Session access control method and apparatus, device, medium, and program product

Abstract

The present application relates to the field of data communications, and discloses a session access control method and apparatus, a device, a medium, and a program product. The method comprises: receiving a first data packet, wherein the first data packet includes a data packet transmitted upon establishment of a TCP communication session; on the basis of an IP address and port in the first data packet, a service port set, and a registered IP address set, determining a first ACL and / or a second ACL as a target ACL, wherein the service port set comprises an IP address and port of a registered communication device that serves as a server, or comprises an IP address and port of an unregistered communication device that serves as a server, the server is a receiver of the TCP communication session, the registered IP address set comprises the IP address of the registered communication device, the first ACL corresponds to a first session case of the registered communication device, and the second ACL corresponds to a second session case of the registered communication device; and executing an access control operation according to the target ACL.

Description

Session access control method, device, equipment, medium and program product

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202410833758.7, filed on June 25, 2024, entitled "Session access control method, device, equipment, medium and program product", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0003] The present application belongs to the field of data communication, and particularly relates to a session access control method, device, equipment, medium and program product. BACKGROUND

[0004] Transmission Control Protocol (TCP) is a connection-oriented, reliable transport layer communication protocol. In a scenario where a client accesses a server and the server provides services for the client, a TCP communication session can be established between the client and the server to transmit data packets. In order to improve network security, a firewall can be set up to detect data packets between the client and the server based on rules and block data packets that do not meet the rules, so as to implement session access control. However, the firewall based on data packet detection cannot determine the TCP session direction of the data packets, and in some scenarios, such as a scenario where a device with an Internet Protocol Address (IP) address A1 is allowed to access a device with an IP address A2, but a device with an IP address A2 is not allowed to access a device with an IP address A1, it is not possible to configure an access control rule that meets the scenario, so that the session access control of the firewall cannot meet the actual scenario requirements and has poor applicability. SUMMARY

[0005] Embodiments of the present application provide a session access control method, device, equipment, medium and program product, which can improve the applicability of the firewall.

[0006] In a first aspect, an embodiment of the present application provides a session access control method, comprising: receiving a first data packet, the first data packet comprising a data packet transmitted after a transmission control protocol (TCP) communication session is established; determining a preset first access control list (ACL) and / or a preset second ACL as a target ACL based on a network protocol (IP) address and a port in the first data packet, a service port set, and a registered IP address set, the service port set comprising an IP address and a port of a communication device registered as a service end or comprising an IP address and a port of a communication device not registered as a service end, the service end being a receiver of the TCP communication session, the registered IP address set comprising an IP address of a registered communication device, the first ACL corresponding to a first session direction of the registered communication device, and the second ACL corresponding to a second session direction of the registered communication device; and performing an access control operation according to the target ACL.

[0007] In a second aspect, an embodiment of the present application provides a session access control apparatus, comprising: a receiving module configured to receive a first data packet, the first data packet comprising a data packet transmitted after a transmission control protocol (TCP) communication session is established; an access control list determining module configured to determine a preset first access control list (ACL) and / or a preset second ACL as a target ACL based on a network protocol (IP) address and a port in the first data packet, a service port set, and a registered IP address set, the service port set comprising an IP address and a port of a communication device registered as a service end or comprising an IP address and a port of a communication device not registered as a service end, the service end being a receiver of the TCP communication session, the registered IP address set comprising an IP address of a registered communication device, the first ACL corresponding to a first session direction of the registered communication device, and the second ACL corresponding to a second session direction of the registered communication device; and an access control module configured to perform an access control operation according to the target ACL.

[0008] In a third aspect, an embodiment of the present application provides a firewall device, comprising: a processor and a memory storing computer program instructions; and the processor implements the session access control method of the first aspect when executing the computer program instructions.

[0009] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing computer program instructions, and the computer program instructions are executed by a processor to implement the session access control method of the first aspect.

[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the session access control method of the first aspect.

[0011] The embodiment of the present application provides a session access control method, device, equipment, medium and program product, which can set corresponding ACLs for different session directions of a TCP communication session, a firewall device can receive a data packet transmitted after a TCP communication session is established, determine the session direction of the TCP communication session to which the data packet belongs according to a service port set recording an IP address and a port of a communication device serving as a receiving end of the TCP communication session, determine the ACL corresponding to the session direction, and perform an access control operation according to the ACL corresponding to the session direction. Through the service port set and the registered IP address set, the firewall device based on data packet detection can also identify the session direction of the TCP communication session, can configure respective ACLs for different session directions, and can configure access control rules meeting various scenes, so that the session access control of the firewall can meet the actual scene requirements and improve the applicability of the firewall. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced. Those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0013] Fig. 1 is an architecture schematic diagram of an example of an application scenario of a session access control method provided by the present application;

