Data processing method and apparatus, and distributed firewall system

Abstract

A data processing method and apparatus, and a distributed firewall system, which are applied to the technical field of cloud computing. The method comprises: a first engine node creating a first bit table file for a second engine node, wherein the first bit table file is used for indicating the situation of reception of each message among at least one message from the second engine node by the first engine node, and the at least one message comprises a first session table and / or first information related to stream reassembly; when the first bit table file indicates that N messages among the at least one message are not received, sending a request message to the second engine node, wherein the request message is used for requesting the N messages; receiving the N messages from the second engine node; and modifying the first bit table file, wherein the modified first bit table file is used for indicating that the at least one message is received. The present application can reduce the impact on service transmission caused by capacity expansion, capacity reduction or an engine node failure in the distributed firewall system.

Description

Data processing method, device and distributed firewall system

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on February 26, 2024, with application number 202410210863.5 and application name “A method, device and other equipment for data processing”, the entire contents of which are incorporated by reference into this application; this application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on March 29, 2024, with application number 202410387020.2 and application name “A method, device and distributed firewall system for data processing”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of cloud computing technology, and in particular to a data processing method, device, and distributed firewall system. Background Art

[0004] A firewall system, comprised of computer hardware and software, is deployed at the network boundary, serving as a bridge between internal and external networks. It separates internal and external networks, controls access to data at the network boundary, and prevents unauthorized access and malicious intrusion, ensuring the security of internal network data.

[0005] A firewall system can be composed of a load balancing node and multiple engine nodes. The load balancing node is primarily responsible for traffic balancing across multiple engine nodes, while the engine nodes primarily control packet access based on security policies. Currently, engine nodes primarily control session access based on session-related information (e.g., session lists). When the firewall system is expanded or reduced in capacity, or when an engine node fails, some sessions will be redistributed to other engine nodes. Since these other engine nodes do not have the relevant information for these sessions, this will cause the sessions to be interrupted, affecting the normal transmission of services.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a data processing method, device, and distributed firewall system for reducing the impact of expansion, contraction, or engine node failure of the firewall system on business transmission.

[0008] In a first aspect, the present application provides a data processing method, which can be executed by a first engine node in a distributed firewall system, or by a device including the first engine node, or by a component configured in the first engine node (such as a chip system, a chip, or a functional module, etc.), without limitation. The distributed firewall system may include multiple engine nodes, and the first engine node belongs to the multiple engine nodes.

[0009] Taking the first engine node as the execution subject as an example, the method includes: the first engine node creates a first table file for the second engine node, wherein the first table file is used to indicate the reception status of each message of at least one message (such as M messages, M is a positive integer) of the second engine node by the first engine node, and the M messages include one or more of the following: a first session table, or first information related to stream reassembly, and the second engine node belongs to multiple engine nodes; when the first table file indicates that N messages of the M messages have not been received, sending a request message to the second engine node, wherein the request message is used to request N messages, and N is a positive integer less than or equal to M; receiving the N messages sent from the second engine node; and modifying the first table file, and the modified first table file is used to indicate that all M messages have been received.

[0010] In the above embodiment of the present application, the first engine node can obtain the first session table (and / or the first information of flow reassembly) of the second engine node, which means that the session table (and / or flow reassembly information) can be shared between multiple engine nodes in the distributed firewall system. In this way, when the distributed firewall system is scaled down (i.e., the number of engine nodes is reduced) or an engine node fails, since other engine nodes share the session table (and / or flow reassembly information) of the engine node, the other engine nodes can continue to provide services for the sessions (and / or data flows) that the engine node is responsible for, thereby reducing the impact on the business when the distributed firewall system is scaled down or the engine node fails. When the distributed firewall system is expanded (i.e., a new engine node joins the distributed firewall system), the engine node can obtain historical data (i.e., session table and / or flow reassembly information) of other engine nodes in the distributed firewall system through the embodiment of the present application. In this way, even if the business tasks of other engine nodes are distributed to the newly joined engine node, the newly joined engine node can continue to provide services for the business based on the historical data, thereby reducing the impact on the business when the distributed firewall system is expanded.

[0011] In one possible implementation, the first engine node may further store at least one message to be sent (e.g., H messages), where the H messages include one or more of the following: a second session table, or second information related to stream reassembly, where H is a positive integer; and send the H messages to at least one engine node other than the first engine node among the multiple engine nodes.

[0012] Through the above implementation method, the first engine node can store a copy of the message to be sent for local use, and copy another copy to share with other engine nodes in the distributed firewall system, thereby realizing data synchronization (or sharing) between multiple engine nodes in the distributed firewall system, which is conducive to reducing the impact on business transmission.

[0013] In one possible implementation, a first engine node sends H messages to at least one engine node other than the first engine node among multiple engine nodes. This may be as follows: the first engine node writes the H messages into a buffer; and when a first condition is met, the H messages are sent to at least one engine node other than the first engine node among the multiple engine nodes, where the first condition includes one or more of the following: a data volume of the H messages is greater than or equal to a first threshold, or a cache time of the H messages is greater than or equal to a second threshold.

[0014] Through the above implementation, the first engine node can store the message to be sent in the buffer first, and then send it to other engine nodes in the distributed firewall system after the conditions are met.

[0015] In a possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is a new session, the first engine node may determine whether to allow access to the first message based on a connection direction of the first session and an access control list.

[0016] Through the above implementation, if the first session to which the first message belongs is a new session, the first engine node can directly obtain the connection direction of the first session and query the access control list based on the connection direction of the first session.

[0017] In a possible implementation, when the first session table does not include the identifier of the first session, or includes the identifier of the first session and third information, where the third information is used to indicate that a connection direction of the first session is uncertain, the first engine node may further modify the first session table, where the modified first session table includes the identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information is used to indicate that the connection direction of the first session is determined. The first engine node may then send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes.

[0018] Through the above implementation, the first engine node can also modify the first session table and synchronize the modified first session table to other engine nodes in the distributed firewall system to achieve data synchronization, which is conducive to reducing the impact on business transmission.

[0019] In one possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is not a newly created session, determine a connection direction of the first session according to a first session table, wherein the first session table does not include an identifier of the first session, and the connection direction of the first session is the sending direction of the first message; determine whether to allow access to the first message according to the connection direction of the first session and an access control list; modify the first session table, wherein the modified first session table includes an identifier of the first session and third information, and the third information is used to indicate that the connection direction of the first session is uncertain; and send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes.

[0020] With the above implementation, the first session is not a new session. The first engine node can query the first session table, determine the connection direction of the first session based on the query result, and query the access control list based on the connection direction of the first session. If the first session table does not include the first session, the first engine node can also modify the first session table and synchronize the modified first session table with other engine nodes in the distributed firewall system to achieve data synchronization, which helps reduce the impact on service transmission.

[0021] In one possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is not a newly created session, determine a connection direction of the first session based on a first session table; and determine whether to allow access to the first message based on the connection direction of the first session and an access control list. The first session table may include an identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information indicates that the connection direction of the first session is determined; or the first session table may include an identifier of the first session and third information, where the third information indicates that the connection direction of the first session is uncertain, and the connection direction of the first session includes both forward and reverse directions of the first message. The forward and reverse directions of the first message may include a sending direction of the first message and a direction opposite (or reverse) to the sending direction of the first message.

[0022] Through the above implementation, the first session is not a new session. The first engine node can query the first session table, determine the connection direction of the first session according to the query result, and query the access control list according to the connection direction of the first session.

[0023] In one possible implementation, the first engine node may also receive a second message, where the second message belongs to the first data stream; when the second message is the first message in the first data stream, the second message is subjected to stream reassembly processing; when the reassembly of the first data stream is completed, fifth information is sent to at least one engine node other than the first engine node among the multiple engine nodes, where the fifth information is used to indicate that the reassembly of the first data stream is completed; or, when the reassembly of the first data stream is not completed, sixth information is sent to at least one engine node other than the first engine node among the multiple engine nodes, where the sixth information is used to indicate that the reassembly of the first data stream is not completed and that the main processing node of the first data stream is the first engine node.

[0024] Through the above implementation, the first engine node is the main processing node, which can perform stream reassembly processing on the received message and send the relevant information of the reassembly of the first data stream to other engine nodes in the distributed firewall system, so that the other engine nodes can obtain the relevant information of the reassembly of the first data stream and perform corresponding processing. For example, after the reassembly of the first data stream is completed, the other engine nodes that have received the message of the first data stream can discard the message and release storage resources. For another example, if the reassembly of the first data stream is not completed and the main processing node is the first engine node, the other engine nodes that have received the message of the first data stream can send the message to the first engine node to complete the reassembly of the first data stream as soon as possible.

[0025] In one possible implementation, the first information does not include information about the first data stream, and the first engine node may also receive a second message, where the second message belongs to the first data stream; when the second message is not the first message in the first data stream, it is determined based on the first information that the first data stream has not been reassembled and that the main processing node for the first data stream does not exist; and the second message is cached.

[0026] Through the above implementation, the first engine node is the main processing node and can cache the second message so that the second message can be sent to the main processing node for flow reassembly within the cache validity period.

[0027] In one possible implementation, the first engine node may further receive seventh information, where the seventh information indicates that the first data stream has not been reassembled and that the main processing node for the first data stream is the third engine node, which belongs to multiple engine nodes; and sends a second message to the third engine node.

[0028] In another possible implementation, the first engine node may also receive a third message, which belongs to the first data stream; when the third message is the first message in the first data stream, the second message and the third message are subjected to stream reassembly processing; when the reassembly of the first data stream is completed, fifth information is sent to at least one engine node other than the first engine node among the multiple engine nodes, and the fifth information is used to indicate that the reassembly of the first data stream is completed; or, when the reassembly of the first data stream is not completed, sixth information is sent to at least one engine node other than the first engine node among the multiple engine nodes, and the sixth information is used to indicate that the reassembly of the first data stream is not completed and the main processing node of the first data stream is the first engine node.

[0029] Through the above two implementation methods, during the cache validity period, if the first engine node determines that the main processing node is another engine node (i.e., the third engine node), the first engine node sends the second message to the third engine node; or, if the first engine node determines that the main processing node is itself, the first engine node reassembles the third message and the messages in the buffer.

