Endogenous security protection method for configuration data of network node operating system

Abstract

The present invention provides an endogenous security protection method for configuration data of a network node operating system. Upon receiving a network message flow, a data backup module backs up target configuration data in the data backup module; a distribution module respectively sends the received network message flow to dynamic heterogeneous redundancy executors; each dynamic heterogeneous redundancy executor stores target configuration data; a synchronization module may respectively read the target configuration data stored by each dynamic heterogeneous redundancy executor, and an arbitration module performs consistency arbitration; and the synchronization module performs online and offline scheduling on the executors on the basis of an arbitration result to enable a target executor having data disorder to go offline, and to enable a candidate executor to go online, and the candidate executor acquires the target configuration data from the data backup module.

Description

A method for protecting endogenous security of network node operating system configuration data

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application No. 202311481291.6, filed on November 8, 2023, which is incorporated herein by reference. Technical Field

[0003] The present disclosure relates to the field of network communication technology, and in particular to a method for protecting intrinsic security of network node operating system configuration data. Background Art

[0004] In recent years, white-box switches equipped with the Software for Open Networking in the Cloud (SONiC) system have been widely used in scenarios such as data centers. The SONiC system uses the Remote Dictionary Server (Redis) database as a message distribution center, storing user-entered configuration information in the Redis database and then notifying each business container.

[0005] However, the Redis database itself is not completely secure and reliable. The data in the Redis database may be tampered with, resulting in data disorder, such as Remote Code / Command Execute (REC) vulnerabilities, which may cause abnormal switch functions.

[0006] Based on this, the present disclosure provides a method for endogenous security protection of network node operating system configuration data.

[0007] Summary of the Invention

[0008] The present disclosure provides a method for endogenous security protection of network node operating system configuration data to partially solve the above-mentioned problems existing in the prior art.

[0009] This disclosure adopts the following technical solutions:

[0010] The present disclosure provides a method for protecting the inherent security of network node operating system configuration data, which is applied to a white box switch equipped with a network node operating system; the method comprises:

[0011] receiving a configuration command input by a user, and encapsulating the configuration command into a network message stream;

[0012] Backing up and parsing the network message flow to obtain target configuration data, and backing up the target configuration data;

[0013] Storing the target configuration data in each dynamic heterogeneous redundant executive of the network node operating system;

[0014] Reading the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies, and performing consistency judgment on the target configuration data respectively stored in each of the dynamic heterogeneous redundant execution bodies to determine a judgment result;

[0015] According to the arbitration result, a target executable is determined from the dynamic heterogeneous redundant executables, the target executable is offline for cleaning, and a candidate executable is online;

[0016] The candidate executable body after going online reads the backed-up network message stream, so as to store the target configuration data parsed from the network message stream in the candidate executable body after going online;

[0017] After the candidate execution body that is online stores the target configuration data, the target configuration data stored in each dynamic heterogeneous redundant execution body in the online state is synchronized to the network node operating system to make the target configuration data effective.

[0018] The present disclosure provides an endogenous security protection device for configuration data of a network node operating system, the device being applied to a target unit, the target unit being pre-deployed in a network node operating system of a white box switch;

[0019] The target unit includes a command line input module, a distribution module, a decision module, a synchronization module, a data backup module, at least three dynamic heterogeneous redundant execution bodies, and a candidate execution body to be put online;

[0020] The device comprises:

[0021] a command line input module, configured to encapsulate a configuration command input by a user into a network message stream when the command line input module receives the configuration command, and send the network message stream to the distribution module and the data backup module respectively;

[0022] A data backup module, configured to parse the network message stream to obtain target configuration data when the data backup module receives the network message stream, and store the target configuration data in the data backup module;

[0023] a distribution module, configured to, when the distribution module receives the network message stream, send the network message stream to each dynamic heterogeneous redundant executor respectively, and generate a distribution success message when the distribution is successful, and send the distribution success message to the synchronization module;

[0024] a target configuration data storage module, configured to, when the dynamic heterogeneous redundant executor receives the network message stream, parse the target configuration data obtained from the network message stream and store the target configuration data;

[0025] a synchronization module, configured to, when the synchronization module receives the distribution success message, read the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively, and send the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively to the arbitration module;

[0026] an arbitration module configured to, when the arbitration module receives the target configuration data respectively stored by the dynamic heterogeneous redundant executors, perform consistency arbitration based on the target configuration data respectively stored by the dynamic heterogeneous redundant executors, determine an arbitration result, and return the arbitration result to the synchronization module;

[0027] an online and offline scheduling module, configured to, when the synchronization module receives the arbitration result, determine a target executable from the dynamic heterogeneous redundant executables according to the arbitration result, offline clean the target executable, and online the candidate executable to be online, so that the online candidate executable reads the network message stream from the data backup module, so that the target configuration data parsed from the network message stream is stored in the online candidate executable;

[0028] The configuration data validation module is used to synchronize the target configuration data stored in each dynamic heterogeneous redundant execution body in the online state to the network node operating system by the synchronization module when the candidate execution body stores the target configuration data, so as to make the target configuration data effective.

[0029] The present disclosure provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for protecting the intrinsic security of the network node operating system configuration data.

[0030] The present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for protecting the intrinsic security of the network node operating system configuration data is implemented.

[0031] At least one of the above technical solutions adopted in the present disclosure can achieve the following beneficial effects:

[0032] In the method for intrinsic security protection of network node operating system configuration data provided by the present disclosure, when the data backup module receives a network message stream, the target configuration data is backed up in the data backup module, the distribution module sends the received network message stream to each dynamic heterogeneous redundant executor respectively, each dynamic heterogeneous redundant executor stores the target configuration data, the synchronization module can read the target configuration data stored by each dynamic heterogeneous redundant executor respectively, and the arbitration module performs consistency arbitration, the synchronization module schedules the execution body to go online and offline based on the arbitration result, takes the target execution body with data disorder offline, and puts the candidate execution body online, and the candidate execution body obtains the target configuration data from the data backup module. By dynamically and redundantly backing up the target configuration data to the data backup module and dynamically protecting the target data, the protection capability against known and unknown threats is achieved, and the intrinsic security performance of the network node operating system configuration data is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0034] FIG1 is a schematic diagram of a system for executing a method for protecting endogenous security of network node operating system configuration data according to an embodiment of the present disclosure;

[0035] FIG2 is a flow chart of a method for protecting endogenous security of network node operating system configuration data according to an embodiment of the present disclosure;

[0036] FIG3 is a flow chart of a method for protecting endogenous security of network node operating system configuration data according to another embodiment of the present disclosure;

[0037] FIG4 is a schematic diagram of a method for endogenous security protection of network node operating system configuration data according to another embodiment of the present disclosure;

[0038] FIG5 is a schematic diagram of an endogenous security protection device for network node operating system configuration data according to an embodiment of the present disclosure;

[0039] FIG. 6 is a schematic diagram of an electronic device corresponding to FIG. 2 . DETAILED DESCRIPTION

[0040] To make the objectives, technical solutions, and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present disclosure.