[0014] Fig. 2 is an architecture schematic diagram of another example of an application scenario of a session access control method provided by the present application;

[0015] Fig. 3 is a flowchart of a session access control method provided by an embodiment of the present application;

[0016] Fig. 4 is a flowchart of a session access control method provided by another embodiment of the present application;

[0017] Fig. 5 is a flowchart of a session access control method provided by still another embodiment of the present application;

[0018] Fig. 6 is an architecture schematic diagram of an example of a cloud firewall provided by the present application;

[0019] Fig. 7 is a structure schematic diagram of a session access control device provided by an embodiment of the present application;

[0020] Fig. 8 is a structure schematic diagram of a firewall device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0021] The features and exemplary embodiments of various aspects of the present application will be described below in detail, in order to make the purposes, technical solutions and advantages of the present application more clear and apparent, the present application will be further described in detail below in combination with the drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, but not to limit the present application. For those skilled in the art, the present application can be implemented without some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application. It should be noted that the acquisition, storage, use, processing, etc. of information and data in the embodiments of the present application are authorized by the user or relevant institution and comply with relevant regulations of national laws and regulations.

[0022] TCP is a connection-oriented, reliable transport layer communication protocol. In the scenario where a client accesses a server and the server provides services for the client, a TCP communication session can be established between the client and the server, so as to transmit data packets. In order to improve network security, a firewall can be set up, which detects data packets between the client and the server based on rules and blocks data packets that do not meet the rules, so as to realize session access control. However, the firewall based on data packet detection cannot determine the TCP session direction of the data packet, so it cannot configure access control rules that meet the requirements of some scenarios, so that the session access control of the firewall cannot meet the actual scenario requirements. For example, for the scenario where the device with IP address A1 is allowed to access the device with IP address A2, but the device with IP address A2 is not allowed to access the device with IP address A1, it is not possible to configure access control rules that meet the scenario, so that the session access control of the firewall cannot meet the actual scenario requirements, and the applicability is poor.

[0023] In order to improve the adaptability of the session access control of the firewall, a state detection firewall can be used for session access control. The state detection firewall records TCP communication sessions through a session table, and regards all messages exchanged between the communication parties belonging to the same connection as a whole data flow, so as to identify the session direction. However, the session table needs to occupy a very large storage space. When the number of sessions recorded in the session table reaches a certain order of magnitude, such as 200,000 sessions, the query and maintenance time of the session table will be greatly increased, which will reduce the performance of the session access control. Moreover, TCP communication sessions are long connections, and the data exchange interval between sessions can be long. Network attackers can establish TCP communication sessions with the target server continuously, but do not release the corresponding TCP communication connections, so that the number of sessions in the session table maintained by the state detection firewall can easily reach the upper limit, so that the state detection firewall is easily damaged by malicious attacks.

[0024] The application provides a session access control method, device, equipment, medium and program product. The method can set an access control list (ACL) corresponding to different session directions based on a packet detection-based firewall, determine a session direction of a TCP communication session to which a data packet belongs according to a server port set recording an IP address and a port of a communication device serving as a receiver of the TCP communication session, determine an ACL corresponding to the session direction, and perform an access control operation according to the ACL corresponding to the session direction. The identification of the session direction enables the setting of the ACLs for different session directions, thereby enabling the configuration of access control rules meeting various scenarios, making the session access control of the firewall meet the actual scenario requirements, and improving the applicability of the firewall. Moreover, the packet detection-based firewall does not need to establish a session table. The server port set occupies a very small storage space compared with the session table. Even if a network attacker continuously establishes TCP communication connections with a target server, the IP address and the port of the target server do not change, and the server port table does not record each TCP communication connection established according to different IP addresses and ports. The number of records in the server port set always remains at a low level, thereby guaranteeing the communication performance and avoiding the malicious attack and destruction of the firewall.

[0025] To facilitate understanding, the application scenario of the session access control method provided in the embodiments of the application is first simply described. FIG. 1 is an architecture schematic diagram of an example of the application scenario of the session access control method provided in the embodiments of the application. As shown in FIG. 1, a communication device 11 communicates with a communication device 13 through a firewall device 12. The firewall device 12 is a firewall device connected in series between the communication device 11 and the communication device 13, and can execute the session access control method in the embodiments of the application.