[0030] In one possible implementation, the first information is used to indicate that the first data stream has not been reassembled and the main processing node of the first data stream is the third engine node. The first engine node can also receive a second message, which belongs to the first data stream; and send the second message to the third engine node based on the first information.

[0031] In the above manner, the first information may also indicate that the main processing node is the third engine node, so that the first engine node can directly send the second message to the third engine node.

[0032] In a second aspect, the present application provides a data processing method that can be executed by a firewall system. The firewall system includes multiple engine nodes, including a first engine node and a second engine node. The method may include:

[0033] The second engine node stores M messages to be sent, and sends the M messages to at least one engine node other than the second engine node among the multiple engine nodes; wherein the M messages include one or more of the following: a first session table or first information related to stream reassembly, and M is a positive integer;

[0034] The first engine node creates a first table file for the second engine node, and sends a request message to the second engine node when the first table file indicates that N messages out of M messages have not been received; wherein the first table file is used to indicate the first engine node's reception status of each of the M messages, and the request message is used to request N messages, where N is a positive integer less than or equal to M;

[0035] The second engine node receives the request message from the first engine node and sends N messages to the first engine node;

[0036] The first engine node receives N messages from the second engine node and modifies the first bit table file. The modified first bit table file is used to indicate that all M messages have been received.

[0037] In one possible implementation, when sending M messages to at least one engine node other than a second engine node among multiple engine nodes, the second engine node writes the M messages into a buffer; and when a second condition is met, M messages are sent to at least one engine node other than the second engine node among the multiple engine nodes, where the second condition includes one or more of the following: a data volume of the M messages is greater than or equal to a third threshold, or a cache time of the M messages is greater than or equal to a fourth threshold.

[0038] In one possible implementation, the first engine node may further store H messages to be sent, where the H messages include one or more of the following: a second session table or second information related to stream reassembly, where H is a positive integer; and send the H messages to at least one engine node other than the first engine node among the multiple engine nodes. The at least one engine node other than the first engine node among the multiple engine nodes may also receive the H messages.

[0039] In one possible implementation, the first engine node may further store H messages to be sent, where the H messages include one or more of the following: a second session table, or second information related to stream reassembly, where H is a positive integer; and send the H messages to at least one engine node other than the first engine node among the multiple engine nodes.

[0040] In one possible implementation, when sending H messages to at least one engine node other than the first engine node among multiple engine nodes, the first engine node may write the H messages into a buffer; and when a first condition is met, sending H messages to at least one engine node other than the first engine node among the multiple engine nodes, wherein the first condition includes one or more of the following: the data volume of the H messages is greater than or equal to a first threshold, or the cache time of the H messages is greater than or equal to a second threshold.

[0041] In a possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is a new session, the first engine node may determine whether to allow access to the first message based on a connection direction of the first session and an access control list.

[0042] In one possible implementation, if the first session table does not include the identifier of the first session, or if the first session table includes the identifier of the first session and third information, where the third information indicates that the connection direction of the first session is uncertain, the first engine node may further modify the first session table, wherein the modified first session table includes the identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information indicates that the connection direction of the first session is determined; and the modified first session table is sent to at least one engine node other than the first engine node among the multiple engine nodes. The at least one engine node other than the first engine node among the multiple engine nodes may also receive the modified first session table.

[0043] In one possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is not a newly created session, determine a connection direction of the first session based on a first session table, wherein the first session table does not include an identifier of the first session, and the connection direction of the first session is the sending direction of the first message; determine whether to allow access to the first message based on the connection direction of the first session and an access control list; modify the first session table, wherein the modified first session table includes the identifier of the first session and third information, the third information being used to indicate that the connection direction of the first session is uncertain; and send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes. At least one engine node other than the first engine node among the multiple engine nodes may also receive the modified first session table.

[0044] In one possible implementation, the first engine node may further receive a first message, where the first message belongs to a first session; if the first session is not a newly created session, determine a connection direction of the first session based on a first session table; and determine whether to allow access to the first message based on the connection direction of the first session and an access control list. The first session table may include an identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information indicates that the connection direction of the first session is determined; or the first session table may include an identifier of the first session and third information, where the third information indicates that the connection direction of the first session is uncertain, and the connection direction of the first session includes both forward and reverse directions of the first message. The forward and reverse directions of the first message may include a sending direction of the first message and a direction opposite (or reverse) to the sending direction of the first message.

[0045] In one possible implementation, the first engine node may further receive a second message, where the second message belongs to the first data stream; if the second message is the first message in the first data stream, perform stream reassembly on the second message; if reassembly of the first data stream is complete, send fifth information to at least one engine node other than the first engine node among the multiple engine nodes, the fifth information being used to indicate that reassembly of the first data stream is complete; or, if reassembly of the first data stream is not complete, send sixth information to at least one engine node other than the first engine node among the multiple engine nodes, the sixth information being used to indicate that reassembly of the first data stream is not complete and that the primary processing node for the first data stream is the first engine node. At least one engine node other than the first engine node among the multiple engine nodes may further receive the fifth information or the sixth information.

[0046] In one possible implementation, the first information does not include information about the first data stream, and the first engine node may also receive a second message, where the second message belongs to the first data stream; when the second message is not the first message in the first data stream, it is determined based on the first information that the first data stream has not been reassembled and that the main processing node for the first data stream does not exist; and the second message is cached.

[0047] In one possible implementation, the multiple engine nodes further include a third engine node. The third engine node may send seventh information to at least one engine node other than the third engine node among the multiple engine nodes. The seventh information indicates that the first data stream has not been completely reassembled and that the third engine node is the primary processing node for the first data stream. The first engine node receives the seventh information and sends a second message to the third engine node. The third engine node receives the second message and performs stream reassembly on the second message.

[0048] In another possible implementation, the first engine node may further receive a third message, the third message belonging to the first data stream; if the third message is the first message in the first data stream, perform stream reassembly processing on the second message and the third message; if the reassembly of the first data stream is complete, send fifth information to at least one engine node other than the first engine node among the multiple engine nodes, the fifth information being used to indicate that the reassembly of the first data stream is complete; or, if the reassembly of the first data stream is not complete, send sixth information to at least one engine node other than the first engine node among the multiple engine nodes, the sixth information being used to indicate that the reassembly of the first data stream is not complete and that the primary processing node for the first data stream is the first engine node. At least one engine node other than the first engine node among the multiple engine nodes may further receive the fifth information or the sixth information.

[0049] In one possible implementation, the multiple engine nodes further include a third engine node, and the first information indicates that the first data stream has not been fully reassembled and that the primary processing node for the first data stream is the third engine node. The first engine node may also receive a second message, the second message belonging to the first data stream, and send the second message to the third engine node based on the first information. The third engine node may receive the second message and perform stream reassembly on the second message.

[0050] In a third aspect, the present application provides a data processing device, which is applied to a first engine node in a distributed firewall system, the distributed firewall system including multiple engine nodes, the first engine node belonging to the multiple engine nodes. For example, the data processing device can execute the method described in the first aspect and any possible implementation thereof. The data processing device can include a processing module, a sending module, and a receiving module. The processing module can also be referred to as a processing unit, a logic unit, etc. The sending module can also be referred to as a sending unit. The receiving module can also be referred to as a receiving unit. The sending module and the receiving module can also be collectively referred to as a transceiver module (or transceiver unit), a communication module (or communication unit), or an interface circuit, etc.

[0051] The processing module is configured to create a first bit table file for the second engine node, wherein the first bit table file is configured to indicate a reception status of each of M messages from the second engine node by the first engine node, where the M messages include one or more of the following: a first session table, or first information related to stream reassembly, the second engine node belongs to the multiple engine nodes, and M is a positive integer;

[0052] The sending module is configured to send a request message to the second engine node when the first bit table file indicates that N messages among the M messages have not been received, wherein the request message is used to request the N messages, and N is a positive integer less than or equal to M;

[0053] The receiving module is configured to receive the N messages sent from the second engine node;

[0054] The processing module is further used to modify the first bit table file, and the modified first bit table file is used to indicate that the M messages have all been received.

[0055] In one possible implementation, the processing module is further configured to store H messages to be sent, where the H messages include one or more of the following: a second session table, or second information related to stream reassembly, where H is a positive integer; and the sending module is further configured to send the H messages to at least one engine node other than the first engine node among the multiple engine nodes.

[0056] In one possible implementation, when sending H messages to at least one engine node other than a first engine node among multiple engine nodes, the processing module is configured to write the H messages into a buffer; and the sending module is configured to send the H messages to at least one engine node other than the first engine node among the multiple engine nodes when a first condition is met, where the first condition includes one or more of the following: a data volume of the H messages is greater than or equal to a first threshold, or a cache time of the H messages is greater than or equal to a second threshold.

[0057] In one possible implementation, the receiving module is further used to receive a first message, where the first message belongs to a first session; and the processing module is further used to determine whether to allow access to the first message based on a connection direction and an access control list of the first session when the first session is a newly created session.

[0058] In one possible implementation, the processing module is further configured to modify the first session table when the first session table does not include an identifier of the first session, or when the first session table includes the identifier of the first session and third information, where the third information is used to indicate that a connection direction of the first session is uncertain, wherein the modified first session table includes the identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information is used to indicate that the connection direction of the first session is determined. The sending module is further configured to send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes.

[0059] In one possible implementation, the receiving module is further configured to receive a first message, where the first message belongs to a first session; the processing module is further configured to, if the first session is not a new session, determine a connection direction of the first session based on a first session table, wherein the first session table does not include an identifier of the first session and the connection direction of the first session is a sending direction of the first message; determine whether to permit access of the first message based on the connection direction of the first session and an access control list; and modify the first session table, wherein the modified first session table includes an identifier of the first session and third information, where the third information is used to indicate that the connection direction of the first session is uncertain; and the sending module is further configured to send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes.

