Message processing method, device and equipment, and storage medium

Abstract

The present disclosure provides a message processing method and device, equipment and storage medium, comprising: in response to receiving a to-be-processed message, extracting quintuple information from the to-be-processed message; matching the quintuple information with the index key of the session table to determine the type of the to-be-processed message, wherein the index key of the session table is constructed based on the quintuple information of the established session; in response to the type of the to-be-processed message being a first packet, matching the quintuple information with the index key of the association mapping table to determine whether the to-be-processed message is an associated session of the main session, wherein the index key of the association mapping table is constructed based on the IP address and port information obtained by parsing the application layer of the control channel message of the multi-channel protocol, and the main session is the session of the control channel; in response to the to-be-processed message being an associated session of the main session, performing forwarding processing on the to-be-processed message.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a message processing method, apparatus, device, and storage medium. Background Technology

[0002] Firewalls, as a core access control technology for network security, primarily use security policies to filter and control the forwarding of incoming and outgoing traffic. For multi-channel protocols, while the control channel port is fixed, the data channel address and port are dynamically negotiated during communication. Since administrators cannot predict these dynamic ports, traditional static security policies struggle to provide precise access. Opening all ports to ensure business continuity exposes the server to significant security risks. Summary of the Invention

[0003] In view of this, the present disclosure provides a message processing method, apparatus, device and storage medium.

[0004] One aspect of this disclosure provides a message processing method, comprising: in response to receiving a message to be processed, extracting 5-tuple information from the message to be processed; matching the 5-tuple information with an index key of a session table to determine the type of the message to be processed, wherein the index key of the session table is constructed based on the 5-tuple information of established sessions; in response to the message to be processed being a first packet, matching the 5-tuple information with an index key of an association mapping table to determine whether the message to be processed is an associated session of a main session, wherein the index key of the association mapping table is constructed based on IP address and port information obtained from application layer parsing of control channel messages of a multichannel protocol, and the main session is a control channel session; and in response to the message to be processed being an associated session of a main session, forwarding the message to be processed.

[0005] This embodiment of the disclosure accurately identifies whether the message to be processed is associated with the main session of the multi-channel protocol through the association mapping table, that is, whether it is a message of the data channel. This can ensure that the multi-channel service data channel can be connected normally, while avoiding the security risks of statically open ports, and taking into account forwarding efficiency, service availability and network security.

[0006] According to embodiments of this disclosure, the method further includes: in response to the message type of the message to be processed being a subsequent message, forwarding the message to be processed and determining whether the application layer protocol of the message to be processed is a multi-channel protocol; in response to the application layer protocol of the message to be processed being a multi-channel protocol, calling a callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed to obtain the IP address and port; using the IP address as the destination IP address and the port as the destination port, and based on the destination IP address, destination port, and the source IP, source port, and communication protocol in the five-tuple information, forming the five-tuple information of the data channel of the multi-channel protocol; adding an index key in the association mapping table according to the five-tuple information of the data channel; adding a key-value relationship in the association mapping table based on the added index key, wherein the value corresponding to the added index key includes the association mapping table entry pool index and the table entry index.

[0007] This embodiment of the disclosure parses the application layer of the control channel messages, which enables the first packet of the data channel to be accurately identified and allowed, ensuring the normal establishment of multi-channel services, reducing the risk of port exposure, and improving processing efficiency and network security.

[0008] According to embodiments of this disclosure, the method further includes: configuring a 5-tuple mask for the newly added index key, the 5-tuple mask being determined based on the application layer protocol of the message to be processed; wherein the 5-tuple mask is used to identify the information in the newly added index key that participates in matching and the information that does not participate in matching.

[0009] This embodiment of the disclosure, by configuring a protocol-adaptive 5-tuple mask, can flexibly control the matching accuracy, adapt to the identification rules of different multi-channel protocols for associated sessions, and improve the search efficiency.

[0010] According to embodiments of this disclosure, the value corresponding to the index key in the session table includes a session pool index and a session table entry index. Determining whether the application layer protocol of the message to be processed is a multi-channel protocol includes: determining a target session pool from multiple session pools based on the session pool index corresponding to the index key in the session table, wherein the target session pool stores at least one session table entry; determining a target session table entry from at least one session table entry included in the target session pool based on the session table entry index; and determining that the application layer protocol of the message to be processed is a multi-channel protocol if the multi-channel protocol flag bit included in the target session table entry is a preset value.

[0011] The two-level design of the session table in this embodiment enables rapid and accurate retrieval of target session entries from a large number of sessions, significantly improving session lookup efficiency and reducing device memory overhead. By reading the multi-channel protocol flag bits in the session table entry, the protocol type can be directly determined without repeatedly parsing packets, thus improving processing speed.

[0012] According to embodiments of this disclosure, calling a callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed includes: determining the protocol entry corresponding to the protocol entry index from the protocol entry pool based on the protocol entry index included in the session entry, wherein the protocol entry includes a multi-channel protocol and a corresponding callback function; and calling the callback function to parse the application layer of the message to be processed to obtain the IP address and port.

[0013] This embodiment of the disclosure uses a protocol lookup table to identify messages, which can detect whether the protocol of the current session belongs to a multi-channel protocol. Furthermore, the protocol table entry index can be used to quickly locate the callback function corresponding to the multi-channel protocol, improving parsing efficiency and message processing efficiency.