[0026] FIG. 2 is an architecture schematic diagram of another example of the application scenario of the session access control method provided in the embodiments of the application. As shown in FIG. 2, the communication device 11 and the communication device 13 communicate, and a firewall device 14 is a bypass firewall device of the communication device 11 and the communication device 13. The firewall device 14 can execute the session access control method in the embodiments of the application. The communication device 11 and the communication device 13 in FIG. 1 are only examples, and more communication devices can be included in the actual application scenario, which is not limited herein.

[0027] The session access control method, device, equipment, medium and program product provided in the application are described below.

[0028] The first aspect of the present application provides a session access control method, which can be applied to a session access control scenario of a firewall or other scenarios. The session access control method can be executed by a session access control device, equipment, or the like. The session access control device can be implemented as a firewall device, a firewall system, or the like, and is not limited herein. FIG. 3 is a flowchart of a session access control method according to an embodiment of the present application. As shown in FIG. 3, the session access control method can include steps S201 to S203.

[0029] In step S201, a first data packet is received.

[0030] The first data packet includes a data packet transmitted after a TCP communication session is established. That is, the data packet transmitted between two communication devices after the TCP communication session is established can be referred to as the first data packet.

[0031] In step S202, a preset first access control list (ACL) and / or a preset second ACL are determined as a target ACL based on a network protocol (IP) address and a port in the first data packet, a service port set, and a registered IP address set.

[0032] The first data packet can include an IP address and a port. Specifically, the first data packet includes a source IP address, a source port, a destination IP address, and a destination port. The source IP address and the source port are an IP address and a port of a sender of the first data packet. The destination IP address and the destination port are an IP address and a port of a receiver of the first data packet. Only the first data packet can indicate a transmission direction of the first data packet, but cannot determine a session direction of a TCP communication session to which the first data packet belongs. In the TCP communication session, the initiator of the TCP communication session can be the sender of the first data packet or the receiver of the first data packet. Similarly, the receiver of the TCP communication session can be the sender of the first data packet or the receiver of the first data packet.

[0033] For ease of description, the receiver of the TCP communication session is referred to as a server, and the initiator of the TCP communication session is referred to as a client in the embodiments of the present application. It should be noted that the identity of a communication device in different TCP communication sessions can be different. For example, a communication device is a server in one TCP communication session, and the communication device is a client in another TCP communication session. The service port set is a dynamic set, which can be implemented in the form of a table. For example, the service port set is implemented in the form of a service port table. The service port set can include an IP address and a port of a communication device that is registered and acts as a server. Alternatively, the service port set can include an IP address and a port of a communication device that is not registered and acts as a server. The registered IP address set includes an IP address of a registered communication device. The registered communication device is a communication device registered with the firewall, that is, the registered communication device is a communication device protected by the firewall.

[0034] In the embodiments of the present application, the ACL includes a first ACL and a second ACL, the first ACL corresponds to a first session direction of the registered communication device, and the second ACL corresponds to a second session direction of the registered communication device. The first ACL includes access control rules configured for the first session direction of the registered communication device. The second ACL includes access control rules configured for the second session direction of the registered communication device. The first session direction is opposite to the second session direction, for example, for a registered communication device, the session direction of the registered communication device as a server in a TCP communication session is the first session direction, and the session direction of the registered communication device as a client in the TCP communication session is the second session direction. Through the setting of the first ACL and the second ACL, various actual scene requirements can be met. For example, the scenario mentioned in the related art above that the communication device of IP address A1 is allowed to access the communication device of IP address A2, but the communication device of IP address A2 is not allowed to access the communication device of IP address A1 cannot be configured, in the embodiments of the present application, the access control rule that the communication device of IP address A1 is allowed to access the communication device of IP address A2 can be configured in the first ACL, and the access control rule that the communication device of IP address A2 is not allowed to access the communication device of IP address A1 can be configured in the second ACL, thereby meeting the configuration requirements of the scenario.

[0035] Whether the sender communication device and the receiver communication device of the first data packet are servers or clients, and whether the sender communication device and the receiver communication device of the first data packet are registered communication devices can be determined by whether the IP address and the port in the first data packet are recorded in the server port set and whether the IP address in the first data packet is recorded in the registered IP address set, thereby determining the session direction of the registered communication device, and realizing the session direction identification of the TCP communication session by the firewall device based on data packet detection. The session direction of the current TCP communication session is determined, and the first ACL or the second ACL corresponding to the session direction of the current TCP communication session is determined as the target ACL.

[0036] In step S203, an access control operation is performed according to the target ACL.