[0060] In one possible implementation, the receiving module is further configured to receive a first message, the first message belonging to a first session; and the processing module is further configured to, if the first session is not a newly created session, determine a connection direction of the first session based on a first session table, and determine whether to permit access to the first message based on the connection direction of the first session and an access control list. The first session table includes an identifier of the first session, fourth information, and the connection direction of the first session, the fourth information indicating that the connection direction of the first session is determined. Alternatively, the first session table includes an identifier of the first session and third information, the third information indicating that the connection direction of the first session is uncertain, and the connection direction of the first session includes both forward and reverse directions of the first message. The forward and reverse directions of the first message may include a sending direction of the first message and a direction opposite (or inverse) to the sending direction of the first message.

[0061] In one possible implementation, the receiving module is further used to receive a second message, which belongs to the first data stream; the processing module is further used to perform stream reassembly processing on the second message when the second message is the first message in the first data stream; the sending module is further used to send fifth information to at least one engine node other than the first engine node among the multiple engine nodes when the reassembly of the first data stream is completed, and the fifth information is used to indicate that the reassembly of the first data stream is completed; or, the sending module is further used to send sixth information to at least one engine node other than the first engine node among the multiple engine nodes when the reassembly of the first data stream is not completed, and the sixth information is used to indicate that the reassembly of the first data stream is not completed and the main processing node of the first data stream is the first engine node.

[0062] In one possible implementation, the data processing device may further include a storage module, the first information does not include information of the first data stream, the receiving module is further used to receive a second message, and the second message belongs to the first data stream; the processing module is further used to determine, based on the first information, that the first data stream has not been reassembled and that the main processing node of the first data stream does not exist when the second message is not the first message in the first data stream; and the storage module is used to cache the second message.

[0063] In one possible implementation, the receiving module is used to receive seventh information, where the seventh information is used to indicate that the first data stream has not been reassembled and the main processing node of the first data stream is the third engine node, which belongs to multiple engine nodes; the sending module is also used to send a second message to the third engine node.

[0064] In another possible implementation, the receiving module is further used to receive a third message, which belongs to the first data stream; the processing module is further used to perform stream reassembly processing on the second message and the third message when the third message is the first message in the first data stream; the sending module is further used to send fifth information to at least one engine node other than the first engine node among the multiple engine nodes when the reassembly of the first data stream is completed, the fifth information is used to indicate that the reassembly of the first data stream is completed; or, the sending module is further used to send sixth information to at least one engine node other than the first engine node among the multiple engine nodes when the reassembly of the first data stream is not completed, the sixth information is used to indicate that the reassembly of the first data stream is not completed and the main processing node of the first data stream is the first engine node.

[0065] In one possible implementation, the first information is used to indicate that the first data stream has not been reassembled and the main processing node of the first data stream is the third engine node. The receiving module is also used to receive a second message, which belongs to the first data stream; the sending module is also used to send the second message to the third engine node according to the first information.

[0066] In a fourth aspect, the present application provides a distributed firewall system, comprising a plurality of engine nodes, the plurality of engine nodes including a first engine node and a second engine node, wherein:

[0067] The second engine node is configured to store M messages to be sent, and send the M messages to at least one engine node other than the second engine node among the plurality of engine nodes; wherein the M messages include one or more of the following: a first session table or first information related to stream reassembly, and M is a positive integer;

[0068] The first engine node is configured to create a first table file for the second engine node, and send a request message to the second engine node when the first table file indicates that N messages out of M messages have not been received; wherein the first table file is configured to indicate a reception status of each of the M messages by the first engine node, and the request message is configured to request N messages, where N is a positive integer less than or equal to M;

[0069] The second engine node is further configured to receive a request message from the first engine node and send N messages to the first engine node;

[0070] The first engine node is further configured to receive N messages from the second engine node and modify the first bit table file, where the modified first bit table file is configured to indicate that all M messages have been received.

[0071] In one possible implementation, when sending M messages to at least one engine node other than a second engine node among multiple engine nodes, the second engine node is configured to write the M messages into a buffer; and when a second condition is met, send the M messages to at least one engine node other than the second engine node among the multiple engine nodes, where the second condition includes one or more of the following: a data volume of the M messages is greater than or equal to a third threshold, or a cache time of the M messages is greater than or equal to a fourth threshold.

[0072] In one possible implementation, the first engine node is further configured to store H messages to be sent, where the H messages include one or more of the following: a second session table or second information related to stream reassembly, where H is a positive integer; and to send the H messages to at least one engine node other than the first engine node among the multiple engine nodes. The at least one engine node other than the first engine node among the multiple engine nodes is further configured to receive the H messages.

[0073] In one possible implementation, the first engine node is further configured to store H messages to be sent, where the H messages include one or more of the following: a second session table, or second information related to stream reassembly, where H is a positive integer; and send the H messages to at least one engine node other than the first engine node among the multiple engine nodes.

[0074] In one possible implementation, when sending H messages to at least one engine node other than a first engine node among multiple engine nodes, the first engine node is configured to write the H messages into a buffer; and when a first condition is met, send the H messages to at least one engine node other than the first engine node among the multiple engine nodes, where the first condition includes one or more of the following: a data volume of the H messages is greater than or equal to a first threshold, or a cache time of the H messages is greater than or equal to a second threshold.

[0075] In a possible implementation, the first engine node is further configured to receive a first message, where the first message belongs to a first session; and when the first session is a new session, determine whether to allow access to the first message based on a connection direction of the first session and an access control list.

[0076] In one possible implementation, when the first session table does not include the identifier of the first session, or includes the identifier of the first session and third information, where the third information indicates that the connection direction of the first session is uncertain, the first engine node is further configured to modify the first session table, wherein the modified first session table includes the identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information indicates that the connection direction of the first session is determined; and the modified first session table is sent to at least one engine node other than the first engine node among the multiple engine nodes. The at least one engine node other than the first engine node among the multiple engine nodes is further configured to receive the modified first session table.

[0077] In one possible implementation, the first engine node is further configured to receive a first message, where the first message belongs to a first session; if the first session is not a newly created session, determine a connection direction of the first session based on a first session table, wherein the first session table does not include an identifier of the first session, and the connection direction of the first session is the sending direction of the first message; determine whether to allow access to the first message based on the connection direction of the first session and an access control list; modify the first session table, wherein the modified first session table includes the identifier of the first session and third information, wherein the third information is used to indicate that the connection direction of the first session is uncertain; and send the modified first session table to at least one engine node other than the first engine node among the multiple engine nodes. The at least one engine node other than the first engine node among the multiple engine nodes is further configured to receive the modified first session table.

[0078] In one possible implementation, the first engine node is further configured to receive a first message, the first message belonging to a first session; if the first session is not a newly created session, determine a connection direction of the first session based on a first session table; and determine whether to permit access to the first message based on the connection direction of the first session and an access control list. The first session table includes an identifier of the first session, fourth information, and the connection direction of the first session, the fourth information being used to indicate that the connection direction of the first session is determined; or the first session table includes an identifier of the first session and third information, the third information being used to indicate that the connection direction of the first session is uncertain, and the connection direction of the first session includes both forward and reverse directions of the first message. The forward and reverse directions of the first message may include a sending direction of the first message and a direction opposite (or reverse) to the sending direction of the first message.

[0079] In one possible implementation, the first engine node is further configured to receive a second message, where the second message belongs to a first data stream; perform stream reassembly on the second message if the second message is the first message in the first data stream; and, if reassembly of the first data stream is complete, send fifth information to at least one engine node other than the first engine node among the multiple engine nodes, the fifth information being used to indicate that reassembly of the first data stream is complete; or, if reassembly of the first data stream is incomplete, send sixth information to at least one engine node other than the first engine node among the multiple engine nodes, the sixth information being used to indicate that reassembly of the first data stream is incomplete and that the primary processing node for the first data stream is the first engine node. The at least one engine node other than the first engine node among the multiple engine nodes is further configured to receive the fifth information or the sixth information.

[0080] In one possible implementation, the first information does not include information about the first data stream, and the first engine node is further used to receive a second message, where the second message belongs to the first data stream; when the second message is not the first message in the first data stream, it is determined based on the first information that the first data stream has not been reassembled and that the main processing node of the first data stream does not exist; and the second message is cached.

[0081] In one possible implementation, the multiple engine nodes further include a third engine node, the third engine node being configured to send seventh information to at least one engine node other than the third engine node among the multiple engine nodes, the seventh information being configured to indicate that the first data stream has not been completely reassembled and that the third engine node is the primary processing node for the first data stream. The first engine node is further configured to receive the seventh information and send a second message to the third engine node. The third engine node is further configured to receive the second message and perform stream reassembly on the second message.

[0082] In another possible implementation, the first engine node is further configured to receive a third message, the third message belonging to the first data stream; if the third message is the first message in the first data stream, perform stream reassembly processing on the second message and the third message; if reassembly of the first data stream is complete, send fifth information to at least one engine node other than the first engine node among the multiple engine nodes, the fifth information being used to indicate that reassembly of the first data stream is complete; or, if reassembly of the first data stream is not complete, send sixth information to at least one engine node other than the first engine node among the multiple engine nodes, the sixth information being used to indicate that reassembly of the first data stream is not complete and that the primary processing node for the first data stream is the first engine node. The at least one engine node other than the first engine node among the multiple engine nodes is further configured to receive the fifth information or the sixth information.

[0083] In one possible implementation, the multiple engine nodes further include a third engine node. The first information indicates that the first data stream has not been fully reassembled and that the primary processing node for the first data stream is the third engine node. The first engine node is further configured to receive a second message belonging to the first data stream and send the second message to the third engine node based on the first information. The third engine node is further configured to receive the second message and perform stream reassembly on the second message.

[0084] In a fifth aspect, the present application provides a data processing apparatus, comprising a processor configured to read and execute a computer program or instruction stored in a memory, so as to cause the computing device to perform the method described in the first aspect and any possible implementation thereof. Optionally, the data processing apparatus may further comprise the memory, wherein the memory stores the computer program or instruction.

[0085] In a sixth aspect, the present application provides a computing device comprising at least one processor and a communication interface, wherein the at least one processor is used to read and execute instructions through the communication interface, so that the computing device executes the method described in the above-mentioned first aspect and any possible implementation thereof.