[0014] According to embodiments of this disclosure, the method further includes: in response to the failure of matching the five-tuple information with the index key of the associated mapping table, matching the five-tuple information of the message to be processed with a preset security policy; and based on the matching result of the five-tuple information and the preset security policy, forwarding the message to be processed or discarding the message to be processed.

[0015] This embodiment of the disclosure achieves rapid access for associated sessions of multi-channel protocols and implements strict security control for unassociated sessions through the judgment mechanism of association mapping table and security policy.

[0016] According to embodiments of this disclosure, forwarding or discarding a packet to be processed based on the matching result of the five-tuple information and a preset security policy includes: in response to a matching result indicating that forwarding is allowed, forwarding the packet to be processed and creating a session entry for the packet to be processed; constructing a protocol lookup key based on the IP version, communication protocol, and destination port of the packet to be processed, and searching in the protocol lookup table based on the protocol lookup key, wherein the protocol lookup table uses the IP version, communication protocol, and destination port as index keys, and the value corresponding to the index key of the protocol lookup table is the protocol entry index; in response to finding the protocol lookup key in the index key of the protocol lookup table, setting the multi-channel protocol flag bit in the session entry of the packet to be processed to a preset value and storing the protocol entry index in the session entry.

[0017] This embodiment of the disclosure enables rapid identification of multi-channel protocol control sessions through a protocol lookup table, and automatically executes the setting of multi-channel protocol flag bits and the writing of protocol table entry indexes. This achieves automatic marking and association of multi-channel protocol sessions.

[0018] Another aspect of this disclosure provides a message processing apparatus, comprising: an extraction module, configured to extract 5-tuple information from a message to be processed in response to receiving a message to be processed; a first processing module, configured to match the 5-tuple information with an index key of a session table to determine the type of the message to be processed, wherein the index key of the session table is constructed based on the 5-tuple information of established sessions; a second processing module, configured to match the 5-tuple information with an index key of an association mapping table in response to the message to be processed being a first packet, to determine whether the message to be processed is an associated session of a main session, wherein the index key of the association mapping table is constructed based on the IP address and port information obtained from the application layer parsing of control channel messages of a multichannel protocol, and the main session is a control channel session; and a forwarding module, configured to forward the message to be processed in response to the message to be processed being an associated session of a main session.

[0019] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method described above.

[0020] Another aspect of this disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0021] Another aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0023] The above and other objects, features and advantages of this disclosure will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 A flowchart illustrating a message processing method according to an embodiment of the present disclosure is shown schematically.

[0025] Figure 2 A schematic diagram illustrating the structure of an association mapping table according to an embodiment of the present disclosure is shown.

[0026] Figure 3 A schematic diagram illustrating the structure of a session table according to an embodiment of the present disclosure is shown.

[0027] Figure 4This illustration schematically shows a structural diagram of a protocol lookup table according to an embodiment of the present disclosure;

[0028] Figure 5 A flowchart illustrating a message processing method according to another embodiment of this disclosure is shown schematically;

[0029] Figure 6 A schematic block diagram of a message processing apparatus according to embodiments of the present disclosure is shown; and

[0030] Figure 7 A schematic block diagram of an electronic device that can be used to implement the message processing method of the embodiments of the present disclosure is shown. Detailed Implementation

[0031] The embodiments of this disclosure will now be described with reference to the accompanying drawings. Various details of the embodiments of this disclosure are included to aid understanding and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0032] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0033] A firewall is an access control technology that protects a network by allowing only specific types of traffic to pass through. The internet is rife with cyber threats, and certain types of data must be blocked to ensure online safety. Otherwise, malware could enter the network and then spread to various connected devices.

[0034] Firewalls achieve this control by inspecting data packets; packets are essentially collections of data containing instructions on how to process the data as it arrives at its destination. The data within these packets can be inspected by the firewall to determine if it contains threats. This process includes examining how the data should be connected to the network and how it moves within the network.

[0035] Firewalls can inspect each data packet (e.g., by examining how the data behaves or by examining the data itself) and determine whether the packet poses a threat. Once a firewall identifies data being used by a malicious entity, it can discard that data, thereby protecting the network.

[0036] The fundamental function of a firewall is to control access to and from a network, protecting a specific network from attacks by "untrusted" networks, while simultaneously allowing legitimate communication between the two networks. Firewalls implement access control through security policy technology. Security policy is a core feature of a firewall; its function is to inspect data flows passing through the firewall, allowing only legitimate traffic that conforms to the security policy to be forwarded.

[0037] Dynamic Port Opening (DPO) of a firewall, also known as stateful packet filtering, can automatically detect the application layer information of certain packets and open the corresponding access rules based on the application layer information.

[0038] Taking multi-channel protocols (such as FTP, H.323, SIP, etc.) as examples, a common characteristic of these protocols is that the control channel port is known, while the data channel ports are dynamically generated. Applying these multi-channel protocols requires first negotiating the address and port of the subsequent data channel in the control channel, and then establishing the data channel connection based on the negotiation result. Because the data channel address and port are dynamically negotiated, administrators cannot predict them, thus making it impossible to formulate comprehensive and precise security policies. To ensure the smooth establishment of the data channel, all ports must be opened, which obviously exposes the server or client to the risk of attack.