[0037] After the target ACL is determined, the access control operation can be performed according to the access control rules in the target ACL. The target ACL includes the first ACL and / or the second ACL. The target ACL belongs to the ACL, the ACL can include an access prohibition rule and / or an access permission rule, the access prohibition rule can include a communication rule representing access prohibition, and the access permission rule can include a rule representing access permission. For example, the rules of the first ACL are shown in Table One as follows:

[0038] Table One

[0039] The access control rule with the serial number 2 is a forbidden access rule, indicating that the communication device with the IP address of Cloud_IP_A is forbidden to access the communication device with the IP address of Cloud_IP_B through any port.

[0040] In the case that the ACL includes the forbidden access rules, if the first data packet matches any one of the forbidden access rules, the TCP communication session to which the data packet belongs is blocked. If the first data packet matches any one of the forbidden access rules, it indicates that the TCP communication session to which the first data packet belongs is forbidden, and the TCP communication session should be stopped. In the case that the ACL includes the allowed access rules, if the first data packet does not match any one of the allowed access rules, the TCP communication session to which the data packet belongs is blocked. If the first data packet matches the allowed access rules, it indicates that the TCP communication session to which the first data packet belongs is allowed, and the TCP communication session can continue. If the first data packet does not match any one of the allowed access rules, it indicates that the TCP communication session to which the first data packet belongs is forbidden, and the TCP communication session should be stopped. Specifically, blocking the TCP communication session to which the first data packet belongs can be specifically implemented as, but is not limited to, the firewall device sending an end session data packet to the initiating communication device and the receiving communication device of the TCP communication session to which the first data packet belongs, ending the TCP communication session to which the first data packet belongs, so as to realize the blocking of the TCP communication session.

[0041] In the embodiments of the present application, the corresponding ACL can be set for different session directions of the TCP communication session, the firewall device can receive the data packet transmitted after the TCP communication session is established, determine the session direction of the TCP communication session to which the data packet belongs according to the service port set recording the IP address and port of the communication device as the server, i.e., the receiver of the TCP communication session, determine the ACL corresponding to the session direction, and perform the access control operation according to the ACL corresponding to the session direction. Through the service port set and the registered IP address set, the firewall device based on data packet detection can also identify the session direction of the TCP communication session, and can configure the respective ACLs for different session directions, so as to configure the access control rules meeting various scenarios, so that the session access control of the firewall can meet the actual scenario requirements, and the applicability of the firewall is improved. Moreover, the service port set set by the firewall based on data packet detection occupies very small storage space, and the maintenance time and query time are very short, which can guarantee the performance of the session access control. Even if the network attacker attacks the network by continuously establishing the TCP communication session, the number of IP addresses and ports recorded in the service port set remains at a low level, which can adapt to the scenario with high concurrency and avoid the firewall being damaged by malicious attacks, and the security of the session access control is improved.

[0042] In some embodiments, the session direction of the registered communication device in the TCP communication session can be determined first, and the target ACL is determined according to the session direction. The above step S202 can be specifically refined as: determining the session direction of the registered communication device in the TCP communication session according to whether the service port set includes the IP address and port in the first data packet, and whether the registered IP address set includes the IP address in the first data packet; and determining the first ACL and / or the second ACL as the target ACL according to the session direction of the registered communication device in the TCP communication session.

[0043] According to whether the service port set includes the IP address and port in the first data packet and whether the registered IP address set includes the IP address in the first data packet, it can be determined whether the registered communication device is a server or a receiver in this TCP communication session, and then the session direction of the registered communication device in the TCP communication session is determined, and the session direction of the registered communication device in the TCP communication session can be regarded as the session direction of the TCP communication session. The first data packet includes two groups of IP addresses and ports, one group of IP addresses and ports is the source IP address and source port, and the other group of IP addresses and ports is the destination IP address and destination port.