[0086] In the seventh aspect, the present application also provides a computing device cluster, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method described in the above second aspect and any possible implementation method thereof.

[0087] In an eighth aspect, the present application further provides a chip system, comprising at least one processor configured to execute one or more computer programs or instructions in the memory to implement the method described in the first or second aspect and any possible implementation thereof. Optionally, the at least one processor is coupled to the memory.

[0088] In a ninth aspect, the present application also provides a computer program product comprising computer-executable instructions for enabling a computing device to execute the method described in the first or second aspect and any possible implementation thereof.

[0089] In the tenth aspect, the present application also provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computing device to execute the method described in the first aspect or the second aspect and any possible implementation thereof.

[0090] The technical effects that can be achieved by any of the above-mentioned second to tenth aspects and any possible implementation methods can refer to the description of the beneficial effects in the above-mentioned first aspect and any possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] FIG1a is a schematic diagram of the structure of a distributed firewall system provided in an embodiment of the present application;

[0092] FIG1b is a schematic diagram of the structure of another distributed firewall system provided in an embodiment of the present application;

[0093] FIG2 is a flow chart of a first data processing method provided in an embodiment of the present application;

[0094] FIG3 is a schematic diagram of data sharing provided in an embodiment of the present application;

[0095] FIG4 is a flow chart of a second data processing method provided in an embodiment of the present application;

[0096] FIG5 is a flow chart of a third data processing method provided in an embodiment of the present application;

[0097] FIG6 is a schematic structural diagram of a data processing device provided in an embodiment of the present application;

[0098] FIG7 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0099] FIG8 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0100] FIG9 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0101] The embodiments of the present application will be presented around a system including multiple devices, components, modules, etc. It should be understood that the system may include other devices, components, modules, etc. not mentioned, or may only include some of the devices, components, or modules, etc. mentioned in the embodiments.

[0102] In the embodiments of the present application, "multiple" may refer to two or more. In view of this, in the embodiments of the present application, "multiple" may also be understood as "at least two". "At least one" may be understood as one or more, for example, one, two or more. For example, "including at least one" means including one, two or more. For example, including at least one of A, B and C, then included may be A, B, C, A and B, A and C, B and C, or A, B and C. "And / or" describes the association relationship of associated objects. Specifically, there may be three relationships. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0103] Ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are generally used to distinguish different objects and are not used to define the order, timing, priority, or importance of multiple objects. For example, the first engine node and the second engine node in the embodiments of this application are used to distinguish different engine nodes and are not used to define the order, timing, priority, or importance of the two engine nodes.

[0104] The embodiments of the present application can be applied to a firewall system. The firewall system can be composed of a load balancing node and multiple engine nodes. The load balancing node is mainly responsible for traffic balancing of multiple engine nodes, and the engine node mainly controls the access of messages according to security policies. At present, the firewall system includes engine nodes that mainly control the access of sessions based on the relevant information of the sessions (for example, the session list). When the firewall system is expanded or reduced in capacity, or when an engine node fails, some sessions will be redistributed to other engine nodes. Since the other engine nodes do not have the relevant information of this part of the session, this will cause the interruption of the session, thereby affecting the normal transmission of the business.

[0105] In view of this, embodiments of the present application provide a data processing method, device, and distributed firewall system to reduce the impact on services when the firewall system is expanded or reduced in capacity, or when an engine node fails. The method and device described in this application are based on the same technical concept. Since the method and device solve similar problems, the implementation of the device and method can refer to each other, and any repetitions will not be repeated.

[0106] Before introducing the data processing method provided in the embodiment of the present application, the distributed firewall system provided in the embodiment of the present application is first introduced below.

[0107] Figures 1a and 1b show schematic diagrams of the architecture of a distributed firewall system (also referred to as a firewall system or firewall) provided in an embodiment of the present application. As shown in Figure 1a or Figure 1b, the distributed firewall system is deployed at the network boundary and serves as a connecting bridge between the internal network and the external network (for example, the Internet, etc.). The distributed firewall system can separate the internal network from the external network, perform access control on data at the network boundary, prevent illegal access, malicious intrusion, etc., and ensure the security of internal network data. As shown in Figure 1a or Figure 1b, the distributed firewall system can include multiple engine nodes. The multiple engine nodes can communicate with each other. The embodiment of the present application does not limit the number of engine nodes included in the distributed firewall system. Figure 1a or Figure 1b shows the first engine node, the second engine node, and the third engine node as examples.

[0108] The engine node may also be referred to as an end node, node, etc. The embodiments of the present application do not limit the naming of the engine node. The engine node mainly controls the access of the message based on the security policy (for example, a session list, an access control list (ACL), etc.). For example, the engine node can determine whether to allow access to the message based on the security policy; if the engine node determines that access to the message is allowed based on the security policy, the engine node forwards the message; if the engine node determines that access to the message is not allowed based on the security policy, the engine node discards the message. The functions of the engine node can be implemented by a computer device, a server, a cloud server, a physical machine or a virtual machine, etc. The embodiments of the present application do not limit the functions and implementation forms of the engine node.

[0109] Optionally, the distributed firewall system may further include a load balancing node, which is indicated by a dotted line in Figures 1a and 1b. The load balancing node may communicate with the multiple engine nodes.

[0110] A load balancing node, also known as a load balancing device, is not limited in this embodiment. A load balancing node is primarily responsible for distributing service data and balancing traffic between multiple engine nodes. The functions of a load balancing node can be implemented by a computer device, server, cloud server, physical machine, or virtual machine. This embodiment does not limit the functions or implementation of a load balancing node.

[0111] Optionally, the distributed firewall system may further include a control node, which is not shown in Figures 1a and 1b. The control node may communicate with multiple engine nodes. The control node may also communicate with a load balancing node. The control node may also be referred to as a control center, etc. The embodiment of the present application does not limit the naming of the control node. The control node is mainly responsible for issuing configuration information to multiple engine nodes and / or load balancing nodes, for example, configuring access control lists (ACLs), load balancing policies, etc. The functions of the control node may be implemented by a computer device, a server, a cloud server, a physical machine or a virtual machine, etc. The embodiment of the present application does not limit the functions and implementation forms of the control node.

[0112] Among them, a message is a unit used to exchange and transmit data in a network, that is, a block of data that a site wants to send at one time. The message in the embodiment of the present application can be a message based on the Transmission Control Protocol / Internet Protocol (TCP / IP). For example, the message can be a TCP message, an IP message, an Internet Control Message Protocol (ICMP) message, etc., without limitation. When the data to be transmitted is large, message segmentation technology can divide the data into multiple smaller data segments for transmission to improve transmission efficiency. The data segmentation behavior that occurs in the transport layer using TCP can be called TCP segmentation or segmentation. The data segmentation behavior that occurs in the network IP layer using IP can be called IP fragmentation or fragmentation. Both TCP segmentation and IP fragmentation can be processed by stream reassembly to obtain a complete data stream. Stream reassembly refers to combining the messages of the same TCP or IP stream in sequence to parse out the data stream of the application layer.

[0113] A session is the period between the start and end of a network connection, encompassing the entire process from the session initiator initiating a connection request to the session responder responding to the request. A session consists of multiple messages consisting of bidirectional flows. Taking TCP messages as an example, after exchanging the source and destination in the five-tuple, multiple messages with the same five-tuple belong to the same session. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and protocol number. The session direction, which can also be referred to as the session connection direction or the message connection direction, is not limited. The connection direction of the session can refer to the direction from the session initiator to the session responder.

[0114] The distributed firewall system shown in Figure 1b differs from the distributed firewall system shown in Figure 1a in that each engine node in the distributed firewall system can include a message broadcast module, a session processing module, and a stream reassembly module.

[0115] The message broadcast module can be used to implement the sending action and / or receiving action of the engine node, assist the session processing module to implement the access control of the engine node to the message, and assist the flow reassembly module to implement the flow reassembly processing of the engine node on the message segmentation or message fragmentation. For example, the message broadcast module can send the session table to other engine nodes in the distributed firewall system, which means that the session table can be shared between multiple engine nodes in the distributed firewall system, so that the session that the engine node where the message broadcast module is located is responsible for can also be served by other nodes. For example, the message broadcast module can send information related to flow reassembly to other engine nodes in the distributed firewall system, which means that multiple engine nodes in the distributed firewall system can share information related to flow reassembly, so that a data flow that the engine node where the message broadcast module is located is responsible for can be collaboratively processed by multiple engine nodes.

[0116] The session processing module, also known as the session table module, is used to implement access control for messages by engine nodes. For example, the session processing module can perform access control on received messages based on the session table (which can be maintained by the module itself or received from other engine nodes via the message broadcast module, without limitation).

[0117] The stream reassembly module can be used to enable engine nodes to perform stream reassembly on message segments or fragments. For example, the stream reassembly module can perform stream reassembly on received message segments (or fragments) based on information related to stream reassembly (this information can be maintained by the module itself or received from other engine nodes via a message broadcast module, without limitation), or send the received message segments (or fragments) to other engine nodes via a message broadcast module for stream reassembly.

[0118] It should be noted that the above-mentioned multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation. In addition, the distributed firewall system provided in the embodiment of the present application may also include other nodes, and the embodiment of the present application does not limit the implementation form.

[0119] In the distributed firewall system provided by the embodiments of the present application, multiple engine nodes can share session tables and / or information related to flow reassembly, thereby reducing the impact of expansion or contraction of the distributed firewall system, or engine node failures, on service transmission. The following, combined with Figures 2 to 5, describes the data processing method provided by the embodiments of the present application from the perspective of exchanges between a first engine node and a second engine node, as well as from the perspective of the first engine node.

[0120] Figure 2 shows a flow chart of a first data processing method provided in an embodiment of the present application. This method can be applied to the distributed firewall system shown in Figure 1a or Figure 1b. As shown in Figure 2, this method can include the following steps.

[0121] S201: The second engine node stores at least one message to be sent.