[0041] In addition, it should be noted that all actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the corresponding data protection laws and policies of the location and with the authorization given by the owner of the corresponding device.

[0042] It should be noted that, unless there is any conflict, the features in the following embodiments and implementations may be combined with each other.

[0043] The technical solutions provided by various embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0044] In the present disclosure, the overall architecture diagram of the network node operating system of the white box switch is shown in Figure 1. The present disclosure takes the network node operating system as the SONiC system as an example to explain the specific technical solution. A target unit is deployed in the white box switch equipped with the SONiC system, wherein the target unit specifically includes a command line input module, a distribution module, a judgment module, a synchronization module, a data backup module and at least three dynamic heterogeneous redundant executors (Figure 2 shows three dynamic heterogeneous redundant executors, namely Redis (v.7.0.12) database, Redis (v.5.0.4) database and KeyDB database). In addition, the target unit also includes a candidate executor to be put online (DrongflyDB database), which is heterogeneous with the at least three dynamic heterogeneous redundant executors.

[0045] As shown in Figure 1, the command line input module, synchronization module, arbitration module, and distribution module are deployed in the same extended container. These four modules run independently as processes. Three live dynamic heterogeneous redundant executors and one unavailable candidate executor also run as containers on the SONiC system. The data backup module, due to its high reliability requirements, runs as an independent process.

[0046] The pre-deployment of the command line input module, distribution module, arbitration module, synchronization module, and data backup module may include the following two deployment methods:

[0047] Method 1: Pre-integrate specified source code into the source code of the open network operating system of a white-box switch, compile the integrated source code to generate an image container, install the image container on the white-box switch, and after the white-box switch is powered on, run the extension container corresponding to the image container in the network node operating system (SONiC system) running the white-box switch. The extension container is deployed with a command line input module, synchronization module, arbitration module, and distribution module. The specified source code is used to deploy the command line input module, synchronization module, arbitration module, and distribution module. This disclosure does not limit whether the specified source code is automatically generated or manually configured.

[0048] Method 2: Pre-publish the developed extension container as a mirror container. After the white-box switch is powered on, load the mirror container into the network node operating system of the white-box switch. The extension container includes a command line input module, a synchronization module, a arbitration module, and a distribution module.

[0049] Among them, the above method 1 mainly involves the following three steps to run the extension container in the SONiC system:

[0050] Step 1. Add the mk file of the extended container to the rules directory. The mk file is used to declare makefile variable information such as the source code path of the extended container.

[0051] Step 2. Add the source code of the extended container in the src directory. The source code directory is consistent with the source code path declared in step 1.

[0052] Step 3. Add the Dockerfile file and supervisord file of the extended container in the docker directory. The supervisord file is used to manage the various processes in the extended container, namely the processes corresponding to the command line input module, synchronization module, arbitration module, and distribution module respectively; the Dockerfile file is used to build the extended container, including the compilation of the source code in step 2.

[0053] In addition, in the disclosed embodiments, when deploying the data backup module, an independent process can be used to enable the data backup module to run independently in the SONiC system. Of course, for scenarios with higher security requirements, the data backup module can run on an external FPGA daughter card or other server. When the data backup module needs to interact with other processes (dynamic heterogeneous redundant executors, command line input modules, etc.), the security of the data transmission link can be guaranteed by encrypted transmission.

[0054] Figure 2 is a flow chart of a method for protecting the inherent security of network node operating system configuration data provided by the present disclosure. The method includes the following steps S100 to S114.

[0055] S100: When the command line input module receives a configuration command input by a user, the command line input module encapsulates the configuration command into a network message stream, and sends the network message stream to the distribution module and the data backup module respectively.

[0056] In the embodiment of the present disclosure, ACL configuration data is used as the target configuration data that needs to be protected. In SONiC, the configuration of ACL can be taken into effect by directly writing it into the No. 4 database of the system's native redis, without the need for other management operations. However, for data that is more complicated to manage, such as bgp configuration, it is necessary to add a management module of bgpmgr-orchagent. The management module of bgpmgr-orchagent can be implemented with reference to the corresponding submodule in the swss module in the SONiC native code. Therefore, in the embodiment of the present disclosure, taking the ACL configuration data that is relatively simple to manage (which also means a greater risk of being attacked and tampered with) as an example of the target configuration data that needs to be protected, the specific technical solution is explained.

[0057] The command line input module is an extension based on the source code of the SONiC system. The embodiment of the present disclosure targets the ACL function of the white box switch, extends the native ACL command, and securely reinforces the ACL configuration data configured by the user.

[0058] In actual use, the ACL command is often configured by directly writing it to the No. 4 database of the SONiC redis server. The embodiment of the present disclosure uses a patch file to extend the main.py file of the source code to extend the ACL.

[0059] In practice, different patch files can be used to implement different command line input modules. Similarly, the distribution module, arbitration module, and redundant executors can also be synchronized with the command line input module to match their code versions. This allows for the hardening of operating system function configuration data for different network nodes.

[0060] For example, if user A only needs to reinforce ACL configuration data, based on this solution, only the ACL-related code package needs to be provided to user A; if user B needs to reinforce multiple configuration data such as ACL and VLAN, a code package that integrates ACL and VLAN needs to be provided to user B.

[0061] Specifically, in the main.py file, the source code around line 3361 encapsulates the add command for the ACL TABLE. Following the above code, the encapsulation of the ACL RULE command is added. First, the command is described using the following code:

[0062] @add.command()

[0063] @click.argument("rule_name",metavar="<rule_name> ")

[0064] @click.option("-p","--priority")

[0065] …

[0066] The above code is used to describe the parameters of the ACL RULE command. The "-p" in the third line is the priority parameter that needs to be set in the command line. In actual use, the ACL RULE command is as follows:

[0067] "sudo config acl add rule DATAACL1:RULE_1 -p 9999 -a FORWARD SRC_IP 10.0.0.2 / 32" (DATAACL1 is the ACL table name, RULE_1 is the rule name, connected by a colon:, -p is PRIORITY, and -a is PACKET_ACTION).

[0068] After completing the above command description, we continue to develop specific command execution parameters. In the embodiment of the present disclosure, the command execution parameters only complete the following two tasks:

[0069] 1. Encapsulate the command line input parameters into a string, which is the encapsulated network message stream;

[0070] 2. Send the string (network message stream) to the distribution module through the socket interface.

[0071] The encapsulation code of the string is as follows:

[0072] The Python string formatting technique is used here, and the final string to be sent is "HMSET ACL_RULE|DATAACL1:RULE_1PRIORITY 9999PACKET_ACTION FORWARD SRC_IP 10.0.0.2 / 32".