[0044] In some examples, the service port set includes an IP address and a port of the communication device that is registered and is a server, i.e., the service port set records an IP address and a port of the communication device that is protected by the firewall device and is a server. The session direction of the registered communication device in the TCP communication session is determined to include the first session direction if the service port set includes a set of IP address and port in the first packet and the registered IP address set includes an IP address of the set of IP address and port. The service port set includes a set of IP address and port in the first packet can be implemented as the service port set includes a source IP address and a source port in the first packet or the service port set includes a destination IP address and a destination port in the first packet. The service port set includes a set of IP address and port in the first packet and the registered IP address set also includes an IP address of the set of IP address and port, which indicates that the registered communication device in the TCP communication session is a server and the unregistered communication device in the TCP communication session is a client, in which case it can be considered that the unregistered communication device initiates the TCP communication session to the registered communication device, i.e., the session direction of the TCP communication session in which the registered communication device is a server is the first session direction. The session direction of the registered communication device in the TCP communication session is determined to include the second session direction if the service port set does not include any set of IP address and port in the first packet and the registered IP address set includes an IP address of a set of IP address and port in the first packet. The service port set does not include any set of IP address and port in the first packet, i.e., the service port set neither includes a source IP address and a source port in the first packet nor includes a destination IP address and a destination port in the first packet. The service port set does not include any set of IP address and port in the first packet and the registered IP address set includes an IP address of a set of IP address and port in the first packet, which indicates that the registered communication device in the TCP communication session is a client and the unregistered communication device in the TCP communication session is a server, in which case it can be considered that the registered communication device initiates the TCP communication session to the unregistered communication device, i.e., the session direction of the TCP communication session in which the registered communication device is a client is the second session direction. The session direction of the registered communication device in the TCP communication session is determined to include the first session direction and the second session direction if the service port set includes a set of IP address and port in the first packet and the registered IP address set includes an IP address of two sets of IP address and port in the first packet. The service port set includes a set of IP address and port in the first packet can be implemented as the service port set includes a source IP address and a source port in the first packet or the service port set includes a destination IP address and a destination port in the first packet.The service port set includes a set of IP addresses and ports in the first data packet, and the registered IP address set includes IP addresses in two sets of IP addresses and ports in the first data packet, indicating that both communication devices involved in the TCP communication session are registered communication devices, one registered communication device in the TCP communication session is a service end, and the other registered communication device in the TCP communication session is a client. In this case, it can be considered that the registered communication device initiates the TCP communication session to the registered communication device. For the registered communication device as the service end, the session direction of the TCP communication session is the first session direction, and for the registered communication device as the client, the session direction of the TCP communication session is the second session direction. Therefore, the session direction of the TCP communication session for the two registered communication devices is the first session direction and the second session direction.

[0045] In some examples, the service port set includes IP addresses and ports of the communication devices that are not registered and are the server of the communication, i.e., the service port set records IP addresses and ports of the communication devices that are not protected by the firewall device and are the server of the communication. If the service port set includes a set of IP addresses and ports in the first data packet, and the registered IP address set does not include IP addresses in the set of IP addresses and ports, it is determined that the session direction of the registered communication device in the TCP communication session includes the second session direction. The service port set includes a set of IP addresses and ports in the first data packet can be implemented as the service port set includes the source IP address and the source port in the first data packet or the service port set includes the destination IP address and the destination port in the first data packet. The service port set includes a set of IP addresses and ports in the first data packet, and the registered IP address set does not include IP addresses in the set of IP addresses and ports, indicates that the communication device that is not registered in the TCP communication session is the server, and the communication device that is registered in the TCP communication session is the client, in which case it can be considered that the communication device that is registered initiates the TCP communication session to the communication device that is not registered, i.e., the session direction of the TCP communication session in which the communication device that is registered is the client is the second session direction. If the service port set does not include any set of IP addresses and ports in the first data packet, and the registered IP address set includes IP addresses in a set of IP addresses and ports in the first data packet, it is determined that the session direction of the registered communication device in the TCP communication session includes the first session direction. The service port set does not include any set of IP addresses and ports in the first data packet, i.e., the service port set neither includes the source IP address and the source port in the first data packet nor includes the destination IP address and the destination port in the first data packet. The service port set does not include any set of IP addresses and ports in the first data packet, and the registered IP address set includes IP addresses in a set of IP addresses and ports in the first data packet, indicates that the communication device that is registered in the TCP communication session is the server, and the communication device that is not registered in the TCP communication session is the client, in which case it can be considered that the communication device that is not registered initiates the TCP communication session to the communication device that is registered, i.e., the session direction of the TCP communication session in which the communication device that is registered is the server is the first session direction. If the service port set does not include any set of IP addresses and ports in the first data packet, and the registered IP address set includes IP addresses in two sets of IP addresses and ports in the first data packet, it is determined that the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction. The service port set does not include any set of IP addresses and ports in the first data packet, i.e., the service port set neither includes the source IP address and the source port in the first data packet nor includes the destination IP address and the destination port in the first data packet.The service port set does not include any one of the IP address and port in the first data packet, and the registered IP address set includes the IP address in the two groups of IP address and port in the first data packet, which indicates that the two communication devices involved in the TCP communication session are both registered communication devices, one registered communication device in the TCP communication session is a server, and the other registered communication device in the TCP communication session is a client. In this case, it can be considered that the registered communication device initiates the TCP communication session to the registered communication device. The session direction of the TCP communication session is the first session direction for the registered communication device as the server, and the session direction of the TCP communication session is the second session direction for the registered communication device as the client. Therefore, the session direction of the TCP communication session for the two registered communication devices is the first session direction and the second session direction.