[0122] The second engine node can write at least one message to be sent to a file (or data file). Writing to a file can be understood as storing or writing to a hard disk (or disk, or memory, etc.). For ease of understanding, the at least one message to be sent by the second engine node is hereinafter referred to as M messages, where M is a positive integer. Figure 2 illustrates an example of the second engine node storing M messages to be sent. These M messages can be understood as messages shared by the second engine node with other engine nodes in the distributed firewall system. The message can be understood as one or more of the following: information, a table, text, or data.

[0123] In an embodiment of the present application, the M messages may include a first session table, or include first information related to stream reassembly, or include the first session table and first information related to stream reassembly. The first session table may include information about at least one session. The information about the at least one session may include: an identifier of at least one session and indication information for indicating whether the connection direction of each session in the at least one session table is determined. Furthermore, if the indication information indicates that the connection direction of the session is determined, the information about the at least one session may also include the connection direction of the session, as shown in Table 1. Table 1 shows an example in which the first session table includes three sessions. It should be understood that the information about at least one session may also include other content, which is not limited in the embodiment of the present application.

[0124] Table 1

[0125] The first information related to stream reassembly may include the identifier of at least one data stream and indication information indicating whether each data stream in the at least one data stream has been processed. Optionally, the first information may also include the identifier of the primary processing node of the data stream, as shown in Table 2. Table 2 uses three data streams as an example. It should be understood that the first information may also include other content, which is not limited in this embodiment of the present application.

[0126] Table 2

[0127] It should be noted that the M messages may also include part of the first session table and / or part of the first information. For ease of understanding, the embodiment of the present application is described by taking the example of M messages including the first session table and / or the first information.

[0128] S202: The second engine node sends M messages. For example, the second engine node may send M messages to at least one engine node other than the second engine node in the distributed firewall system. For example, a message broadcast module in the second engine node sends the M messages.

[0129] Exemplarily, the second engine node may write M messages to a file and send a copy to at least one engine node in the distributed firewall system other than the second engine node. In one embodiment, the second engine node may buffer (or cache) the M messages; alternatively, the second engine node may write the M messages to a buffer (or cache area). That is, the second engine node writes the M messages to both the file and the buffer. Furthermore, if a second condition is met, the second engine node may send the M messages to at least one engine node in the distributed firewall system other than the second engine node. The second condition may include the data volume of the M messages being greater than or equal to a third threshold, the cache duration of the M messages being greater than or equal to a fourth threshold, or both the data volume of the M messages being greater than or equal to the third threshold and the cache duration of the M messages being greater than or equal to a fourth threshold. Both the third and fourth thresholds may be pre-set and are not subject to restrictions. For example, the third threshold may be 1.3 KB, which is not subject to restrictions. For example, the fourth threshold may be 100 microseconds, which is not subject to restrictions.

[0130] In one embodiment, the second engine node can determine the sequence numbers of the M messages. For example, the second engine node can determine the sequence numbers of the M messages based on the time (or timestamp) when the M messages were written to the file and the offset at which the M messages were written to the file. The time when the M messages were written to the file can be recorded as the first time or the first timestamp.

[0131] In one embodiment, the distributed firewall system (or the second engine node) may include an expiration mechanism. For example, when the storage duration of any one of the M messages exceeds a set threshold, the second engine node may delete the at least one message whose storage duration exceeds the set threshold. For example, the first engine node may delete the at least one message from a file and / or buffer to reduce storage resource waste.

[0132] Optionally, the second engine node may send the M messages to at least one engine node via the User Datagram Protocol (UDP), thereby ensuring real-time data transmission. If the distributed firewall system includes three or more engine nodes, the second engine node may send the M messages to multiple engine nodes in the distributed firewall system other than the second engine node via UDP multicast to conserve network transmission resources. Alternatively, the second engine node may send the M messages one by one to multiple engine nodes in the distributed firewall system other than the second engine node via UDP unicast to accommodate network environments that do not support UDP multicast.

[0133] Through the above-mentioned S201 and S202, data sharing (or data synchronization) can be achieved between multiple engine nodes in the distributed firewall system. In one embodiment, multiple engine nodes in the distributed firewall system can share the same key value (KV) structure, with local memory-level read and write speeds, and data written by any engine node can be read globally. The KV structure can be, for example, a hash table, but is not limited to this. For example, when an engine node updates (or modifies) a hash table, the engine node can send the updated content or the updated hash table to other engine nodes. For example, as shown in Figure 3, data 1 of engine node 1 is first written to a file (not shown in Figure 3) and local buffer 1, and then sent to engine node 2 and engine node 3; data 2 of engine node 2 is first written to a file (not shown in Figure 3) and local buffer 1, and then sent to engine node 1 and engine node 3; data 3 of engine node 3 is first written to a file (not shown in Figure 3) and local buffer 1, and then sent to engine node 1 and engine node 3; in this way, engine node 1, engine node 2, and engine node 3 can all use data 1, data 2, and data 3. It is understood that the local buffer of the engine node can be deployed outside the engine node or inside the engine node, without limitation. Figure 3 shows an example of engine node 1, engine node 2, and engine node 3 communicating with each other via a bus (indicated by thick black lines in Figure 3).

[0134] It should be noted that the second engine node may send M messages to at least one engine node in the distributed firewall system other than the second engine node. The at least one engine node may or may not include the first engine node. For example, the first engine node may be an engine node newly added to the distributed firewall system after S202 and before S203.

[0135] S203: The first engine node creates (or constructs, or determines, or establishes) a first bit table file for the second engine node.

[0136] The first engine node can create at least one bitmap file for each of at least one engine node other than the first engine node in the distributed firewall system. The distributed firewall system includes at least one engine node other than the first engine node, including a second engine node. The at least one bitmap file created by the first engine node for the second engine node includes a first bitmap file. The at least one bitmap file created by the first engine node for the second engine node can be used to deduplicate multiple messages sent by the second engine node to the first engine node, and to quickly determine which messages have not yet been received. For ease of understanding, the following description uses the first bitmap file as an example; the remaining bitmap files can refer to the description of the first bitmap file.

[0137] Exemplarily, the first engine node may create the first position table file in response to receiving the first message from the second engine node, which belongs to the M messages. Alternatively, the first engine node may also create the first position table file based on other information. If the first engine node is a newly added engine node, the first position file may be understood as an empty file, or the first position file may also be understood as a full-range file; or the first engine node may also create the first position table file based on the configuration information of the control node; or, after the first engine node is newly added to the distributed firewall system, it may send a request for obtaining shared information to at least one engine node (including the second engine node) other than the first engine node in the distributed firewall system, and then create at least one position table file for the at least one engine node after receiving the corresponding message. The embodiment of the present application does not limit the triggering conditions for the first engine node to create the first position table file.

[0138] The first bit table file can be used to indicate the reception status of each of the M messages from the second engine node by the first engine node. Optionally, the first bit table file can be named after the first time (or first timestamp) to indicate the reception status of the message indicated by each sequence number within the first time by the first engine node. The first time (or first timestamp) is the time when the second engine node writes the M messages to the file. Exemplarily, the first bit table file can include the sequence numbers of the M messages and indication information indicating whether each of the M messages has been received, as shown in Table 3. Table 3 is shown with three messages as an example.

[0139] Table 3

[0140] In S202, the second engine node sends M messages. Each time the first engine node receives a message, it can determine whether the message has been received based on the first bit table file. Taking message 1 among the M messages as an example, if the first bit table file indicates that message 1 has been received, the first engine node discards message 1. If the first bit table file indicates that message 1 has not been received, the first engine node updates the first bit table file, with the updated first bit table file indicating that message 1 has been received, and passes message 1 to the upper-layer application for processing (such as writing it to the session table and / or for stream reassembly). The first engine node processes each received message according to the processing method for message 1 until it has processed the last message received by the first engine node. Furthermore, the first engine node can periodically or aperiodically check the first bit table file to determine whether all M messages have been received. If the first bit table file indicates that all M messages have been received, the process ends. If the first bit table file indicates that N of the M messages have not been received, the first engine node executes S204. N is a positive integer less than or equal to M. For example, if the first engine node is a newly added node, N may be equal to M. The embodiment of the present application is described by taking N messages out of M messages as an example. In S202 of FIG2 , "X" is used to indicate that N messages out of the M messages have not been received.

[0141] S204: When the first bit of the table file indicates that N messages among the M messages have not been received, the first engine node sends a request message to the second engine node. Correspondingly, the second engine node receives the request message from the first engine node.

[0142] The request message may be used to request the N messages, or to request retransmission of the N messages, or to obtain the N messages. Optionally, the request message includes sequence numbers of the N messages. For example, the first engine node may send the request message to the second engine node via the TCP protocol, without limitation.

[0143] S205: The second engine node sends N messages to the first engine node.

[0144] For example, after receiving the request message, the second engine node can send the N messages to the first engine node based on the request message. The first engine node can process each received message as described in Message 1. If some or all of the N messages are not received, the first engine node executes S203 until all N messages are received. Figure 2 illustrates the first engine node receiving the N messages as an example.

[0145] S206: The first engine node modifies the first table file.

[0146] The first engine node modifies (or updates) the first bit table file. For example, the first engine node modifies (or updates) the first bit table file based on the receipt of N messages, as described above for message 1. The modified first bit table file indicates that all M messages have been received.

[0147] Figure 2 describes the first engine node as a message receiver as an example. Optionally, the first engine node can also serve as a message sender. In one possible implementation, the first engine node can store (or write to a file) at least one message to be sent, and send the at least one message to at least one engine node other than the first engine node in the distributed firewall system. For the sake of simplicity, the following description takes the at least one message to be sent by the first engine node as H messages, where H is a positive integer. Among them, the H messages may include a second session table, or include second information related to stream reassembly, or include a second session table and second information related to stream reassembly. Please refer to the description of the M messages for the H messages, refer to the description of the first session table for the second session table, and refer to the description of the first information for the second information. No further details will be given.

[0148] Exemplarily, the first engine node sending the H messages to at least one engine node other than the first engine node in the distributed firewall system may include: the first engine node writing the H messages into a buffer, and then sending the H messages to at least one engine node other than the first engine node in the distributed firewall system if a first condition is met. The first condition may include the data volume of the H messages being greater than or equal to a first threshold, or the cache time of the H messages being greater than or equal to a second threshold, or both the data volume of the H messages being greater than or equal to the first threshold and the cache time of the H messages being greater than or equal to the second threshold. H is a positive integer. The first and second thresholds may be predefined and are not subject to limitation.