[0073] The string (network message stream) is sent to the distribution module through the socket interface. The specific code is as follows:

[0074] client_socket=socket.socket(socket.AF_INET,socket.SOCK_STREAM)

[0075] client_socket.connect(('127.0.0.1',6666))

[0076] client_socket.send(message.encode())

[0077] …

[0078] That is, the command line input module sends the network message stream to the distribution module and the data backup module respectively through the local TCP port 6666. The distribution module and the data backup module each run a TCP server to receive messages, and the port numbers corresponding to the bound ports are 6666 and 6667 respectively.

[0079] S102: When the data backup module receives the network message stream, the data backup module parses the network message stream to obtain target configuration data, and stores the target configuration data in the data backup module.

[0080] In the embodiment of the present disclosure, the data backup module adopts a client-server CS architecture, where the data backup module itself serves as a server, and the arbitration module and the distribution module interacting with the data backup module serve as clients.

[0081] In the disclosed embodiment, the data backup module is implemented in C and contains only two C source files: memory_db.c and data_backup_server.c. The memory_db.c source file implements a lightweight in-memory database, providing interfaces such as db_open, db_close, db_store, and db_get, and is compiled into a library file. The data_backup_server.c source file links to the library compiled with memory_db.c to generate an executable program that serves as the main process of the data backup module. This main process receives interactive requests from clients and then calls interfaces such as db_open to read or update data.

[0082] For example, when the TCP server in the main process receives the data "HMSET ACL_RULE|DATAACL1:RULE_1 PRIORITY 9999 PACKET_ACTION FORWARD SRC_IP 10.0.0.2 / 32", it creates a database named "ACL" through db_open, sets the key to "ACL_RULE|DATAACL1:RULE_1" and the value to "PRIORITY 9999PACKET_ACTION FORWARD SRC_IP 10.0.0.2 / 32", and saves the data.

[0083] S104: When the distribution module receives the network message stream, the distribution module sends the network message stream to each dynamic heterogeneous redundant executor respectively, generates a distribution success message when the distribution is successful, and sends the distribution success message to the synchronization module.

[0084] The distribution module performs three tasks. One of them is to act as a TCP server and constantly listen for messages sent from the aforementioned command line input module.

[0085] When the distribution module receives a message, it calls the interfaces of each dynamic heterogeneous executor to distribute the data. In the disclosed embodiment, the dynamic heterogeneous executors are different versions of Redis, DragonflyDB, and KeyDB. The interactive interface of the Redis database is implemented using Hiredis. DragonflyDB and KeyDB also have corresponding existing interactive interfaces.

[0086] In fact, both dragonflydb and keydb are compatible with hiredis interface, and both can realize data interaction through hiredis.

[0087] Finally, the distribution module sends a distribution success message to the synchronization module. At this time, the distribution module, as a TCP client, forwards the message from the command line input module to the TCP server in the main process of the synchronization module, informing the synchronization module that a new configuration command has been issued, triggering the synchronization logic.

[0088] S106: When each of the dynamic heterogeneous redundant executors receives the network message stream, it parses the target configuration data obtained from the network message stream and stores the target configuration data.

[0089] Specifically, the distribution module calls the hiredis interface to communicate directly with each dynamic heterogeneous redundancy executor. In this embodiment, the dynamic heterogeneous redundancy executor is a database such as Redis. Different dynamic heterogeneous redundancy executors correspond to different database versions. These can be different versions of Redis, DragonflyDB, and KeyDB. Each dynamic heterogeneous redundancy executor stores target configuration data in a key-value format.

[0090] S108: When the synchronization module receives the distribution success message, the synchronization module reads the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively, and sends the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies to the arbitration module.

[0091] The purpose of data synchronization is to continuously obtain data from multiple dynamically heterogeneous redundant executors, compare them, and write them back to the network node operating system. To facilitate synchronization, the synchronization module stores all keys that require security reinforcement, implemented using a C language linked list (only the keys are stored, not the values).

[0092] For example, based on the above command line operation, the synchronization module will save the "ACL_RULE|DATAACL1:RULE_1" key to the linked list; if the user sets a new RULE2, the synchronization module will also add "ACL_RULE|DATAACL1:RULE_2" to the linked list.

[0093] When the synchronization module receives a message related to the "ACL_RULE|DATAACL1:RULE_1" key from the distribution module, the event synchronization logic is triggered. At this time, the synchronization module reads the target configuration data, that is, the value corresponding to the aforementioned key, from multiple heterogeneous executors, and submits the target configuration data to the arbitration module for consistency arbitration.

[0094] In addition to event-triggered synchronization, the synchronization module also performs synchronization triggered periodically by events. Specifically, in this disclosed embodiment, the synchronization period is set to 5 minutes. After the synchronization period reaches the end, the synchronization module sequentially obtains key information from the key chain table and then reads the target configuration data from multiple dynamic heterogeneous redundant executables based on the key information.

[0095] S110: When the arbitration module receives the target configuration data respectively stored by the dynamic heterogeneous redundant executors, the arbitration module performs consistency arbitration according to the target configuration data respectively stored by the dynamic heterogeneous redundant executors, determines an arbitration result, and returns the arbitration result to the synchronization module.

[0096] In the present disclosure, when the arbitration module performs consistency arbitration based on the target configuration data extracted from each dynamic heterogeneous redundant executor, the arbitration method adopted may be any existing arbitration method, and the present disclosure does not limit this.

[0097] Generally, the arbitration process uses a majority-based approach. If the target configuration data stored by a dynamic heterogeneous redundant executor differs from the target configuration data stored by several other dynamic heterogeneous redundant executors, this indicates that the target configuration data stored by that dynamic heterogeneous redundant executor may be inconsistent. The arbitration result can indicate which dynamic heterogeneous redundant executor's target configuration data is inconsistent with the target configuration data stored by the majority of dynamic heterogeneous redundant executors.

[0098] For example, if the same data key is obtained from dynamic heterogeneous redundant executors A and B and the value obtained from dynamic heterogeneous redundant executor C is "value2", then the target configuration data stored in dynamic heterogeneous redundant executor C is determined to be inconsistent with the other dynamic heterogeneous redundant executors, and dynamic heterogeneous redundant executor C is taken offline. If the data obtained from all three dynamic heterogeneous redundant executors is inconsistent, all three dynamic heterogeneous redundant executors are taken offline.

[0099] The above method may cause the dynamic heterogeneous redundant executor to frequently go online and offline, and therefore may not be suitable for most scenarios requiring arbitration. However, since this solution has strong security of the data backup module and the executor is relatively simple, the performance requirements for arbitration are not high, so the above solution is adopted.

[0100] S112: When the synchronization module receives the judgment result, the target execution body is determined from the dynamic heterogeneous redundant execution bodies according to the judgment result, and the target execution body is offline for cleaning, and the candidate execution body to be online is online, and the candidate execution body after going online reads the network message stream from the data backup module, so that the candidate execution body after going online stores the target configuration data parsed from the network message stream in the candidate execution body after going online.