[0039] For specific applications using multi-channel protocols (such as FTP, H.323, SIP, etc.), the addresses and ports of the data channels are dynamically negotiated and cannot be predicted by the administrator. Therefore, it is impossible to formulate a comprehensive and precise security policy to allow the corresponding traffic. In order to ensure the smooth establishment of the data channel, all ports must be opened, which obviously brings the risk of attack to the server or client.

[0040] Figure 1 A flowchart illustrating a message processing method according to an embodiment of the present disclosure is shown schematically.

[0041] like Figure 1 As shown, this embodiment includes operations S110 to S140.

[0042] In operation S110, in response to receiving a message to be processed, the five-tuple information is extracted from the message to be processed.

[0043] In this embodiment of the disclosure, the message to be processed is specifically a received network data packet. The five-tuple information of the message to be processed may include the source IP address, destination IP address, source port, destination port, and the communication protocol of the message transport layer. Specifically, the five-tuple information can be extracted by parsing the header fields of the message to be processed.

[0044] In operation S120, the 5-tuple information is matched with the index key of the session table to determine the type of the message to be processed.

[0045] In this embodiment of the disclosure, the index key of the session table is constructed based on the 5-tuple information of the established sessions.

[0046] In this embodiment of the disclosure, the session table is used to record existing sessions. Specifically, it can be designed as a hash table, where the index key is the five-tuple information of the existing session, and the message types of the messages to be processed include the session first packet and the session subsequent packet.

[0047] The specific matching process can refer to searching for the existence of the 5-tuple information in the index key of the session table. If the search is successful, the message type of the message to be processed is determined to be a session follow-up packet. If the search fails, the message type of the message to be processed is determined to be a session first packet.

[0048] In operation S130, in response to the message to be processed being of type first packet, the five-tuple information is matched with the index key of the associated mapping table to determine whether the message to be processed is associated with the main session.

[0049] In this embodiment of the disclosure, the index key of the association mapping table is constructed based on the IP address and port information obtained from the application layer parsing of the control channel messages of the multichannel protocol, and the main session is the control channel session.

[0050] In this embodiment of the disclosure, the association mapping table can store data channel information negotiated from the multi-channel protocol. The index key of the association mapping table can be a five-tuple of information constructed based on the IP address and port of the data channel parsed by the application layer of the control channel message. The associated session can refer to the session of the data channel negotiated by the master session.

[0051] If the message type of the message to be processed is a session header packet, then the index key in the association mapping table can be used to check if the 5-tuple information exists. If the search is successful, it means that the message to be processed is associated with the main session, that is, the message to be processed is a data packet of the data channel, used to transmit specific data, such as a file. If the search fails, it means that the message to be processed is not associated with the main session.

[0052] In operation S140, in response to the associated session of the main session, the pending message is forwarded.

[0053] In this embodiment of the disclosure, if the message to be processed is associated with the main session, it means that the message can be allowed to pass. Specifically, the message can be forwarded according to the destination IP address and destination port in the message's five-tuple information.

[0054] This embodiment of the disclosure quickly distinguishes whether a packet is the first packet or a subsequent packet in a session by extracting the five-tuple information and matching it with the session table. For the first packet, the associated session of the multi-channel protocol master session of the packet to be processed can be accurately identified through the association mapping table. The association mapping table records the information of the data channel of the control channel protocol in the multi-channel protocol. In this way, it can ensure that the multi-channel service data channels can be connected normally, while avoiding the security risks of statically open ports, and balancing forwarding efficiency, service availability and network security.

[0055] According to embodiments of this disclosure, the method further includes: in response to the message type of the message to be processed being a subsequent message, forwarding the message to be processed and determining whether the application layer protocol of the message to be processed is a multi-channel protocol; in response to the application layer protocol of the message to be processed being a multi-channel protocol, calling a callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed to obtain the IP address and port; using the IP address as the destination IP address and the port as the destination port, and based on the destination IP address, destination port, and the source IP, source port, and communication protocol in the five-tuple information, forming the five-tuple information of the data channel of the multi-channel protocol; adding an index key in the association mapping table according to the five-tuple information of the data channel; adding a key-value relationship in the association mapping table based on the added index key, wherein the value corresponding to the added index key includes the association mapping table entry pool index and the table entry index.

[0056] In this embodiment of the disclosure, if the message type of the message to be processed is a subsequent message, it indicates that the message is a data packet of an existing session and can be forwarded. Simultaneously, it is necessary to determine whether the application layer protocol of the message to be processed is a multi-channel protocol, that is, whether the message is a control channel message that requires a protocol data channel port.

[0057] A callback function can refer to a pre-stored callback function that can parse the application layer of a message. This function is a dedicated parsing logic written for a specific multi-channel protocol, which can parse the IP address and port of the data channel from the application layer of the message.

[0058] After obtaining the IP address and port, the resolved IP address can be used as the destination IP address, and the resolved port as the destination port. Combined with the source IP address, source port, and communication protocol from the five-tuple information of the packet to be processed, a five-tuple information is formed. This five-tuple information is the five-tuple information of the data channel. An index key is added to the association mapping table for matching and searching when the first packet of the subsequent data channel arrives. A key-value relationship is added for the newly added index key. The association mapping table may include a hash table specifically used to identify multi-channel protocol association sessions, storing data channel information negotiated by the main session, i.e., the control channel. The entry pool is a pre-allocated memory area used to uniformly store the contents of all association mapping table entries. The association mapping table entry pool index is used to identify which entry pool the entry corresponding to the five-tuple information specifically exists in. The entry index can be associated with the specific location of the entry within that pool. Combining the entry pool index and the entry index, the device can accurately locate the complete content of a specific association mapping table entry, enabling efficient table lookup, reading, and management.