[0149] Optionally, the first engine node may further determine the sequence numbers of the H messages. For the implementation process, please refer to the description of determining the sequence numbers of the M messages by the second engine node, which will not be repeated here.

[0150] It should be noted that the execution order of the steps in Figure 2 is an example and is not limited thereto. For example, the first engine node receiving N messages and the first engine node modifying the first table file can be performed simultaneously.

[0151] In the first data processing method described above, multiple engine nodes in a distributed firewall system can share a session table (and / or flow reassembly information). Therefore, when the distributed firewall system is scaled down (i.e., the number of engine nodes is reduced) or an engine node fails, since other engine nodes share the session table (and / or flow reassembly information) of the engine node, the other engine nodes can continue to provide services for the sessions (and / or data flows) that the engine node is responsible for, thereby reducing the impact on services when the distributed firewall system is scaled down or an engine node fails. When the distributed firewall system is expanded (i.e., a new engine node joins the distributed firewall system), the engine node can obtain historical data (i.e., session table and / or flow reassembly information) of other engine nodes in the distributed firewall system using the first data processing method described above. Therefore, even if business tasks from other engine nodes are assigned to the engine node, the engine node can continue to provide services for the business based on this historical data, thereby reducing the impact on services when the distributed firewall system is expanded.

[0152] A single session is handled by one engine node. When the traffic volume of this session is large, this engine node may be attacked by an elephant flow, which may cause the single engine node to be overwhelmed and unable to provide services. In the above-mentioned embodiments of the present application, multiple engine nodes in the distributed firewall system can share session tables and / or flow reassembly information, which means that a single session can be distributed to multiple engine nodes for processing. This can reduce the risk of a single node being overwhelmed due to a large single session flow, allowing the distributed firewall system to support larger single session flows, thereby improving the stability of the distributed firewall system.

[0153] As mentioned above, multiple engine nodes in a distributed firewall system can share a session table, which is mainly used to control packet access. This is described below with reference to Figure 4.

[0154] Figure 4 shows a flow chart of a second data processing method provided in an embodiment of the present application. This method can be applied to the distributed firewall system shown in Figure 1a or Figure 1b. As shown in Figure 4, this method can include the following steps.

[0155] S401: A first engine node receives a first message.

[0156] The first message belongs to the first session. The first message can originate from an internal network or an external network, without limitation. For example, when joining the distributed firewall system, the first engine node can load the configuration and construct an ACL, etc., and obtain historical data of the distributed firewall system using the first data processing method described above to obtain a first session table. Optionally, the first engine node can also obtain first information. Thereafter, the first engine node initiates a message sending and receiving process to receive the first message.

[0157] S402: The first engine node determines whether the first session is a new session. For example, the session processing module in the first engine node may determine whether the first session is a new session.

[0158] Exemplarily, the first engine node can parse the first message header to determine whether the first session is a newly created session. For example, if the first message is a TCP SYN message, the first engine node determines that the first session is a newly created session and determines that the connection direction of the first session is the sending direction of the first message. For another example, if the first message is a TCP SYN-ACK message, the first engine node determines that the first session is a newly created session and determines that the connection direction of the first session is the opposite direction of the sending direction of the first message. For another example, if the first message is an ICMP ping request message, the first engine node determines that the first session is a newly created session and determines that the connection direction of the first session is the sending direction of the first message. For another example, if the first message is an ICMP ping response message, the first engine node determines that the first session is a newly created session and determines that the connection direction of the first session is the opposite direction of the sending direction of the first message. The embodiments of the present application do not limit the implementation process of the first engine node determining whether the first session is a newly created session.

[0159] If the first engine node determines that the first session is a new session, S403 and S404 are executed; or if the first engine node determines that the first session is not a new session, S406 is executed.

[0160] S403: The first engine node determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the session processing module in the first engine node can determine whether to allow access to the first message based on the connection direction of the first session and the ACL.

[0161] The first session is a newly created session. The first engine node can directly obtain the connection direction of the first session and determine whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the first engine node queries the ACL based on the connection direction of the first session. Further, if the query result indicates that access is allowed, the first engine node forwards the first message (for example, sends the first message to the destination of the first message); alternatively, if the query result indicates that access is not allowed, the first engine node discards the first message.

[0162] S404: The first engine node modifies the first session table. For example, the session processing module in the first engine node may modify the first session table.

[0163] S404 and S405 are optional steps, indicated by dashed lines in FIG4 . The first engine node may determine whether to modify the first session table based on the first session table. For example, if the first session table includes the first session identifier, the fourth information, and the connection direction of the first session, the first engine node determines not to modify the first session table. Alternatively, if the first session table does not include the first session identifier, or if the first session table includes the first session identifier and the third information, where the third information indicates that the connection direction of the first session is uncertain, the first engine node may modify the first session table. The modified first session table includes the first session identifier, the fourth information, and the connection direction of the first session.

[0164] S405: The first engine node sends the modified first session table to at least one engine node. For example, the message broadcast module in the first engine node may send the modified first session table to at least one engine node.

[0165] The at least one engine node is an engine node other than the first engine node in the distributed firewall system. The implementation process of S405 is described in detail in S201 and S202 and is not further described. For example, the first engine node writes the modified first session table to a file and a buffer, and transmits the modified first session table in the buffer.

[0166] It should be noted that the first engine node may send the modified first session table to at least one engine node, or may send the modified content of the first session table to at least one engine node, which is not limited in this embodiment of the present application.

[0167] S406: The first engine node determines whether the first session table includes the identifier of the first session. For example, the session processing module in the first engine node may determine whether the first session table includes the identifier of the first session.

[0168] If the first session is not a new session, the first engine node may determine the connection direction of the first session based on the first session table. For example, the first engine node may determine whether the first session table includes an identifier of the first session; or, in other words, the first engine node may determine whether the first session matches the first session table; or, in other words, the first engine node may determine whether the first session matches the first session table; or, the first engine node may determine whether the first session table includes information about the first session.

[0169] If the first engine node determines that the first session table does not include the identifier of the first session, S407 to S409 are executed; or if the first engine node determines that the first session table includes the identifier of the first session, S410 is executed.

[0170] S407: The first engine node determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the session processing module in the first engine node can determine whether to allow access to the first message based on the connection direction of the first session and the ACL.

[0171] The connection direction of the first session is the sending direction of the first message. That is, the first engine node uses the sending direction of the first message as the connection direction of the first session, and determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the first engine node queries the ACL based on the sending direction of the first message. Further, if the query result indicates that access is allowed, the first engine node forwards the first message (for example, sends the first message to the destination of the first message); or, if the query result indicates that access is not allowed, the first engine node discards the first message.

[0172] S408: The first engine node modifies the first session table. For example, the session processing module in the first engine node modifies the first session table.

[0173] The modified first session table includes the identifier of the first session and third information, wherein the third information is used to indicate that the connection direction of the first session is uncertain.

[0174] S409: The first engine node sends the modified first session table to at least one engine node. For example, the message broadcast module in the first engine node may send the modified first session table to at least one engine node.

[0175] The at least one engine node is an engine node other than the first engine node in the distributed firewall system. The implementation process of S409 is referred to the implementation process of S405 and will not be described in detail.

[0176] S410: The first engine node determines whether the connection direction of the first session is determined. For example, the session processing module in the first engine node may determine whether the connection direction of the first session is determined.

[0177] The first engine node may determine whether the connection direction of the first session is determined based on the first session table. For example, if the first session table includes the first session identifier, the fourth information, and the connection direction of the first session, the first engine node determines that the connection direction of the first session is determined and executes S411. Alternatively, if the first session table includes the first session identifier and the third information, the first engine node determines that the connection direction of the first session is undetermined and executes S412.

[0178] S411: The first engine node determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the session processing module in the first engine node can determine whether to allow access to the first message based on the connection direction of the first session and the ACL.

[0179] The first engine node obtains the connection direction of the first session from the first session table and determines whether to allow access to the first message based on the connection direction of the first session and the ACL. Furthermore, if the query result indicates that access is allowed in either the forward or reverse direction, the first engine node forwards the first message (e.g., sends the first message to the destination of the first message); otherwise, if the query result indicates that access is not allowed in either the forward or reverse direction, the first engine node discards the first message.

[0180] S412: The first engine node determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the session processing module in the first engine node can determine whether to allow access to the first message based on the connection direction of the first session and the ACL.

[0181] The connection direction of the first session includes the forward and reverse directions of the first message. That is, the first engine node uses the forward and reverse directions of the first message as the connection direction of the first session, and determines whether to allow access to the first message based on the connection direction of the first session and the ACL. For example, the first engine node queries the ACL based on the forward and reverse directions of the first message. Furthermore, if the query result indicates that any one of the forward and reverse directions is allowed to pass, the first engine node forwards the first message (for example, sends the first message to the destination of the first message); or, if the query result indicates that neither the forward nor reverse directions are allowed to pass, the first engine node discards the first message. The forward and reverse directions of the first message refer to the sending direction of the first message and the reverse direction of the sending direction of the first message.

[0182] In the second data processing method described above, the first engine node can implement access control for the first message based on the shared session table of the distributed firewall system. The shared session table among multiple engine nodes in the distributed firewall system ensures that sessions managed by any engine node can also be serviced by other engine nodes, enabling the firewall to adapt to elastic scaling scenarios.

[0183] As mentioned above, multiple engine nodes in a distributed firewall system can share information related to flow reassembly. This information is mainly used to reassemble message segments or fragments. This is described below with reference to FIG5.

[0184] FIG5 is a flow chart of a third processing method provided in an embodiment of the present application. This method can be applied to the distributed firewall system shown in FIG1a or FIG1b. As shown in FIG5, this method can include the following steps.

[0185] S501: The first engine node receives a second message.