[0101] In the embodiment of the present disclosure, trusting the newly launched executable body is essentially trusting the data backup module in the present application, thereby trusting the newly launched executable body that completes initialization based on the target configuration data in the data backup module.

[0102] Regarding the online and offline operations of the executor, since the executor in the embodiment of the present disclosure is a database server such as redis, the database can be directly offline through the shutdown command. At the same time, an rdb file can be generated based on the data backup module. Based on the format of the rdb file, the synchronization module can obtain the target configuration data from the data backup module and generate an rdb file. The format of the rdb file can be obtained through redis related information. Then, the online initialization of the redis database can be completed through the rdb file. The online and offline operations of other executors such as keydb are similar to those of the redis executor.

[0103] In an optional embodiment of the present disclosure, since the target configuration data of a newly online heterogeneous redundant executor (candidate executor) originates from a data backup module and the target configuration data in the data backup module is highly secure and reliable, the target configuration data stored by the newly online heterogeneous redundant executor is generally trustworthy. Therefore, an online protection period is set for the newly online heterogeneous redundant executor. During the online protection period, the target configuration data stored by the newly online heterogeneous redundant executor is trustworthy. If, during the online protection period, a consistency decision is performed on the newly online heterogeneous redundant executor based on target configuration data stored by multiple dynamic heterogeneous redundant executors, and a decision result indicates that the target configuration data stored by the heterogeneous redundant executor within the online protection period is inconsistent with the target configuration data stored by other heterogeneous redundant executors, it is determined that the target configuration data stored by the other heterogeneous redundant executors are disordered. In this case, the target configuration data stored by the heterogeneous redundant executor within the online protection period is believed to be reliable and accurate, rather than being based on a majority rule.

[0104] Specifically, after the candidate executor after going online stores the target configuration data parsed from the network message flow in the candidate executor after going online, for each dynamic heterogeneous redundant executor that has not gone offline, it is determined whether the target configuration data stored in the dynamic heterogeneous redundant executor that has not gone offline is consistent with the target configuration data stored in the candidate executor in the online protection period; wherein, the dynamic heterogeneous redundant executor that has not gone offline is not in the online protection period.

[0105] If not, the dynamic heterogeneous redundant executor that has not been offlined is offlined.

[0106] If so, no action is taken.

[0107] In addition, the offline operation will also be carried out for the executors that are in the non-online protection period and whose judgment results are inconsistent with those of other executors.

[0108] S114: When the candidate execution body stores the target configuration data, the synchronization module synchronizes the target configuration data stored in each dynamic heterogeneous redundant execution body in the online state to the network node operating system to make the target configuration data effective.

[0109] After the arbitration is completed, the running status of the configuration corresponding to the key is read from the network node operating system. If it is inconsistent with the arbitration result, the arbitration result is rewritten into the network node operating system to make the configuration effective.

[0110] The process of making the configuration effective can directly call the native redis database write interface of the network node operating system in the embodiment of the present disclosure, write the ACL configuration information to database No. 4, and the configuration will take effect; the reading of the running status can be achieved by calling the native redis database read interface of the network node operating system.

[0111] Specifically, the synchronization module in the embodiment of the present disclosure also saves a key space, which is a subset of the key space in the redis database of the switch's native operating system. It only saves the keys related to the configuration commands that need to be protected and reinforced obtained in the command line input module.

[0112] In the embodiment of the present disclosure, the synchronization action is performed key by key in sequence. After the synchronization action between heterogeneous executors of a key-value data is completed, the synchronization module obtains data from the database of the native switch network operating system (or obtains the status of the native switch through the show command, etc.), and compares the obtained data with the synchronized data. If the data is inconsistent, the synchronization module synchronizes the data related to the protection and hardening configuration command to the native network operating system of the switch by writing a database command or a related switch configuration command, and makes the data effective.

[0113] Specifically, if the ACL configuration in the switch's native operating system is inconsistent with that stored in the heterogeneous executive, you can directly complete the change by writing to the database. If the VLAN configuration in the switch's native operating system is inconsistent with that stored in the heterogeneous executive, you need to call the vlan config interface to refresh the VLAN configuration. Other commands are similar to the above two cases.

[0114] In the method for endogenous security protection of network node operating system configuration data provided in this specification, when the data backup module receives a network message stream, the target configuration data is backed up in the data backup module, and the distribution module sends the received network message stream to each dynamic heterogeneous redundant executor respectively. Each dynamic heterogeneous redundant executor stores the target configuration data. The synchronization module can read the target configuration data stored by each dynamic heterogeneous redundant executor respectively, and the arbitration module performs consistency arbitration. The synchronization module schedules the executor to go online and offline based on the arbitration result, takes offline the target executor with disordered data, and puts online the candidate executor. The candidate executor obtains the target configuration data from the data backup module.

[0115] By backing up the target configuration data to the data backup module, the target data is dynamically protected, achieving protection capabilities against known and unknown threats and enhancing the inherent security performance of the network node operating system configuration data.

[0116] In one or more embodiments of the present disclosure, in S104, the data backup module parses the network message stream to obtain target configuration data, and stores the target configuration data in the data backup module, which can be specifically implemented through the following steps S200 to S210, as shown in FIG3 .

[0117] S200: creating and / or opening a database corresponding to a specified identifier through the data backup module, where the database corresponding to the specified identifier includes a hash chain descriptor table, an index memory, an index memory identifier, a data memory, and a data memory identifier.

[0118] The disclosed embodiment is based on the object-oriented programming concept and creates a database corresponding to a specified identifier by instantiating a DB structure. The definition of the DB structure is as follows:

[0119] The detailed descriptions of each item are as follows:

[0120] Item 1: name is used as the database identifier to identify the created database.

[0121] Item 2, hashlist_describer_table is the hash chain descriptor table. Each entry in this table is an int value, which describes the position of the first entry of each hash list in the index memory (i.e., idxmem).

[0122] Item 3, idxmem is an index memory, which stores multiple index information. The structure definition of the index information is described later.

[0123] Item 4, datmem is the data memory, which stores the value information of the data.

[0124] Item 5, idxmem_cursor is an index memory identifier. In the embodiment of the present disclosure, the value of this item always corresponds to the end position of the used memory in idxmem.

[0125] Item 6, datmem_cursor is a data memory identifier. In the embodiment of the present disclosure, the value of this item always corresponds to the end position of the used memory in datmem.

[0126] Item 7, hashtable_size is the number of database hash chains, that is, the size of the hash chain descriptor table hashlist_describer_table.

