single cloud host, it utilizes ARP proxy and virtual IP to achieve bidirectional, closed-loop security protection for east-west traffic.

[0077] Based on the same inventive concept, this application also provides a flow safety protection device.

[0078] Example 4 This embodiment provides a traffic security protection device applied to a protected virtual router for protecting VPCs. The device includes: The first module is used to receive service packets from the first virtual router of the first service VPC; wherein the service packets are sent from the first virtual machine in the first service VPC to the second virtual machine in the second service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC; the service packets are received by the first virtual router based on the ARP proxy function; The second module is used to route the service packets to the firewall within the protected VPC, so that the firewall can perform security checks on the service packets. The third module is used to forward service packets to the second virtual router of the second service VPC after passing the security test, so that the second virtual router can deliver the service packets to the second virtual machine.

[0079] Optionally, the firewall is a firewall cluster, and the virtual IP address is the load balancing address provided by the firewall cluster to the outside world.

[0080] Furthermore, the firewall cluster includes a primary firewall instance and a backup firewall instance, and the virtual IP address is a high-availability address provided to the outside world by the primary firewall instance and the backup firewall instance.

[0081] Optionally, the service message may be a request message or a response message.

[0082] Example 5 This embodiment provides a traffic security protection device applied to a virtual router in a business VPC. The device includes: The fourth module is used to receive outbound service packets sent by the first virtual machine in the current service VPC based on the ARP proxy function; wherein the destination of the outbound service packets is the second virtual machine in another service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC. The fifth module is used to forward the outgoing service packets to the protection virtual router of the protection VPC, so that the protection virtual router routes the outgoing service packets to the firewall for security detection, and sends the outgoing service packets that pass the security detection to the second virtual machine via the virtual router of another service VPC.

[0083] Optionally, the device further includes: The sixth module is used to receive inbound service packets from the protection virtual router of the protection VPC; wherein the inbound service packets are service packets sent to the target virtual machine in the current service VPC after passing the security inspection of the firewall in the protection VPC. The seventh module is used to deliver the inbound service message to the target virtual machine.

[0084] Based on the same inventive concept, this application also provides a traffic security protection system.

[0085] Example 6 This embodiment provides a traffic security protection system, including a protection VPC and at least two service VPCs. The following description uses an example where the system includes two service VPCs: a first service VPC and a second service VPC.

[0086] The protected VPC is equipped with a protective virtual router and firewall. The first service VPC is equipped with a first virtual machine and a first virtual router. The gateway address of the first virtual machine is a virtual IP address, which is the address of the firewall protecting the VPC. The first virtual router has ARP proxy function enabled. The second service VPC is equipped with a second virtual machine and a second virtual router. The first virtual router is used to receive service packets from the first virtual machine based on the ARP proxy function and forward them to the protection virtual router. The destination of the service packets is the second virtual machine in the second service VPC. The protection virtual router is used to route the service packets to the firewall for security detection and to send the security-detected service packets to the second virtual machine via the second virtual router.

[0087] This application also provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform the various functions or steps of the above method embodiments.

[0088] The aforementioned computer-readable storage media include, but are not limited to, any of the following: USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media capable of storing program code.

[0089] This application also provides a computer program product that, when run on a computer, causes the computer to perform various functions or steps of the above method embodiments.

[0090] The electronic devices, computer-readable storage media, and computer program products provided in this application embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0091] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various variations or substitutions can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for traffic security protection, characterized in that, The method, applied to a protective virtual router for VPCs, includes: Receive service packets from the first virtual router of the first service VPC; wherein the service packets are sent from the first virtual machine in the first service VPC to the second virtual machine in the second service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC; the service packets are received by the first virtual router based on the ARP proxy function; The service packets are routed to the firewall within the protected VPC, so that the firewall can perform security checks on the service packets. After passing the security check, the service message is forwarded to the second virtual router of the second service VPC, so that the second virtual router can deliver the service message to the second virtual machine.

2. The method according to claim 1, characterized in that, The firewall is a firewall cluster, and the virtual IP address is the load balancing address provided by the firewall cluster to the outside world.

3. The method according to claim 2, characterized in that, The firewall cluster includes a primary firewall instance and a backup firewall instance, and the virtual IP address is a high-availability address provided to the outside world by the primary firewall instance and the backup firewall instance.

4. The method according to claim 1, characterized in that, The service message can be a request message or a response message.

5. A method for traffic security protection, characterized in that, The method, applied to a virtual router in a business VPC, includes: Based on the ARP proxy function, outbound service packets sent by the first virtual machine in the current service VPC are received; wherein, the destination of the outbound service packets is the second virtual machine in another service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC. The outbound service packets are forwarded to the protection virtual router of the protection VPC, so that the protection virtual router routes the outbound service packets to the firewall for security inspection, and sends the outbound service packets that pass the security inspection to the second virtual machine via the virtual router of another service VPC.

6. The method according to claim 5, characterized in that, The method further includes: Receive inbound service packets from the protection virtual router of the protection VPC; wherein, the inbound service packets are service packets sent to the target virtual machine in the current service VPC after passing the security inspection of the firewall in the protection VPC. The inbound service message is delivered to the target virtual machine.

7. A flow safety protection device, characterized in that, A protective virtual router for protecting VPCs, the device comprising: The first module is used to receive service packets from the first virtual router of the first service VPC; wherein the service packets are sent from the first virtual machine in the first service VPC to the second virtual machine in the second service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC; the service packets are received by the first virtual router based on the ARP proxy function; The second module is used to route the service packets to the firewall within the protected VPC, so that the firewall can perform security checks on the service packets. The third module is used to forward service packets to the second virtual router of the second service VPC after passing the security test, so that the second virtual router can deliver the service packets to the second virtual machine.

8. A flow safety protection device, characterized in that, A virtual router used in a business VPC, the device comprising: The fourth module is used to receive outbound service packets sent by the first virtual machine in the current service VPC based on the ARP proxy function; wherein the destination of the outbound service packets is the second virtual machine in another service VPC; the gateway address of the first virtual machine is a virtual IP address, and the virtual IP address is the address of the firewall in the VPC. The fifth module is used to forward the outgoing service packets to the protection virtual router of the protection VPC, so that the protection virtual router routes the outgoing service packets to the firewall for security detection, and sends the outgoing service packets that pass the security detection to the second virtual machine via the virtual router of another service VPC.

9. A traffic security protection system, characterized in that, include: Protect the VPC, the primary service VPC, and the secondary service VPC; The protected VPC is equipped with a protective virtual router and firewall. The first service VPC is equipped with a first virtual machine and a first virtual router. The gateway address of the first virtual machine is a virtual IP address, which is the address of the firewall protecting the VPC. The first virtual router has ARP proxy function enabled. The second service VPC is equipped with a second virtual machine and a second virtual router. The first virtual router is used to receive service packets from the first virtual machine based on the ARP proxy function and forward them to the protection virtual router. The destination of the service packets is the second virtual machine in the second service VPC. The protection virtual router is used to route the service packets to the firewall for security detection and to send the security-detected service packets to the second virtual machine via the second virtual router.

10. A computer-readable storage medium comprising computer instructions, characterized in that, When the computer instructions are executed on the electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-6.

11. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1-6.

Images