[0186] The second message belongs to the first data flow. The second message can originate from either the internal network or the external network, without limitation. For example, when joining the distributed firewall system, the first engine node can load the configuration and construct an ACL, etc. It can also obtain historical data of the distributed firewall system using the first data processing method described above to obtain first information related to flow reassembly. Optionally, the first engine node can also obtain the first session table. Thereafter, the first engine node initiates the message sending and receiving process and receives the second message.

[0187] S502: The first engine node determines whether the second packet is the first packet in the first data stream. For example, the stream reassembly module in the first engine node may determine whether the second packet is the first packet in the first data stream.

[0188] For example, the first engine node parses the header of the second message to determine whether the second message is the first message in the first data stream. If the first engine node determines that the second message is the first message in the first data stream, S503 and S504 are executed; or if the first engine node determines that the second message is not the first message in the first data stream, S507 is executed.

[0189] S503: The first engine node performs stream reassembly processing on the second message. For example, the stream reassembly module in the first engine node may perform stream reassembly processing on the second message.

[0190] Optionally, if the buffer of the first engine node includes a message of the first data flow (such as the fourth message), the first engine node may perform stream reassembly processing on the second message and the fourth message.

[0191] S504: The first engine node determines whether the first data stream is completely reassembled. For example, the stream reassembly module in the first engine node may determine whether the first data stream is completely reassembled.

[0192] If the first engine node determines that the first data stream is reassembled completely, S505 is executed; or if the first engine node determines that the first data stream is not reassembled completely, S506 is executed.

[0193] S505: The first engine node sends the fifth information to at least one engine node. For example, the message broadcast module in the first engine node may send the fifth information to at least one engine node.

[0194] The at least one engine node is an engine node other than the first engine node in the distributed firewall system. The fifth information can be used to indicate that the first data stream has been reassembled, so that other engine nodes can delete packets of the first data stream from their buffers, thereby saving storage resources. The implementation process of S505 is similar to the implementation process of S201 and S202 and will not be further described.

[0195] S506: The first engine node sends the sixth information to at least one engine node. For example, the message broadcast module in the first engine node may send the sixth information to at least one engine node.

[0196] The at least one engine node is an engine node other than the first engine node in the distributed firewall system. The sixth information can be used to indicate that the first data stream reassembly is incomplete and that the primary processing node for the first data stream is the first engine node, thereby causing the other engine nodes to send the packets of the first data stream buffered in their buffers to the first engine node. The implementation process of S506 is similar to the implementation process of S201 and S202 and is not further described.

[0197] S507: The first engine node determines whether the first data stream is reassembled according to the first information. For example, the stream reassembly module in the first engine node can determine whether the first data stream is reassembled according to the first information.

[0198] If the first information is the fifth information, the first engine node determines that the first data stream is reassembled, discards the second message, and ends the process; or if the first information does not include information about the first data stream, execute S508 and S509; or if the first information is used to indicate that the first data stream is not reassembled and the main processing node is the third engine node, execute S510.

[0199] S508: The first engine node caches the second message.

[0200] For example, the first engine node writes the second message into the buffer.

[0201] S509: The first engine node determines whether the main processing node is the first engine node. For example, the stream reassembly module in the first engine node may determine whether the main processing node is the first engine node.

[0202] If the first engine node determines in S502 that the second packet is not the first packet in the first data stream, and subsequently receives the first packet of the first data stream (e.g., the third packet) (e.g., the third packet is received after S502 and before S507), the first engine node determines itself as the primary processing node and executes S503. For example, the first engine node receives the third packet (not shown in FIG5 ), and if the third packet is the first packet in the first data stream, performs stream reassembly processing on the second packet and the third packet.

[0203] Alternatively, if the first engine node determines that the primary processing node is not itself based on the first information or the seventh information, S510 is executed. For example, if the first information indicates that the first data stream is not fully reassembled and the primary processing node is the third engine node, the first engine node determines that the primary processing node is not itself based on the first information and executes S510. For another example, if the first engine node receives seventh information (e.g., after S507 and at S509 from the third engine node), the seventh information indicates that the first data stream is not fully reassembled and the primary processing node is the third engine node, the first engine node determines that the primary processing node is not itself based on the seventh information and executes S510.

[0204] S510: The first engine node sends a second message to the third engine node.

[0205] Correspondingly, the third engine node receives the second message and performs stream reassembly on the second message. For example, if the first information indicates that the first data stream has not been reassembled and the primary processing node for the first data stream is the third engine node, the third engine node may send the second message to the third engine node based on the first information. For another example, if the first information indicates that the first data stream has not been reassembled and the primary processing node for the first data stream does not exist, the first engine node may receive the seventh information and send the second message to the third engine node based on the seventh information.

[0206] In the third data processing method described above, the first engine node can reassemble message segments or fragments based on the information related to flow reassembly shared by the distributed firewall system. Multiple engine nodes in the distributed firewall system share this information, allowing message segments or fragments from the same data flow to be distributed to any engine node. Using this third data processing method, the main processing node can reassemble these message segments or fragments to obtain a complete data flow.

[0207] In the embodiments provided herein, the methods provided herein are described from the perspective of a first engine node. The steps performed by the first engine node may be implemented by different functional entities comprising the first engine node. The first engine node may include hardware structures and / or software modules, and implement the aforementioned functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. Whether any of the aforementioned functions is implemented in the form of hardware structures, software modules, or a combination of hardware structures and software modules depends on the specific application and design constraints of the technical solution.

[0208] The following describes the data processing device used to implement the above method in the embodiment of the present application in conjunction with the accompanying drawings. Therefore, the above content can be used in subsequent embodiments, and repeated content will not be repeated.

[0209] Figure 6 shows a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. The data processing device 600 can implement the functions of the first engine node in each of the above-mentioned method embodiments. As shown in Figure 6, the data processing device 600 includes a processing module 601, a sending module 602, and a receiving module 603. Among them, the processing module 601 can also be referred to as a processing unit, a logic unit, etc. The sending module 602 can also be referred to as a sending unit. The receiving module 603 can also be referred to as a receiving unit. The sending module 602 and the receiving module 603 can also be collectively referred to as a transceiver module (or transceiver unit), a communication module (or communication unit), or an interface circuit, etc.

[0210] Optionally, the data processing device 600 may further include a storage module 604, which is indicated by a dotted line in Figure 6. The storage module 604 may also be referred to as a storage unit, a memory, or the like.

[0211] The processing module 601, the sending module 602, the receiving module 603, and the storage module 604 can all be implemented by software, hardware, or a combination of software and hardware. For example, the implementation of the processing module 601 will be described below using the processing module 601 as an example. Similarly, the implementation of the sending module 602, the receiving module 603, and the storage module 604 can be compared with the implementation of the processing module 601.

[0212] As an example of a software functional unit, the processing module 601 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the processing module 601 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0213] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0214] As an example of a hardware functional unit, processing module 601 may include at least one computing device, such as a server. Alternatively, processing module 601 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0215] The multiple computing devices included in processing module 601 can be distributed in the same region or in different regions. The multiple computing devices included in processing module 601 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in processing module 601 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0216] For example, the processing module 601 can be used to execute S203 and S206 in the method embodiment shown in FIG2 , execute S402 to S404, S406 to S407, S410 to S411 in the method embodiment shown in FIG4 , and execute S502 to S504, S507, and S509 in the method embodiment shown in FIG5 . The sending module 602 can be used to execute S204 in the method embodiment shown in FIG2 , execute S405 and S409 in the method embodiment shown in FIG4 , and execute S505, S506, and S510 in the method embodiment shown in FIG5 . The receiving module 603 can be used to execute S201 and S205 in the method embodiment shown in FIG2 , execute S401 in the method embodiment shown in FIG4 , and execute S501 in the method embodiment shown in FIG5 . The storage module 604 can be used to execute S508 in the method embodiment shown in FIG5 . For the specific implementation process, please refer to the aforementioned method embodiments and will not be repeated here.

[0217] This application also provides a computing device 700. As shown in Figure 7, computing device 700 includes a bus 701, a processor 702, a memory 703, and a communication interface 704. Processor 702, memory 703, and communication interface 704 communicate with each other via bus 702. Computing device 700 can be a server, configured to implement the functionality of a first engine node. It should be understood that this application does not limit the number of processors and memories in computing device 700.

[0218] Bus 701 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG7 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 701 may include a path for transmitting information between various components of computing device 700 (e.g., memory 703, processor 702, and communication interface 704).

[0219] The processor 702 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0220] The memory 703 may include a volatile memory, such as a random access memory (RAM). The processor 702 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0221] The memory 703 stores executable program code, and the processor 702 executes the executable program code to respectively implement the functions of the aforementioned processing module 601, the sending module 602, the receiving module 603, and the storage module 604, thereby implementing the aforementioned method embodiments. In other words, the memory 703 stores instructions for executing the aforementioned method embodiments.

[0222] Alternatively, the memory 703 stores executable code, and the processor 702 executes the executable code to implement the functions of the aforementioned processing module 601, sending module 602, receiving module 603, and storage module 604, thereby implementing the aforementioned method embodiments. In other words, the memory 703 stores instructions for executing the aforementioned method embodiments.

[0223] The communication interface 704 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or communication networks. For example, the communication interface 704 can implement the functions of the sending module 602 and the receiving module 603.

[0224] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0225] As shown in Figure 8, the computing device cluster includes at least one computing device 700. The memory 703 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the aforementioned various method embodiments.

[0226] In some possible implementations, the memory 703 of one or more computing devices 700 in the computing device cluster may also store some instructions for executing the aforementioned method embodiments. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for executing the aforementioned method embodiments.

[0227] It should be noted that the memory 703 in different computing devices 700 in the computing device cluster can store different instructions, each used to execute part of the functions of the data processing apparatus 600. In other words, the instructions stored in the memory 703 in different computing devices 700 can implement the functions of one or more modules among the processing module 601, the sending module 602, the receiving module 603, and the storage module 604.

[0228] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network (WAN) or a local area network (LAN), among others. FIG. 9 illustrates a possible implementation. As shown in FIG. 9 , two computing devices 700A and 700B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 703 in the computing device 700A stores instructions for executing the functions of the processing module 601 and the storage module 604. Simultaneously, the memory 703 in the computing device 700B stores instructions for executing the functions of the sending module 602 and the receiving module 603.