[0059] This embodiment of the disclosure, while forwarding subsequent packets, automatically identifies multi-channel protocols and parses data channel information through callback functions. It dynamically constructs a data channel 5-tuple and adds it to an association mapping table, forming an index key and key-value relationship that can be used for matching. This achieves automatic establishment of associated session identification rules without requiring manual configuration of static port policies, ensuring accurate identification and passage of the first packet of the data channel, guaranteeing the normal establishment of multi-channel services, reducing port exposure risks, and improving processing efficiency and network security.

[0060] According to embodiments of this disclosure, the method further includes: configuring a 5-tuple mask for the newly added index key, the 5-tuple mask being determined based on the application layer protocol of the message to be processed; wherein the 5-tuple mask is used to identify the information in the newly added index key that participates in matching and the information that does not participate in matching.

[0061] In this embodiment, when a dynamic port that needs to be allowed is detected, an index key is added to the association mapping table. The key mapping table consists of two parts: a key mapping hash table and a key mapping table entry pool. Because the domains of interest differ for each protocol when creating the association mapping table—for example, FTP, TFTP, and SIP protocols are concerned with four dimensions: source IP address, destination IP address, destination port, and protocol, but not source port information; some association sessions in the H.323 protocol are only concerned with three dimensions: destination IP address, destination port, and protocol, but not source IP address and source port; and the PPTP protocol's association mapping table is concerned with five dimensions: source IP address, source port, destination IP address, destination port, and protocol—to accommodate the creation and lookup operations of association mapping tables for all protocols, the hash table of this disclosure, in addition to the traditional key-value relationship, also defines a mask entry for lookup using variable keys.

[0062] A 5-tuple mask can be a bitmask of the same length as the 5-tuple information. Each bit is used to indicate whether the corresponding position in the 5-tuple information participates in the matching. For example, when the corresponding bit in the mask is 1, that part of the 5-tuple must be strictly consistent to be considered a match; when the corresponding bit in the mask is 0, that part of the 5-tuple does not participate in the matching and does not affect the matching result. Specifically, a preset mask template can be selected according to the multi-channel protocol type to which the current message belongs. Fields that need to be matched, such as destination IP and destination port, are set to all 1s, and variable fields, such as source IP and source port, are set to all 0s. Then, the mask is associated with the index key and stored in the association mapping table.

[0063] Figure 2 A schematic diagram illustrating the structure of an association mapping table according to an embodiment of the present disclosure is shown.

[0064] like Figure 2 As shown, the association mapping table can be a hash table, such as association mapping hash table 210. The index key of the association mapping hash table can be 40 bytes, containing the packet's 5-tuple information (source IP address, destination IP address, source port, destination port, protocol). The corresponding 5-tuple mask can also be set to 40 bytes, containing the mask corresponding to the 5-tuple information. It is set to 1 when the protocol cares about the information and 0 when it does not. The value corresponding to the index key can be set to 8 bytes, containing the association mapping table entry pool index 212 and the entry index 213. Among them, the association mapping table entry pool 221 corresponding to the association mapping table entry pool index 212 is used to store the associated main session structure, entry management, and other information. The entry index 213 is used to locate entry 0 in the association mapping table entry pool 221. To speed up CPU memory access, a management mapping table entry pool exists in each worker thread. The 5-tuple mask can adapt to various key-value lookups, and the result can be obtained with only one hash lookup, thus accelerating the system processing performance.

[0065] This embodiment of the disclosure, by configuring a protocol-adaptive 5-tuple mask, can flexibly control the matching accuracy, adapt to the identification rules of different multi-channel protocols for associated sessions, and improve the search efficiency.

[0066] According to embodiments of this disclosure, the value corresponding to the index key in the session table includes a session pool index and a session table entry index. Determining whether the application layer protocol of the message to be processed is a multi-channel protocol includes: determining a target session pool from multiple session pools based on the session pool index corresponding to the index key in the session table, wherein the target session pool stores at least one session table entry; determining a target session table entry from at least one session table entry included in the target session pool based on the session table entry index; and determining that the application layer protocol of the message to be processed is a multi-channel protocol if the multi-channel protocol flag bit included in the target session table entry is a preset value.

[0067] In this embodiment of the disclosure, the index key of the session table can be a 40-byte quintuple. Each session's corresponding session entry can be an entry storing session information, such as session status, multi-channel protocol flags, and protocol entry indexes. The session entry index is used to locate which session pool the current session belongs to, and it is also used to locate a specific session entry.

[0068] To determine whether the application layer protocol of a message to be processed is a multi-channel protocol, it can be determined based on the session table entry corresponding to the message. Specifically, based on the session pool index corresponding to the index key, the target session pool pointed to by the session pool index can be determined from multiple pre-allocated session pools. Then, based on the session table entry index, the target session table entry can be obtained from the multiple entries included in the target session pool. This entry records all attribute information of the current session. If the session table entry contains a multi-channel protocol flag bit and the multi-channel protocol flag bit is a preset value, then the application layer protocol of the message to be processed can be considered to be a multi-channel protocol. The multi-channel protocol flag bit is a flag bit in the session table entry used to mark whether the session is the main session of a multi-channel protocol such as FTP or SIP.