[0046] In the case that the session direction of the registered communication device in the TCP communication session includes the first session direction, the first ACL is determined as the target ACL. In the case that the session direction of the registered communication device in the TCP communication session includes the second session direction, the second ACL is determined as the target ACL. In the case that the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction, the first ACL and the second ACL are determined as the target ACL.

[0047] In some embodiments, the two communication devices need to perform a three-way handshake first to establish a TCP communication session. During the establishment of the TCP communication session, the firewall device can still detect the data packets transmitted during the establishment of the TCP communication session to realize session access control. The session access control during the establishment of the TCP communication session will be described below by taking the cases that the service port set includes the IP address and port of the registered communication device as the server and the service port set includes the IP address and port of the unregistered communication device as the server.

[0048] FIG. 4 is a flowchart of a session access control method provided by another embodiment of the present application. FIG. 4 shows the session access control method in the case that the service port set includes the IP address and port of the registered communication device as the server. FIG. 4 is different from FIG. 3 in that the session access control method shown in FIG. 4 can further include steps S204 to S209.

[0049] In step S204, the third data packet is received.

[0050] The third data packet is a data packet transmitted in the first handshake process of establishing the TCP communication session. The third data packet has a request identifier by which the data packet can be identified as the third data packet. The third data packet can also be referred to as a synchronize packet, abbreviated as a SYN data packet. The request identifier can include a SYN identifier. The third data packet includes a source IP address and a source port as well as a destination IP address and a destination port. Since the third data packet is a data packet transmitted in the first handshake process of establishing the TCP communication session, the sender communication device of the third data packet is a client of the TCP communication session, and the receiver communication device of the third data packet is a server of the TCP communication session. Correspondingly, the source IP and the source port in the third data packet are the IP address and the port of the client of the TCP communication session, and the destination IP address and the destination port in the third data packet are the IP address and the port of the server of the TCP communication session.

[0051] In step S205, if the registered IP address set includes the destination IP address in the third data packet, the access control operation is performed according to the first ACL.

[0052] The registered IP address set includes the destination IP address in the third data packet, indicating that the registered communication device is the server of the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the first session direction, and the access control operation is performed according to the first ACL corresponding to the first session direction.

[0053] In step S206, if the registered IP address set includes the source IP address in the second data packet, the access control operation is performed according to the second ACL.

[0054] The registered IP address set includes the source IP address in the third data packet, indicating that the registered communication device is the client of the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the second session direction, and the access control operation is performed according to the second ACL corresponding to the second session direction.

[0055] It should be noted that if the registered IP address set includes the source IP address and the destination IP address in the second data packet, it indicates that one of the registered communication devices in the TCP communication session is a server, and the other registered communication device is a client, the session direction of the one registered communication device in the TCP communication session is the first session direction, and the session direction of the other registered communication device is the second session direction, that is, the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction, and the access control operation is performed according to the first ACL and the second ACL.

[0056] The third data packet and the registered IP address set can be used to determine the session direction of the TCP communication session, and then the access control operation is performed, thereby ensuring the security of the session access control during the establishment of the TCP communication session.

[0057] In step S207, the second data packet is received.

[0058] The second data packet is a data packet transmitted in the second handshake during the establishment of the TCP communication session. The second data packet has a request and confirmation identifier, by which the data packet can be identified as the second data packet. The second data packet can also be referred to as a SYN / ACK data packet or a SYN+ACK data packet. The request and confirmation identifier can include a SYN / ACK identifier. The second data packet includes a source IP address and a source port, and a destination IP address and a destination port. Since the second data packet is a data packet transmitted in the second handshake during the establishment of the TCP communication session, the sender communication device of the second data packet is the server of the TCP communication session, and the receiver communication device of the second data packet is the client of the TCP communication session. Correspondingly, the source IP and the source port in the second data packet are the IP address and the port of the server of the TCP communication session, and the destination IP address and the destination port in the second data packet are the IP address and the port of the client of the TCP communication session.

[0059] In step S208, if the registered IP address set includes the source IP address in the second data packet, the source IP address and the source port in the second data packet are written into the server port set, and the access control operation is performed according to the first ACL.

[0060] The registered IP address set includes the source IP address in the second data packet, which means that the communication device corresponding to the source IP address in the second data packet is a registered communication device, and the registered communication device is the server in the TCP communication session. Therefore, the source IP address and the source port in the second data packet are written into the server port set, so that the IP address and the port of all registered communication devices serving as servers are recorded in the server port set, so as to determine the session direction of the TCP communication session to which the subsequent first data packet belongs after the TCP communication session is established. The registered communication device is the server in the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the first session direction, and the access control operation is performed according to the first ACL corresponding to the first session direction.