[0127] The index information stored in idxmem is defined by the following structure:

[0128] typedef struct{

[0129] int next_idxmsg_describer;

[0130] int data_len;

[0131] int data_position;

[0132] int key_len;

[0133] char key[0];

[0134] }STRUCT_idxmsg;

[0135] The detailed description of each item is as follows:

[0136] Item 1, next_idxmsg_describer records the position of the next item in idxmem in the hash list where the current index information is located;

[0137] Item 2, data_len records the length of the data value corresponding to the current index information in datmem;

[0138] Item 3, data_positon records the position of the data value corresponding to the current index information in datmem;

[0139] Item 4, key_len records the length of the data key corresponding to the current index information;

[0140] Item 5, key records the content of the data key corresponding to the current index information.

[0141] For details, refer to Figure 4. The example shown in Figure 4 is the database state after saving three pairs of key-value data, and the saved data are {"Alpha", "a"}, {"Beta", "bb"}, and {"Gamma", "ccc"} respectively.

[0142] In the example shown in Figure 4, the value of hashtable_size is 3, indicating a maximum of three hash chains. However, there are only two valid descriptors in hashlist_describer_table, and the third descriptor has a value of -1, indicating that the third hash chain is empty. The descriptors in the hashlist_describer_table table represent the position of the first entry in the corresponding hash list in idxmem. For example, the descriptor value of hash list 0 (the corresponding key hash values ​​are all 0) is 25, meaning that the first entry in this hash list is at position 25, which is the index corresponding to the "Gamma" key. At the same time, hash list 0 has two entries, and the first element of the first entry (the next_idxmsg_describer item in the STUCT_idxmsg structure) has a value of 0, indicating that the next entry in hash list 0 is at position 0 in idxmem, which is the index corresponding to the "Alpha" key. The third element in the index information (the data_position item in the STRUCT_idxmsg structure) means the position of the value corresponding to the key in datmem. For example, the value of the data_position item in the index information corresponding to the "Gamma" key is 5, that is, the value "ccc" corresponding to the "Gamma" key is at position 5 in datmem.

[0143] S202: parse the network message flow to obtain target configuration data, use the target configuration data as data to be saved, determine a key of the data to be saved, and determine a hash value of the key of the data to be saved.

[0144] The present disclosure implements hash value calculation through the following three lines of code:

[0145] for(i=1; (c=*key++)!=0; i++)

[0146] hval+=c*i;

[0147] return(hval%db->hashtable_size);

[0148] This is a common hashing method for strings. According to the above method, in the example shown in Figure 3, the hash values ​​of the keys "Alpha" and "Gamma" are 0, and the hash value of the key "Beta" is 1.

[0149] S204: According to the hash value of the key of the data to be saved, searching the hash chain descriptor table of the database corresponding to the specified identifier to obtain the hash chain descriptor corresponding to the key of the data to be saved, and determining the target hash chain corresponding to the key of the data to be saved according to the hash chain descriptor corresponding to the key of the data to be saved; the target hash chain includes index information of multiple items of saved data.

[0150] S206: Based on the index information, determine whether the key of the data to be saved exists in the database corresponding to the designated identifier. If so, execute step S208; otherwise, execute step S210.

[0151] Step 1: Locate the position of the first item of the target hash chain in the index memory according to the hash chain descriptor corresponding to the key of the data to be saved; wherein the target hash chain includes index information of multiple items of saved data, and the index information includes the position of the next saved data item of each saved data item in the target hash chain in the index memory, the length of the value of each saved data item, the position of the value of each saved data item in the data memory, the length of the key of each saved data item, and the content of the key of each saved data item.

[0152] First, still using the calculated hash value of the key of the data to be saved, the hash chain descriptor corresponding to the key of the data to be saved is obtained from the hash chain descriptor table corresponding to the key of the data to be saved.

[0153] Still taking the example shown in FIG4 , if the data of the “Alpha” key is to be obtained, the hash value of the character string “Alpha” is first calculated. According to the aforementioned hash algorithm in the embodiment of the present disclosure, the value is 0 after calculation.

[0154] The hash chain descriptor can be obtained directly through the C language to get the numerical operation of the pointer pointing to the memory. The specific sample code is as follows:

[0155] int hashlist_describer=*(db->hashlist_describer_table+hashval);

[0156] Through the above code, you can get the hash chain descriptor corresponding to the "Alpha" key.

[0157] Furthermore, in the disclosed embodiment, the index memory idxmem is actually a compressed set data structure, where the items in the set are index information, defined by the structure STRUCT_idxmsg. This structure contains the position of the next item in the hash chain in the index memory (next_idxmsg_describer), the length of the stored data value (data_len), the position of the stored data value in the data memory (data_position), the length of the stored data key (key_len), and the content of the stored data key (key).

[0158] In the DB structure, idxmem is defined as a UINT8* type (the char type in C). When processing specific index information within idxmem, the pointer can be cast to a STRUCT_idxmsg* type. This allows direct access to the key content through the key[0] item, which does not occupy the sizeof of STRUCT_idxmsg. This solution draws on the development approach of the Ethernet communication protocol stack. The STRUCT_idxmsg structure acts as the header of the index information, allowing for highly efficient processing of index information.

[0159] Still using the example shown in Figure 4, after obtaining the value of the hash chain descriptor hashlist_describer as 44, it means that the first item of the corresponding hash chain is at position 44 in idxmem. From this, we can get the first index information in the hash chain:

[0160] STRUCT_idxmsg*idxmsg=(STRUCT_idxmsg*)(db->idxmem+hashlist_describer);

[0161] Through the above code, idxmsg is the first index information in the obtained hash chain.

[0162] Step 2: traverse the index information of each saved data item contained in the target hash chain, and for each index information of the saved data item in the target hash chain, compare the content of the key of the saved data item in the index information of the saved data item with the content of the key of the data to be saved.

[0163] The traversal process code is as follows:

[0164] while(idxmsg->next_idxmsg_describer>=0){

[0165] if(strcmp(idxmsg->key,key)==0)

[0166] return(idxmsg);

[0167] idxmsg=(STRUCT_idxmsg*)(db->idxmem+next_idxmsg_describer);

[0168] }

[0169] If the content of the saved key is found to be consistent with the content of the key to be saved, the idxmsg pointer is returned. The STRUCT_idxmsg structure pointed to by the pointer stores the index information corresponding to the "Alpha" key.

[0170] If the key to be saved does not exist, the above step returns a null pointer.

[0171] Step 3: If the index information of each saved data item included in the target hash chain contains a key of the saved data that is consistent with the key of the data to be saved, then the key of the data to be saved exists in the database corresponding to the designated identifier.

[0172] Step 4: If the index information of each stored data item included in the target hash chain does not contain a stored data key that is consistent with the key of the data to be stored, then the key of the data to be stored does not exist in the database corresponding to the designated identifier.

[0173] S208: Execute a data update action, where the data update action at least includes deleting the index information of the original data in the index memory, the data information in the data memory, and updating the hash chain descriptor table.