[0069] Figure 3 A schematic diagram illustrating the structure of a session table according to an embodiment of the present disclosure is shown.

[0070] like Figure 3As shown, the hash table storing sessions adopts a two-level design. Specifically, the session table includes a session hash table 310, which can be used for operations such as searching, adding, and deleting session entries. The key size used for hash function calculation in the hash table can be 40 bytes, consisting of the five-tuple information of the packet (source IP address, destination IP address, source port, destination port, protocol), serving as the index key of the session hash table 310. The value corresponding to the index key 311 can be set to 8 bytes, storing the session pool index 312 and the session entry pool index 313. The session table also includes a session entry pool 320, used to store information such as packet forwarding and entry management. To accelerate CPU memory access, a session entry pool exists in each worker thread. In this invention, the number of worker threads can be flexibly configured according to the number of CPU cores. The session pool index 312 can be used to determine whether the session represented by index key 311 belongs to session pool 321. The session entry index can be selected from entry 0 of the multiple entries included in session pool 321. It's important to note that session entries are used to record the connection states of protocols such as TCP, UDP, and ICMP, and are crucial for firewall packet forwarding. Firewalls employ a connection-state-based packet control mechanism: the state of a connection is determined by inspecting only the first packet or a small number of packets, while a large number of packets are controlled directly based on the state of their respective connections. This stateful inspection mechanism significantly improves the firewall's inspection and forwarding efficiency. The session table and its entry pool exist precisely to record connection states. When forwarding TCP, UDP, and ICMP packets, the device needs to query the session table to determine the connection to which the packet belongs and the appropriate handling measures.

[0071] The two-level design of the session table in this embodiment enables rapid and accurate retrieval of target session entries from a large number of sessions, significantly improving session lookup efficiency and reducing device memory overhead. By reading the multi-channel protocol flag bits in the session table entry, the protocol type can be directly determined without repeatedly parsing packets, thus improving processing speed.

[0072] According to embodiments of this disclosure, calling a callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed includes: determining the protocol entry corresponding to the protocol entry index from the protocol entry pool based on the protocol entry index included in the session entry, wherein the protocol entry includes a multi-channel protocol and a corresponding callback function; and calling the callback function to parse the application layer of the message to be processed to obtain the IP address and port.

[0073] In this embodiment of the disclosure, the protocol entry index is used to point to a specific protocol entry in the protocol entry pool. The protocol entry pool can be a pre-allocated memory area used to store protocol entries corresponding to all supported multi-channel protocols. It adopts a structured management approach. Specifically, a protocol entry can be a structured data unit stored in the protocol entry pool. Each protocol entry can include the protocol type of the specific multi-channel protocol and the corresponding callback function.

[0074] Specifically, to invoke the callback function, a protocol entry index can be obtained from the located session entry. Then, based on this protocol entry index, the corresponding protocol entry is determined from the protocol entry pool using memory address mapping. This protocol entry includes the specific multi-channel protocol type and its corresponding callback function. The callback function is then invoked to parse the application layer of the packet to be processed to obtain the IP address and port. For example, based on the callback function, the application layer data of the packet to be processed is parsed and fields are extracted to obtain the IP address and port.

[0075] This embodiment of the disclosure uses a protocol lookup table to identify messages, which can detect whether the protocol of the current session belongs to a multi-channel protocol. Furthermore, the protocol table entry index can be used to quickly locate the callback function corresponding to the multi-channel protocol, improving parsing efficiency and message processing efficiency.

[0076] According to embodiments of this disclosure, the method further includes: in response to the failure of matching the five-tuple information with the index key of the associated mapping table, matching the five-tuple information of the message to be processed with a preset security policy; and based on the matching result of the five-tuple information and the preset security policy, forwarding the message to be processed or discarding the message to be processed.

[0077] In this embodiment of the disclosure, a set of rules pre-configured in the device by the network administrator is used to manage network access permissions. For example, each policy may include matching conditions (such as a five-tuple, port range, IP segment) and an action to be performed (allow forwarding / drop). The matching result may be to allow the packet to pass or to drop the packet.

[0078] Specifically, when the five-tuple of the message to be processed does not match any of the index keys in the association mapping table, it means that the message is not a legitimate associated session of the multi-channel protocol, and it is impossible to determine whether it can be allowed based on the association mapping table. In this case, the five-tuple information of the message to be processed can be matched with all the preset security policies to determine whether the message conforms to the pre-configured access rules.

[0079] If the packet's five-tuple matches a security policy that allows forwarding (such as conforming to the access permission configuration of IP network segment and port), the device creates a session entry for the packet and forwards it; if the packet matches a security policy that discards packets, or does not match any preset security policy, the device can discard the packet.

[0080] This embodiment of the disclosure achieves rapid access for associated sessions of multi-channel protocols and implements strict security control for unassociated sessions through the judgment mechanism of association mapping table and security policy.