[0061] In step S209, if the registered IP address set includes the destination IP address in the second data packet, the access control operation is performed according to the second ACL.

[0062] The registered IP address set includes the destination IP address in the second data packet, indicating that the communication device corresponding to the destination IP address in the second data packet is a registered communication device, and the registered communication device is a client in the TCP communication session, and the source IP address and the source port in the second data packet do not need to be written into the service port set. The registered communication device acts as a client in the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the second session direction, and the access control operation is performed according to the second ACL corresponding to the second session direction.

[0063] In some examples, if the registered IP address set includes the destination IP address in the second data packet but does not include the source IP address, and the service port set includes the destination IP address and the destination port in the second data packet, the destination IP address and the destination port in the second data packet are deleted from the service port set. The registered IP address set includes the destination IP address in the second data packet but does not include the source IP address, indicating that the registered communication device is a client in the TCP communication session. If the service port set includes the destination IP address and the destination port in the second data packet at this time, it may be that the registered communication device is a server in a previously established TCP communication session. In order to avoid the influence of the previously established TCP communication session on the current TCP communication session, the destination IP address and the destination port in the second data packet are deleted from the service port set, so as to avoid the registered communication device being considered as a server in the current TCP communication session.

[0064] It should be noted that if the registered IP address set includes the source IP address and the destination IP address in the second data packet, it indicates that one registered communication device acts as a server and another registered communication device acts as a client in the TCP communication session, the session direction of the one registered communication device in the TCP communication session is the first session direction, and the session direction of the other registered communication device is the second session direction, that is, the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction, and the access control operation is performed according to the first ACL and the second ACL.

[0065] In the process of establishing the second handshake of the TCP communication session, the service port set can be dynamically updated, so as to accurately judge the session direction of the TCP communication session to which the first data packet transmitted belongs, select the correct ACL, and improve the security of session access control.

[0066] FIG. 5 is a flowchart of a session access control method provided by another embodiment of the present application. FIG. 5 shows the session access control method when the service port set includes the IP address and the port of a communication device that is not registered and acts as a server. FIG. 5 is different from FIG. 3 in that the session access control method shown in FIG. 4 can further include steps S210 to S216.

[0067] In step S210, the third data packet is received.

[0068] In step S211, if the registered IP address set includes the destination IP address in the third data packet, the access control operation is performed according to the first ACL.

[0069] In step S212, if the registered IP address set includes the source IP address in the second data packet, the access control operation is performed according to the second ACL.

[0070] In step S213, the second data packet is received.

[0071] The second data packet has a request and an acknowledgement identity. The second data packet includes a source IP address and a source port, and a destination IP address and a destination port.

[0072] The specific contents of steps S210 to S213 are basically the same as those of steps S204 to S207 in the above embodiment, and the related description in the above can be referred to, and will not be repeated here.

[0073] In step S214, if the registered IP address set includes the destination IP address in the second data packet but does not include the source IP address, the source IP address and the source port in the second data packet are written into the service port set, and the access control operation is performed according to the second ACL.

[0074] The registered IP address set includes the destination IP address in the second data packet but does not include the source IP address, indicating that the communication device corresponding to the destination IP address in the second data packet is a registered communication device, and the communication device corresponding to the source IP address in the second data packet is an unregistered communication device, and the registered communication device is a client in the TCP communication session, and the unregistered communication device is a service end in the TCP communication session, so the source IP address and the source port in the second data packet are written into the service port set, to ensure that the IP address and the port of all unregistered communication devices serving as service ends are recorded in the service port set, so that the service port set is used to determine the session direction of the TCP communication session to which the first data packet belongs after the TCP communication session is established. The registered communication device serves as a client in the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the second session direction, and the access control operation is performed according to the second ACL corresponding to the second session direction.

[0075] In step S215, if the registered IP address set includes the source IP address in the second data packet but does not include the destination IP address, the access control operation is performed according to the first ACL.

[0076] The registered IP address set includes the source IP address in the second data packet but does not include the destination IP address, indicating that the communication device corresponding to the source IP address in the second data packet is a registered communication device, and the communication device corresponding to the destination IP address in the second data packet is an unregistered communication device. The registered communication device is a server in the TCP communication session, and the unregistered communication device is a client in the TCP communication session. Therefore, the destination IP address and the destination port in the second data packet do not need to be written into the server port set. The registered communication device is a server in the TCP communication session, and the session direction of the registered communication device in the TCP communication session includes the first session direction. The access control operation is performed according to the first ACL corresponding to the first session direction.