[0174] If the key of the data to be saved exists in the database corresponding to the specified identifier, it is equivalent to the value corresponding to the key of the data to be saved existing in the database corresponding to the specified identifier. The value may be the same as or different from the value of the data to be saved. Since the data stored in the database corresponding to the specified identifier are all data that need to be backed up by the data backup module, in order to ensure the authenticity and reliability of the data, in this step, it is necessary to delete the value corresponding to the key of the data to be saved (not the value of the data to be saved) originally in the database corresponding to the specified identifier, and after deletion, the value of the data to be saved is stored in the database corresponding to the specified identifier, so as to realize the storage of the target data (data to be saved) in the database corresponding to the specified identifier.

[0175] An optional data update action is as follows:

[0176] Step 1: in the database corresponding to the designated identifier, the stored data corresponding to the key of the stored data that is identical to the key of the data to be stored is used as the data to be deleted.

[0177] Step 2: Obtain the index information of the data to be deleted, determine the position of the index information of the data to be deleted in the target hash chain, and determine whether the index information of the data to be deleted is located at the first item of the target hash chain based on the position of the index information of the data to be deleted in the target hash chain.

[0178] In the embodiment of the present disclosure, the deletion action is implemented by calling the _db_del static function. As mentioned above, this function is equivalent to a member function of the DB object and is defined as follows:

[0179] static int_db_del(DB*,const STRUCT_idxmsg*,int);

[0180] The second parameter passed in is actually the index information of the data to be deleted. The method of obtaining the index information of the data to be deleted is similar to the above-mentioned S204 and S206, and will not be repeated here.

[0181] Step 3: When the index information of the data to be deleted is located at the first item of the target hash chain, the index information of the saved data next to the index information of the data to be deleted in the target hash chain is updated into the hash chain descriptor table.

[0182] The above steps are implemented by the following code:

[0183] *(db->hashlist_describer_table+hashval)=del_key_idxmsg->next_idxmsg_describer; Thus, the update of the descriptor in the hash chain descriptor table can be completed.

[0184] Step 4: When the index information of the data to be deleted is located in a non-first item of the target hash chain, the index information of the data to be deleted is removed from the target hash chain.

[0185] The deletion step is implemented using a while loop, which traverses each element on the hash chain. The purpose is to find the previous hash information of the hash chain to which the index information corresponding to the key to be deleted belongs. In this way, the next_idxmsg_describer of the previous item can be assigned to the next_idxmsg_describer of the index information to be deleted, thereby realizing the removal operation.

[0186] Step 5: traverse the hash chain descriptor table and update the descriptor information in the hash chain descriptor table to the new descriptor information after deleting the data.

[0187] The hash chain descriptor table needs to perform corresponding data updates for key deletion. The method adopted in the embodiment of the present disclosure is to compare the value of each descriptor with the position of the key to be deleted in idxmem. If the former is smaller than the latter, the value remains unchanged. Otherwise, the former is reduced by the length of the index information corresponding to the key to be deleted.

[0188] Specifically, as shown in the example in Figure 3, there are two valid values ​​in the current hash chain descriptor table, namely 44 and 22. Suppose the key "Alpha" is to be deleted at this time. The length of the index information corresponding to the key "Alpha" is 22, int del_key_idxmsg_size=sizeof(STRUCT_idxmsg)+strlen(del_key_idxmsg->key)+1;) The position of the key "Alpha" in idxmem is 0. Then, since 44 and 22 are both greater than 0, 22 needs to be subtracted at this time. That is, after the operation is completed, the value in the hash chain descriptor table is [22,0,-1].

[0189] Step 6: Traverse each hash list and update the location information of the next item of each item in the hash list in the index memory to the new location information after deleting the data.

[0190] This step is to update each idxmsg->next_idxmsg_describer information. The process is similar to the aforementioned fifth step and will not be repeated here.

[0191] Step 7: Locate the deletion start node and deletion end node of the index memory and data memory respectively.

[0192] The above steps only update the values ​​of the index information in idxmem, and do not actually delete the index information and data information.

[0193] This is achieved through the following code:

[0194] int idxmem_delete_start=del_key_idxmsg-db->idxmem;

[0195] int idxmem_delete_end=idxmem_delete_start+del_key_idxmsg_size;

[0196] int datmem_delete_start=del_key_idxmsg->data_position;

[0197] int datmem_delete_end = del_key_idxmsg->data_position + del_key_idxmsg->data_len; Thus, the starting point and end point of the part to be deleted in idxmem and datmem can be located.

[0198] Step 8: Create a temporary memory buffer, which is used to store the original data in the index memory and data memory respectively. Based on the deletion start node and the deletion end node, the data after the corresponding fragments are deleted is written back to the index memory and data memory of the database respectively.

[0199] The above operations are implemented through the memncpy function. The copy process can be achieved through the commonly used methods in the industry and will not be described in detail.

[0200] As can be seen from the above steps, the data backup process corresponding to this application scheme, by introducing elements such as hash chain descriptor tables, index memory, data memory, index information, index memory identifiers, and data memory identifiers, refers to Linux memory management methods such as GDT and IDT, and also refers to Ethernet protocol stack implementation methods. It utilizes the powerful pointer processing capabilities of the C language, supplemented by object-oriented programming ideas, and very efficiently implements a backup process for non-relational key-value data. The entire backup sub-step is easy to maintain and port, and the data backup process is traceable, providing great flexibility for deploying and running the data backup module on different platforms.

[0201] S210: Execute a data adding action; wherein, the data adding action includes updating a hash chain descriptor table, adding index information in an index memory, and adding value content of data to be saved in a data memory.

[0202] If the key of the data to be saved does not exist in the database corresponding to the specified identifier, the key and value of the data to be saved need to be stored in the database corresponding to the specified identifier in order to store the target data (data to be saved) in the database corresponding to the specified identifier in the form of key-value. Therefore, in this step, the data addition action is performed.

[0203] An optional data adding action is as follows:

[0204] Step 1: Determine the target position of the first item of the target hash chain corresponding to the key of the data to be saved in the index memory according to the hash chain descriptor corresponding to the key of the data to be saved.

[0205] Use the following code to locate the end of the index memory through the index memory identifier:

[0206] STRUCT_idxmsg idxmsg=(STRUCT_idxmsg*)(db->idxmem+db->idxmem_cursor);

[0207] idxmem_cursor is a state variable that represents the end of the valid data in the idxmem memory of the current database. Although developed in C, this disclosed embodiment draws on object-oriented programming concepts. An instance of the DB structure is an object; idxmem_cursor and other variables within the object can be considered member variables of the object; static functions related to the DB structure, such as _db_hash, _db_add, and _db_del, can be considered member functions.

[0208] Furthermore, pointer arithmetic in C language can be used to determine the target position of the first item of the hash chain corresponding to the key of the data to be saved in the index memory according to the hash chain descriptor corresponding to the key of the data to be saved, that is, *(db->hashlist_describer_table+hashval).