[0081] According to embodiments of this disclosure, forwarding or discarding a packet to be processed based on the matching result of the five-tuple information and a preset security policy includes: in response to a matching result indicating that forwarding is allowed, forwarding the packet to be processed and creating a session entry for the packet to be processed; constructing a protocol lookup key based on the IP version, communication protocol, and destination port of the packet to be processed, and searching in the protocol lookup table based on the protocol lookup key, wherein the protocol lookup table uses the IP version, communication protocol, and destination port as index keys, and the value corresponding to the index key of the protocol lookup table is the protocol entry index; in response to finding the protocol lookup key in the index key of the protocol lookup table, setting the multi-channel protocol flag bit in the session entry of the packet to be processed to a preset value and storing the protocol entry index in the session entry.

[0082] In this embodiment of the disclosure, if the matching result is that forwarding is allowed, the packet can be forwarded according to the packet forwarding process, and a session entry can be created for the new connection. The created session entry is then pooled with the protocol session entry pool, so that subsequent packets can be directly forwarded quickly through the session table without having to repeatedly match security policies, thus improving processing efficiency.

[0083] To determine whether a message to be processed is a multi-channel protocol, a protocol lookup key is generated using the combination of the message's IP version, communication protocol, and destination port. The protocol lookup table can be a hash table, using this combination as the index key, and the value of the corresponding index key stores the protocol table entry index.

[0084] The system searches for the existence of a protocol lookup key in the index key of the protocol lookup table. If the search is successful, it indicates that the session to which the message belongs is a control session of a multichannel protocol. In this case, the multichannel protocol flag in the session table entry can be set to a preset value, and the index of the found protocol table entry can be stored in the session table entry.

[0085] Figure 4 The schematic diagram illustrates the structure of a protocol lookup table according to an embodiment of the present disclosure.

[0086] like Figure 4As shown, the protocol lookup table is designed as a protocol lookup hash table 410. The index key 411 of the protocol lookup hash table consists of the following parts: IP version, communication protocol, and destination port. The value of the hash table stores the protocol entry index 412. The protocol entry 421 can be located through the protocol entry index 412, and the protocol entry 421 stores the callback function of the corresponding protocol.

[0087] This embodiment of the disclosure enables rapid identification of multi-channel protocol control sessions through a protocol lookup table, and automatically executes the setting of multi-channel protocol flag bits and the writing of protocol table entry indexes. This achieves automatic marking and association of multi-channel protocol sessions.

[0088] Figure 5 A flowchart illustrating a message processing method according to another embodiment of this disclosure is shown schematically. Figure 5 As shown, this embodiment includes operations S501 to S516.

[0089] When operating S501, receive messages to be processed.

[0090] In operation S502, the five-tuple information of the message to be processed is matched with the index key of the session table.

[0091] Upon receiving a message, the 5-tuple information is extracted to obtain the matching result. For example, a session lookup key is constructed based on the 5-tuple information, and a search is performed in the session table using this session lookup key.

[0092] When operating S503, determine whether the message to be processed is the first packet of the session.

[0093] When the matching result indicates that no 5-tuple information is found in the index key, it means that no related session was found, indicating that this message is the first packet of the session. If an index key matching the session lookup key is found, it means that this message is a subsequent packet of the session. For the first packet of the session, operation S504 is executed; for subsequent packets of the session, operation S513 is executed.

[0094] In operation S504, the quintuple information is matched with the index key of the associated mapping table.

[0095] For example, you can check if quintuple information exists in the association mapping table.

[0096] When operating S505, determine whether the match is successful.

[0097] When the query result is empty, it means that no associated mapping table entry was found, indicating that this message is not associated with the main session. In this case, security policy matching is performed, and operation S506 is executed. If an associated session table entry is found, it means that this message is associated with the main session. In this case, a corresponding session table entry needs to be created for this session. Subsequent messages will be allowed directly based on the session table entry, i.e., operations S512 and S516 are executed.

[0098] In operation S506, the five-tuple information of the message to be processed is matched with a preset security policy.

[0099] The security policy can be a preset rule used to determine whether to allow a message based on the five-tuple information.

[0100] When operating S507, determine whether to allow passage.

[0101] Based on the security policy action, a decision is made on whether to allow the message. If the action is to prohibit, the message is discarded, i.e., operation S508 is executed. If the action is to allow, the message is allowed.

[0102] When operating S508, the message is discarded.

[0103] When operating S509, a protocol lookup key is constructed, and a lookup is performed in the protocol lookup table.

[0104] If permission is granted, a protocol lookup key can be constructed based on the IP version, communication protocol, and destination port, and the lookup can be performed in the index key of the protocol lookup table.

[0105] When operating S510, determine whether the search was successful.

[0106] If the search is successful, it means that the message is a normal message and operation S512 can be performed; otherwise, it means that the message is a multi-channel protocol message and operation S511 needs to be performed.

[0107] In operation S511, the multi-channel protocol flag is set to a preset value, and the protocol entry index is saved.

[0108] If a lookup is successful in the protocol lookup table, the multi-channel protocol flag can be set and the index of the found protocol entry can be saved.

[0109] In S512, create a session table entry.

[0110] In operation S513, determine whether the protocol flag bit in the session entry is a preset value.

[0111] If the message type of the message to be processed is a session follow-up packet, the session table entry pool already stores the session table entry of the session to which the message to be processed belongs. The session table entry can be obtained, and it can be determined whether the protocol flag bit of the session table entry is a preset value. If it is a preset value, then operation S514 is executed; otherwise, operation S516 is executed.

[0112] When operating S514, the callback function is obtained based on the protocol table entry index.

[0113] The callback function corresponding to the multichannel protocol can be retrieved from the protocol entry pool based on the protocol entry index.