[0229] The connection method between the computing device clusters shown in Figure 9 can be that considering that receiving actions and sending actions need to be performed in the aforementioned method embodiments provided in this application, it is considered to entrust the functions implemented by the sending module 602 and the receiving module 603 to the computing device 700B for execution.

[0230] It should be understood that the functionality of the computing device 700A shown in FIG9 may also be implemented by multiple computing devices 700. Similarly, the functionality of the computing device 700B may also be implemented by multiple computing devices 700.

[0231] The present application also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similar to the connection method of the computing device cluster described in Figures 8 and 9. However, the memory 703 in one or more computing devices 700 in this computing device cluster can store the same instructions for executing the aforementioned method embodiment.

[0232] In some possible implementations, the memory 703 of one or more computing devices 700 in the computing device cluster may also store some instructions for executing the aforementioned method embodiment. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for executing the aforementioned method embodiment.

[0233] It should be noted that the memory 703 in different computing devices 700 in the computing device cluster can store different instructions for executing portions of the functions of the distributed firewall system. In other words, the instructions stored in the memory 703 in different computing devices 700 can implement the functions of one or more of the first engine node, the second engine node, and the third engine node.

[0234] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes each of the aforementioned method embodiments.

[0235] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned various method embodiments, or instruct the computing device to execute the aforementioned various method embodiments.

[0236] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A data processing method, characterized in that: The distributed firewall system includes multiple engine nodes, and the method includes: The first engine node creates a first bitmap file for the second engine node, wherein the first bitmap file is used to indicate a reception status of each of at least one message from the second engine node by the first engine node, the at least one message including one or more of the following: a first session table, or first information related to stream reassembly, the first engine node and the second engine node belonging to the plurality of engine nodes; When the first bit table file indicates that N messages in the at least one message have not been received, the first engine node sends a request message to the second engine node, wherein the request message is used to request the N messages, where N is a positive integer; The first engine node receives the N messages sent from the second engine node; The first engine node modifies the first bitmap file, and the modified first bitmap file is used to indicate that the at least one message has been received.

2. The method according to claim 1, characterized in that The method further comprises: The first engine node stores H messages to be sent, where the H messages include one or more of the following: a second session table, or second information related to stream reassembly, where H is a positive integer; The first engine node sends the H messages to at least one engine node among the plurality of engine nodes except the first engine node.

3. The method according to claim 2, characterized in that The sending the H messages to at least one engine node other than the first engine node among the plurality of engine nodes includes: The first engine node writes the H messages into a buffer; When a first condition is met, the first engine node sends the H messages to at least one engine node other than the first engine node among the multiple engine nodes, wherein the first condition includes one or more of the following: the data volume of the H messages is greater than or equal to a first threshold, or the cache time of the H messages is greater than or equal to a second threshold.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The first engine node receives a first message, where the first message belongs to a first session; In a case where the first session is a newly created session, the first engine node determines whether to allow access of the first message according to a connection direction of the first session and an access control list.

5. The method according to claim 4, characterized in that The at least one message includes the first session table, and the method further includes: If the first session table does not include the identifier of the first session, or if the first session table includes the identifier of the first session and third information, where the third information is used to indicate that a connection direction of the first session is uncertain, the first engine node modifies the first session table, wherein the modified first session table includes the identifier of the first session, fourth information, and the connection direction of the first session, where the fourth information is used to indicate that the connection direction of the first session is determined; The first engine node sends the modified first session table to at least one engine node among the plurality of engine nodes except the first engine node.

6. The method according to any one of claims 1 to 3, characterized in that The at least one message includes the first session table, and the method further includes: The first engine node receives a first message, where the first message belongs to a first session; If the first session is not a new session, the first engine node determines a connection direction of the first session according to the first session table, wherein the first session table does not include an identifier of the first session, and the connection direction of the first session is a sending direction of the first message; The first engine node determines whether to allow access to the first message according to a connection direction of the first session and an access control list; The first engine node modifies the first session table, wherein the modified first session table includes an identifier of the first session and third information, where the third information is used to indicate that a connection direction of the first session is uncertain; The first engine node sends the modified first session table to at least one engine node among the plurality of engine nodes except the first engine node.

7. The method according to any one of claims 1 to 3, characterized in that The at least one message includes the first session table, and the method further includes: The first engine node receives a first message, where the first message belongs to a first session; If the first session is not a new session, the first engine node determines a connection direction of the first session according to the first session table; The first engine node determines whether to allow access to the first message according to a connection direction of the first session and an access control list; The first session table includes an identifier of the first session, fourth information, and a connection direction of the first session, where the fourth information is used to indicate that the connection direction of the first session is determined. Alternatively, the first session table includes an identifier of the first session and third information, where the third information is used to indicate that the connection direction of the first session is determined, and the connection direction of the first session includes both forward and reverse directions of the first message.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: The first engine node receives a second message, where the second message belongs to the first data flow; In a case where the second message is the first message in the first data flow, the first engine node performs stream reassembly processing on the second message; When the first data stream is reassembled, the first engine node sends fifth information to at least one engine node among the multiple engine nodes other than the first engine node, where the fifth information is used to indicate that the reassembly of the first data stream is completed; or, when the first data stream is not reassembled, the first engine node sends sixth information to at least one engine node among the multiple engine nodes other than the first engine node, where the sixth information is used to indicate that the first data stream is not reassembled and the main processing node of the first data stream is the first engine node.

9. The method according to any one of claims 1 to 7, characterized in that The at least one message includes the first information, the first information does not include information of the first data stream, and the method further includes: The first engine node receives a second message, where the second message belongs to the first data flow; In a case where the second message is not the first message in the first data flow, the first engine node determines, based on the first information, that the first data flow is not completely reassembled and that a primary processing node for the first data flow does not exist; The first engine node caches the second message.

10. The method according to claim 9, characterized in that The method further comprises: The first engine node receives seventh information, where the seventh information is used to indicate that the first data stream is not completely reassembled and a main processing node for the first data stream is a third engine node, and the third engine node belongs to the multiple engine nodes; The first engine node sends the second message to the third engine node.

11. The method according to claim 9, characterized in that The method further comprises: The first engine node receives a third message, where the third message belongs to the first data flow; In a case where the third message is the first message in the first data flow, the first engine node performs stream reassembly processing on the second message and the third message; When the first data stream is reassembled, the first engine node sends fifth information to at least one engine node among the multiple engine nodes other than the first engine node, where the fifth information is used to indicate that the reassembly of the first data stream is completed; or, when the first data stream is not reassembled, the first engine node sends sixth information to at least one engine node among the multiple engine nodes other than the first engine node, where the sixth information is used to indicate that the first data stream is not reassembled and the main processing node of the first data stream is the first engine node.

12. The method according to any one of claims 1 to 7, characterized in that The at least one message includes the first information, where the first information is used to indicate that the first data stream is not completely reassembled and a main processing node for the first data stream is a third engine node, and the method further includes: The first engine node receives a second message, where the second message belongs to the first data flow; The first engine node sends the second message to the third engine node according to the first information.

13. A data processing method, characterized in that: Applied to a distributed firewall system, the distributed firewall system includes a plurality of engine nodes, the plurality of engine nodes including a first engine node and a second engine node, the method includes: The second engine node stores at least one message to be sent, and sends the at least one message to at least one engine node other than the second engine node among the plurality of engine nodes; wherein the at least one message includes one or more of the following: a first session table, or first information related to stream reassembly; The first engine node creates a first bitmap file for the second engine node, and sends a request message to the second engine node when the first bitmap file indicates that N messages in the at least one message have not been received; wherein the first bitmap file is used to indicate the first engine node's reception status of each message in the at least one message, and the request message is used to request the N messages, where N is a positive integer; The second engine node receives the request message from the first engine node and sends N messages to the first engine node; The first engine node receives the N messages sent from the second engine node and modifies the first bitmap file, where the modified first bitmap file is used to indicate that the at least one message has been received.

14. A data processing device, characterized in that: The device is applied to a first engine node in a distributed firewall system, the distributed firewall system includes multiple engine nodes, the first engine node belongs to the multiple engine nodes, and the device includes a processing module, a sending module, and a receiving module, wherein: the processing module is configured to create a first bitmap file for the second engine node, wherein the first bitmap file is configured to indicate a reception status of each of at least one message from the second engine node by the first engine node, the at least one message comprising one or more of the following: a first session table, or first information related to stream reassembly, the second engine node belonging to the plurality of engine nodes; The sending module is configured to send a request message to the second engine node when the first bit table file indicates that N messages in the at least one message have not been received, wherein the request message is used to request the N messages, and N is a positive integer; The receiving module is configured to receive the N messages sent from the second engine node; The processing module is further configured to modify the first bitmap file, and the modified first bitmap file is configured to indicate that the at least one message has been received.

15. A distributed firewall system, characterized in that: The distributed firewall system includes a plurality of engine nodes, wherein the plurality of engine nodes include a first engine node and a second engine node, wherein: The second engine node is configured to store at least one message to be sent, and send the at least one message to at least one engine node other than the second engine node among the plurality of engine nodes; wherein the at least one message includes one or more of the following: a first session table, or first information related to stream reassembly; The first engine node is configured to create a first bitmap file for the second engine node, and send a request message to the second engine node when the first bitmap file indicates that N messages in the at least one message have not been received; wherein the first bitmap file is configured to indicate a reception status of each message in the at least one message by the first engine node, and the request message is configured to request the N messages, where N is a positive integer; The second engine node is further configured to receive a request message from the first engine node and send N messages to the first engine node; The first engine node is further configured to receive the N messages sent from the second engine node and modify the first bitmap file, where the modified first bitmap file is configured to indicate that the at least one message has been received.

16. A computing device cluster, characterized in that: comprising at least one computing device, each computing device including a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in a memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 12 or claim 13.

17. A computer-readable storage medium, characterized in that The method comprises computer program instructions which, when executed by a computing device cluster, cause the computing device cluster to perform the method of any one of claims 1 to 12 or claim 13.

18. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 12 or claim 13.

Images