[0209] Step 2: Create a specified index information hash chain entry, and insert the specified index information hash chain entry before the first entry of the target hash chain.

[0210] In this step, after the newly created specified index information hash chain entry is inserted into the target hash chain, the position of the specified index information hash chain entry in the target hash chain is the first item, and the original first item in the target hash chain is set to the next item of the new first item, and so on for other items.

[0211] The information is updated through the following code:

[0212] idxmsg->next_idxmsg_describer=*(db->hashlist_describer_table+hashval);

[0213] *(db->hashlist_describer_table+hashval)=db->idxmem_cursor=new_idxmem_cursor;

[0214] The first line of the above two lines of code sets the first item of the original linked list to the next item of the new first item; the second line also updates the value of the idxmem_cursor variable synchronously.

[0215] Step 3: According to the data memory identifier, obtain the location of the value of the data to be saved in the data memory.

[0216] Step 4: Update the length of the value of the data to be saved, the position of the value of the data to be saved in the data memory, the length of the key of the data to be saved, and the content of the key of the data to be saved into the specified index information hash linked list item.

[0217] The above steps can be implemented by the following code:

[0218] idxmsg->datalen=strlen(data)+1;

[0219] idxmsg->data_position=db->datmem_cursor

[0220] idxmsg->keylen=strlen(key)+1;

[0221] strcpy(idxmsg->key,key);

[0222] In the embodiment of the present disclosure, datmem_cursor is the identifier of the data memory, which means the end position of the valid data in the current datmem.

[0223] Step 5: Locate the end of the index memory according to the index memory identifier, write the value of the data to be saved at the end of the index memory, and update the value of the data memory identifier.

[0224] The above steps can be implemented by the following code:

[0225] char*datawrite=(db->datmem+idxmsg->data_position);

[0226] strcpy(datawrite,data);

[0227] db->datmem_cursor=db->datmem_cursor+strlen(data)+1;

[0228] In addition, when executing the third, fourth, and fifth steps above, when it comes to the string length, you must add 1 because an extra character space is needed to store the '\0' character.

[0229] The above is a method for protecting the inherent security of network node operating system configuration data provided by one or more embodiments of the present disclosure. Based on the same idea, the present disclosure also provides a corresponding device for protecting the inherent security of network node operating system configuration data, as shown in Figure 5.

[0230] FIG5 is a schematic diagram of an endogenous security protection device for network node operating system configuration data provided by the present disclosure, wherein the device is applied to a target unit that is pre-deployed in a network node operating system of a white box switch;

[0231] The target unit includes a command line input module, a distribution module, a decision module, a synchronization module, a data backup module, at least three dynamic heterogeneous redundant execution bodies, and a candidate execution body to be put online;

[0232] The device comprises:

[0233] The command line input module 300 is configured to encapsulate the configuration command input by the user into a network message stream when the command line input module receives the configuration command input by the user, and send the network message stream to the distribution module and the data backup module respectively.

[0234] A data backup module 302 is configured to parse the network message stream to obtain target configuration data when the data backup module receives the network message stream, and store the target configuration data in the data backup module;

[0235] a distribution module 304 configured to, when the distribution module receives the network message stream, send the network message stream to each dynamic heterogeneous redundant executor, generate a distribution success message when the distribution is successful, and send the distribution success message to the synchronization module;

[0236] a target configuration data storage module 306 for, when the dynamic heterogeneous redundant executive receives the network message stream, parsing the target configuration data obtained from the network message stream and storing the target configuration data;

[0237] a synchronization module 308 configured to, when the synchronization module receives the distribution success message, read the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively, and send the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively to the arbitration module;

[0238] an arbitration module 310 configured to, when the arbitration module receives the target configuration data respectively stored by the dynamic heterogeneous redundant executors, perform consistency arbitration based on the target configuration data respectively stored by the dynamic heterogeneous redundant executors, determine an arbitration result, and return the arbitration result to the synchronization module;

[0239] The online and offline scheduling module 312 is configured to, when the synchronization module receives the decision result, determine a target executable from the dynamic heterogeneous redundant executables based on the decision result, offline and clean the target executable, and online the candidate executable to be online, so that the online candidate executable reads the network message stream from the data backup module, so that the target configuration data parsed from the network message stream is stored in the online candidate executable;

[0240] The configuration data validation module 314 is used to synchronize the target configuration data stored in the online dynamic heterogeneous redundant execution body to the network node operating system by the synchronization module when the candidate execution body stores the target configuration data, so as to make the target configuration data effective.

[0241] The present disclosure also provides a computer-readable storage medium storing a computer program, which can be used to execute the method for intrinsic security protection of network node operating system configuration data shown in FIG1 above.

[0242] The present disclosure also provides a schematic structural diagram of an electronic device shown in FIG6 . As shown in FIG6 , at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the intrinsic security protection method for the network node operating system configuration data shown in FIG2 above. Of course, in addition to software implementation methods, the present disclosure does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0243] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0244] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0245] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0246] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0247] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0248] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0249] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0250] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0251] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0252] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0253] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0254] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0255] Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Thus, the present disclosure may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0256] The present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0257] The various embodiments of this disclosure are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0258] The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A method for endogenous security protection of network node operating system configuration data, the method being applied to a white box switch equipped with a network node operating system; the method comprising: Receiving a configuration command input by a user, and encapsulating the configuration command into a network message stream; Backing up and parsing the network message flow to obtain target configuration data, and backing up the target configuration data; Storing the target configuration data in each dynamic heterogeneous redundant executive of the network node operating system; Reading the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies, and performing consistency determination on the target configuration data respectively stored in each of the dynamic heterogeneous redundant execution bodies, and determining a determination result; According to the decision result, a target executable body is determined from the dynamic heterogeneous redundant executable bodies, the target executable body is offline for cleaning, and a candidate executable body is online; The candidate executable body after going online reads the backed-up network message stream, so as to store the target configuration data parsed from the network message stream in the candidate executable body after going online; After the candidate executable body that is online stores the target configuration data, the target configuration data stored in each dynamic heterogeneous redundant executable body that is online is synchronized to the network node operating system to make the target configuration data effective.

2. The method according to claim 1, characterized in that Backing up and parsing the network message flow to obtain target configuration data, and backing up the target configuration data, including: Create and / or open a database corresponding to a specified identifier, wherein the database corresponding to the specified identifier includes a hash chain descriptor table, an index memory, an index memory identifier, a data memory, and a data memory identifier; Parsing the network message stream to obtain target configuration data, using the target configuration data as data to be saved, and determining a key of the data to be saved; Determine the hash value of the key of the data to be saved; According to the hash value of the key of the data to be saved, the hash chain descriptor table of the database corresponding to the designated identifier is searched to obtain the hash chain descriptor corresponding to the key of the data to be saved, and according to the hash chain descriptor corresponding to the key of the data to be saved, the target hash chain corresponding to the key of the data to be saved is determined; the target hash chain includes index information of multiple items of saved data; According to the index information, determining whether a key of the data to be saved exists in the database corresponding to the designated identifier; If the key of the data to be saved does not exist in the database corresponding to the specified identifier, a data adding action is performed; wherein the data adding action includes updating the hash chain descriptor table, updating the index information in the index memory, and adding the value of the data to be saved in the data memory; If the key of the data to be saved exists in the database corresponding to the specified identifier, a data update action is executed, and the data update action at least includes deleting the index information of the original data in the index memory, deleting the data information in the data memory, and updating the hash chain descriptor table.