[0114] When operating S515, the application layer uses callback functions to parse packets. Based on the parsed IP address and port, an index key and key-value relationship are added to the association mapping table.

[0115] If the IP address and port can be resolved, it indicates that the IP address and port are used to establish a data channel, and the packet is a control channel packet. In this case, an index key and key-value relationship can be added to the association mapping table so that the first packet of the subsequent data channel can be directly allowed by matching it with the association mapping table. The value corresponding to the index key includes the association mapping table entry pool index and the entry index.

[0116] When operating the S516, allow the message to pass.

[0117] For example, packets to be processed can be forwarded based on session table entries.

[0118] Figure 6 A schematic block diagram of a message processing apparatus according to an embodiment of the present disclosure is shown.

[0119] like Figure 6 As shown, the message processing device 600 of this embodiment includes an extraction module 610, a first processing module 620, a second processing module 630, and a forwarding module 640.

[0120] Extraction module 610 is used to extract 5-tuple information from a message to be processed in response to receiving such a message. In one embodiment, extraction module 610 can be used to perform the operation S110 described above, which will not be repeated here.

[0121] The first processing module 620 is used to match the 5-tuple information with the index key of the session table to determine the type of the message to be processed, wherein the index key of the session table is constructed based on the 5-tuple information of the established sessions. In one embodiment, the first processing module 620 can be used to perform the operation S120 described above, which will not be repeated here.

[0122] The second processing module 630 is configured to, in response to the message to be processed being a first packet, match the five-tuple information with the index key of the association mapping table to determine whether the message to be processed is an associated session of the main session. The index key of the association mapping table is constructed based on the IP address and port information obtained from the application layer parsing of the control channel message of the multi-channel protocol, where the main session is a control channel session. In one embodiment, the second processing module 630 can be used to execute the operation S130 described above, which will not be repeated here.

[0123] The forwarding module 640 is used to forward the message to be processed in response to the associated session of the main session. In one embodiment, the forwarding module 640 can be used to perform the operation S140 described above, which will not be repeated here.

[0124] According to embodiments of this disclosure, the message processing apparatus 600 further includes a third processing module, a fourth processing module, a composition module, a first addition module, and a second addition module. The third processing module is used to forward the message to be processed and determine whether the application layer protocol of the message to be processed is a multi-channel protocol in response to the message type being a subsequent message. The fourth processing module is used to call a callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed, in response to the application layer protocol being a multi-channel protocol, to obtain the IP address and port. The composition module is used to compose the five-tuple information of the data channel of the multi-channel protocol, using the IP address as the destination IP address and the port as the destination port, and based on the destination IP address, destination port, and the source IP, source port, and communication protocol in the five-tuple information. The first addition module is used to add an index key in the association mapping table according to the five-tuple information of the data channel. The second addition module is used to add a key-value relationship in the association mapping table based on the added index key, wherein the value corresponding to the added index key includes the association mapping table entry pool index and the entry index.

[0125] According to embodiments of this disclosure, the message processing apparatus 600 further includes a configuration module. The configuration module is used to configure a 5-tuple mask for a newly added index key, the 5-tuple mask being determined based on the application layer protocol of the message to be processed; wherein the 5-tuple mask is used to identify information in the newly added index key that participates in matching and information that does not participate in matching.

[0126] According to embodiments of this disclosure, the value corresponding to the index key in the session table includes a session pool index and a session table entry index. The third processing module further includes a target session pool determination module, a target session table entry determination module, and a multi-channel protocol determination module. The target session pool determination module is used to determine a target session pool from multiple session pools based on the session pool index corresponding to the index key in the session table, wherein the target session pool stores at least one session table entry. The target session table entry determination module is used to determine a target session table entry from at least one session table entry included in the target session pool based on the session table entry index. The multi-channel protocol determination module is used to determine that the application layer protocol of the message to be processed is a multi-channel protocol if the multi-channel protocol flag bit included in the target session table entry is a preset value.

[0127] According to embodiments of this disclosure, the fourth processing module further includes a protocol entry determination module and a parsing module. The protocol entry determination module is used to determine the protocol entry corresponding to the protocol entry index from the protocol entry pool based on the protocol entry index included in the session entry. The protocol entry includes a multi-channel protocol and a corresponding callback function. The parsing module is used to call the callback function to parse the application layer of the packet to be processed to obtain the IP address and port.

[0128] According to embodiments of this disclosure, the message processing apparatus 600 further includes a matching module and a fifth processing module. The matching module is used to match the five-tuple information of the message to be processed with a preset security policy in response to a failure to match the index key of the associated mapping table; the fifth processing module is used to forward or discard the message to be processed based on the matching result of the five-tuple information and the preset security policy.

[0129] According to embodiments of this disclosure, the fifth processing module further includes a first processing submodule, a second processing submodule, and a third processing submodule. The first processing submodule is configured to, in response to a matching result indicating that forwarding is allowed, perform forwarding processing on the packet to be processed and create a session entry for the packet to be processed; the second processing submodule is configured to construct a protocol lookup key based on the IP version, communication protocol, and destination port of the packet to be processed, and perform a lookup in the protocol lookup table based on the protocol lookup key, wherein the protocol lookup table uses the IP version, communication protocol, and destination port as index keys, and the value corresponding to the index key of the protocol lookup table is the protocol entry index; the third processing submodule is configured to, in response to finding the protocol lookup key in the index key of the protocol lookup table, set the multi-channel protocol flag bit in the session entry of the packet to be processed to a preset value and store the protocol entry index in the session entry.

[0130] Figure 7 A schematic block diagram of an electronic device that can be used to implement the methods of embodiments of the present disclosure is shown.

[0131] like Figure 7As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0132] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of this disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also implement the methods provided in embodiments of this disclosure by executing programs stored in said one or more memories.

[0133] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0134] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0135] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0136] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0137] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0138] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0139] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] It should be noted that the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information in this disclosed technical solution comply with relevant laws and regulations, necessary confidentiality measures have been taken, and it does not violate public order and good morals. In this disclosed technical solution, user authorization or consent has been obtained before acquiring or collecting user personal information.

[0141] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0142] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0143] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0144] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A message processing method, the method comprising: In response to receiving a message to be processed, extract the 5-tuple information from the message to be processed; The type of the message to be processed is determined by matching the 5-tuple information with the index key of the session table, wherein the index key of the session table is constructed based on the 5-tuple information of the established sessions. In response to the fact that the type of the message to be processed is the first packet, the five-tuple information is matched with the index key of the association mapping table to determine whether the message to be processed is an associated session of the main session. The index key of the association mapping table is constructed based on the IP address and port information obtained from the application layer parsing of the control channel message of the multichannel protocol. The main session is the session of the control channel. In response to the fact that the message to be processed is an associated session of the main session, the message to be processed is forwarded.

2. The method according to claim 1, characterized in that, The method further includes: In response to the message type of the message to be processed being a subsequent message, the message to be processed is forwarded and it is determined whether the application layer protocol of the message to be processed is a multi-channel protocol. In response to the fact that the application layer protocol of the message to be processed is a multi-channel protocol, the callback function corresponding to the application layer protocol of the message to be processed is called to parse the application layer of the message to be processed in order to obtain the IP address and port. The data channel information of the multi-channel protocol is composed of the IP address as the destination IP address, the port as the destination port, and the source IP, source port and communication protocol in the five-tuple information. Based on the quintuple information of the data channel, add an index key to the association mapping table; Based on the newly added index key, a key-value relationship is added to the association mapping table, wherein the value corresponding to the newly added index key includes the association mapping table entry pool index and the table entry index.

3. The method according to claim 2, characterized in that, The method further includes: Configure a 5-tuple mask for the newly added index key, the 5-tuple mask being determined based on the application layer protocol of the message to be processed; The quintuple mask is used to identify the information in the newly added index key that participates in the matching and the information that does not participate in the matching.

4. The method according to claim 2, wherein the value corresponding to the index key in the session table includes a session pool index and a session table entry index, and determining whether the application layer protocol of the message to be processed is a multichannel protocol includes: A target session pool is determined from multiple session pools based on the session pool index corresponding to the index key of the session table, wherein the target session pool stores at least one session table entry; Based on the session entry index, a target session entry is determined from at least one session entry included in the target session pool; If the multichannel protocol flag bit included in the target session entry is a preset value, the application layer protocol of the message to be processed is determined to be a multichannel protocol.

5. The method according to claim 4, characterized in that, The step of calling the callback function corresponding to the application layer protocol of the message to be processed to parse the application layer of the message to be processed includes: Based on the protocol entry index included in the session entry, the protocol entry corresponding to the protocol entry index is determined from the protocol entry pool. The protocol entry includes a multi-channel protocol and a corresponding callback function. The callback function is invoked to parse the message to be processed at the application layer to obtain the IP address and port.

6. The method according to claim 1, characterized in that, The method further includes: In response to the failure of the five-tuple information to match the index key of the associated mapping table, the five-tuple information of the message to be processed is matched with a preset security policy; Based on the matching result between the five-tuple information and the preset security policy, the message to be processed is either forwarded or discarded.

7. The method according to claim 6, characterized in that, The step of forwarding or discarding the packet based on the matching result of the five-tuple information and the preset security policy includes: In response to the matching result indicating that forwarding is allowed, the pending message is forwarded and a session entry for the pending message is created. A protocol lookup key is constructed based on the IP version, communication protocol, and destination port of the message to be processed, and a lookup is performed in the protocol lookup table based on the protocol lookup key. The protocol lookup table uses the IP version, communication protocol, and destination port as index keys, and the value corresponding to the index key of the protocol lookup table is the protocol table entry index. In response to finding the protocol lookup key in the index key of the protocol lookup table, the multichannel protocol flag bit in the session table entry of the message to be processed is set to a preset value and the protocol table entry index is stored in the session table entry.

8. A message processing apparatus, characterized in that, The device includes: The extraction module is used to extract quintuple information from the message to be processed in response to receiving the message to be processed; The first processing module is used to match the five-tuple information with the index key of the session table to determine the type of the message to be processed, wherein the index key of the session table is constructed based on the five-tuple information of the established session; The second processing module is used to match the five-tuple information with the index key of the association mapping table in response to the fact that the type of the message to be processed is the first packet, to determine whether the message to be processed is the associated session of the main session, wherein the index key of the association mapping table is constructed based on the IP address and port information obtained from the application layer parsing of the control channel message of the multi-channel protocol, and the main session is the session of the control channel. The forwarding module is used to forward the message to be processed in response to the message being an associated session of the main session.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images