3. The method according to claim 2, characterized in that Judging, according to the index information, whether the data to be saved exists in the database corresponding to the designated identifier, including: Locate the position of the first item of the target hash chain in the index memory according to the hash chain descriptor corresponding to the key of the data to be saved; wherein the target hash chain includes index information of multiple items of saved data, and the index information includes the position of the next saved data item of each saved data item in the target hash chain in the index memory, the length of the value of each saved data item, the position of the value of each saved data item in the data memory, the length of the key of each saved data item, and the content of the key of each saved data item; Traversing the index information of each saved data item contained in the target hash chain, and for each index information of the saved data item in the target hash chain, comparing the content of the key of the saved data item in the index information of the saved data item with the content of the key of the data to be saved; If the index information of each item of saved data included in the target hash chain contains a key of the saved data that is consistent with the key of the data to be saved, then the key of the data to be saved exists in the database corresponding to the designated identifier; If the index information of each item of saved data included in the target hash chain does not contain a key of the saved data that is consistent with the key of the data to be saved, then the key of the data to be saved does not exist in the database corresponding to the designated identifier.

4. The method according to claim 2, characterized in that The execution data adding action includes: Determine, according to the hash chain descriptor corresponding to the key of the data to be stored, the target position of the first item of the target hash chain corresponding to the key of the data to be stored in the index memory; Create a specified index information hash chain entry, and insert the specified index information hash chain entry before the first entry of the target hash chain; According to the data memory identifier, obtaining the position of the value of the data to be saved in the data memory; Update the length of the value of the data to be saved, the position of the value of the data to be saved in the data memory, the length of the key of the data to be saved, and the content of the key of the data to be saved into the specified index information hash linked list item; According to the index memory identifier, the end position of the index memory is located, and the value of the data to be saved is written into the end position of the index memory, and the value of the data memory identifier is updated.

5. The method according to claim 2, characterized in that The execution data update action includes: The stored data corresponding to the key of the stored data which is the same as the key of the data to be stored in the database corresponding to the designated identifier is used as the data to be deleted; Obtaining index information of the data to be deleted, determining a position of the index information of the data to be deleted in the target hash chain, and judging whether the index information of the data to be deleted is located at the first item of the target hash chain according to the position of the index information of the data to be deleted in the target hash chain; When the index information of the data to be deleted is located at the first item of the target hash chain, updating the index information of the next item of the saved data of the index information of the data to be deleted in the target hash chain into the hash chain descriptor table; When the index information of the data to be deleted is located in a non-first item of the target hash chain, removing the index information of the data to be deleted from the target hash chain; Traversing the hash chain descriptor table, and updating the descriptor information in the hash chain descriptor table to new descriptor information after deleting the data; Traverse each hash list and update the location information of the next item in the index memory of each table item in the hash list to the new location information after deleting the data; Locate the deletion start node and deletion end node of the index memory and data memory respectively; A temporary memory buffer is created, and the temporary memory buffer is used to store the original data in the index memory and the data memory respectively. Based on the deletion start node and the deletion end node, the data after the corresponding fragments are deleted is written back to the index memory and the data memory of the database respectively.

6. The method according to claim 1, characterized in that Further including: Integrate the specified source code into the source code of the open network operating system of the white-box switch in advance, compile the integrated source code to obtain an image container, install the image container into the white-box switch, and after the white-box switch is powered on, run the extended container corresponding to the image container in the network node operating system running the white-box switch; or, The developed extension container is published as a mirror container in advance, and after the white box switch is powered on, the mirror container is loaded into the network node operating system of the white box switch.

7. The method according to claim 1, characterized in that The candidate executable body is pre-set with an online protection period; After the candidate executable body after going online reads the backed-up network message stream so as to store the target configuration data parsed from the network message stream in the candidate executable body after going online, the method further includes: For each dynamic heterogeneous redundant executor that is not offline, determine the storage whether the target configuration data is consistent with the target configuration data stored in the candidate executable body in the online protection period; wherein the dynamic heterogeneous redundant executable body that has not been offline is not in the online protection period; If the target configuration data stored in the dynamic heterogeneous redundant executor that is not offline is inconsistent with the target configuration data stored in the candidate executor that is in the online protection period, the dynamic heterogeneous redundant executor that is not offline is offlined.

8. A device for endogenous security protection of configuration data of a network node operating system, the device being applied to a target unit, the target unit being pre-deployed in a network node operating system of a white box switch; The target unit includes a command line input module, a distribution module, a decision module, a synchronization module, a data backup module, at least three dynamic heterogeneous redundant execution bodies, and a candidate execution body to be put online; The device comprises: A command line input module, configured to encapsulate the configuration command into a network message stream when the command line input module receives the configuration command input by the user, and send the network message stream to the distribution module and the data backup module respectively by the command line input module; A data backup module, configured to parse the network message stream to obtain target configuration data when the data backup module receives the network message stream, and store the target configuration data in the data backup module; A distribution module, configured to, when the distribution module receives the network message stream, send the network message stream to each dynamic heterogeneous redundant executor respectively, generate a distribution success message when the distribution is successful, and send the distribution success message to the synchronization module; a target configuration data storage module, configured to parse the target configuration data obtained from the network message stream and store the target configuration data when the dynamic heterogeneous redundant executor receives the network message stream; a synchronization module, configured to, when the synchronization module receives the distribution success message, read the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively, and send the target configuration data stored in each of the dynamic heterogeneous redundant execution bodies respectively to the arbitration module; a decision module, configured to, when the decision module receives the target configuration data respectively stored by the dynamic heterogeneous redundant execution bodies, perform consistency decision according to the target configuration data respectively stored by the dynamic heterogeneous redundant execution bodies, determine a decision result, and return the decision result to the synchronization module; an online and offline scheduling module, for determining a target executable body from the dynamic heterogeneous redundant executable bodies according to the arbitration result when the synchronization module receives the arbitration result, offline cleaning the target executable body, and online the candidate executable body to be online, and the online candidate executable body reads the network message stream from the data backup module, so that the target configuration data parsed from the network message stream is stored in the online candidate executable body; The configuration data validation module is used for synchronizing the target configuration data stored in each dynamic heterogeneous redundant execution body in the online state to the network node operating system by the synchronization module when the candidate execution body stores the target configuration data, so as to make the target configuration data effective.

9. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

Images