[0077] In some examples, if the registered IP address set includes the source IP address in the second data packet but does not include the destination IP address, and the server port set includes the destination IP address and the destination port in the second data packet, the destination IP address and the destination port in the second data packet are deleted from the server port set. The registered IP address set includes the source IP address in the second data packet but does not include the destination IP address, indicating that the unregistered communication device is a client in the TCP communication session. If the server port set includes the destination IP address and the destination port in the second data packet at this time, it is possible that the unregistered communication device is a server in a previously established TCP communication session. In order to avoid the influence of the previously established TCP communication session on the current TCP communication session, the destination IP address and the destination port in the second data packet are deleted from the server port set, so as to avoid the registered communication device being considered as a server in the current TCP communication session.

[0078] In step S216, if the registered IP address set includes the source IP address and the destination IP address in the second data packet, the access control operation is performed according to the first ACL and the second ACL.

[0079] The registered IP address set includes the source IP address and the destination IP address in the second data packet, indicating that one registered communication device in the TCP communication session is a server, and another registered communication device is a client. The session direction of the one registered communication device in the TCP communication session is the first session direction, and the session direction of the another registered communication device is the second session direction. That is, the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction. The access control operation is performed according to the first ACL and the second ACL.

[0080] In the process of establishing the second handshake of the TCP communication session, the server port set can be dynamically updated, so as to accurately judge the session direction of the TCP communication session to which the first data packet transmitted belongs, select the correct ACL, and improve the security of session access control.

[0081] In the above embodiments, in the case that the ACL includes the forbidden access rules, if the second data packet matches any of the forbidden access rules, the TCP communication session to which the second data packet belongs is blocked; in the case that the ACL includes the allowed access rules, if the second data packet does not match any of the allowed access rules, the TCP communication session to which the second data packet belongs is blocked. In the case that the ACL includes the forbidden access rules, if the third data packet matches any of the forbidden access rules, the TCP communication session to which the third data packet belongs is blocked; in the case that the ACL includes the allowed access rules, if the third data packet does not match any of the allowed access rules, the TCP communication session to which the third data packet belongs is blocked. The specific content can be referred to the above description of blocking the TCP communication session to which the first data packet belongs, and will not be repeated here.

[0082] It should be noted that the session direction of the communication device registered in the TCP communication session mentioned in the embodiments of the present application can specifically include the session direction of the port of the communication device registered in the TCP communication session.

[0083] In some embodiments, it can occur that a port of a communication device simultaneously acts as a client and a server, i.e., the session direction of the registered communication device simultaneously includes the first session direction and the second session direction, in which case, a predetermined access control policy can be executed. The predetermined access control policy can include: performing the access control operation according to the first ACL; or performing the access control operation according to the second ACL; or performing the access control operation according to the first ACL and the second ACL. The predetermined access control policy can include performing the access control operation according to the first ACL, which means that the port of the communication device that simultaneously acts as a client and a server is forcibly marked as a server. The predetermined access control policy can include performing the access control operation according to the second ACL, which means that the port of the communication device that simultaneously acts as a client and a server is forcibly marked as a client. The predetermined access control policy can include performing the access control operation according to the first ACL and the second ACL, which means that the port of the communication device that simultaneously acts as a client and a server is forcibly marked as a client and a server. The forced marking behavior can be performed in advance, or can be performed when it is detected that a port of a communication device simultaneously acts as a client and a server, which is not limited herein. The predetermined access control policy can also be adjusted and updated according to the scene and demand.

[0084] The firewall in the embodiments of the present application can be implemented as a cloud firewall. FIG. 6 is a schematic diagram of an architecture of an example of a cloud firewall provided by the embodiments of the present application. As shown in FIG. 6, the cloud firewall 30 includes a firewall unit 31, a network traffic analysis (NTA) unit 32, a security management unit 33, a synchronization unit 34, and an ACL management unit 35. The security management unit 33 can have a blocking mode function and a ban management function, which can be triggered and executed by the inbound ACL management and the outbound ACL management in the ACL management unit 35 synchronized by the synchronization unit 34. The inbound direction is the first session direction in the above embodiments, and the outbound direction is the second session direction in the above embodiments. The cloud firewall 30 can communicate with the communication device 40 of the user, and the data traffic transmitted to the communication device 40 can be transmitted to the firewall unit 31 and the NTA unit 32 through the mirror traffic mode. The firewall unit 31 queries and manages the blocking instructions through the ban management function in the security management unit 33, and the security management unit 33 issues blocking instructions to the firewall unit 31 through the blocking mode function in the security management unit 33, so that the firewall unit 31 performs the blocking action. The NTA unit 32 can also provide blocking suggestions to the security management unit 33.

[0085] For ease of understanding, the session access control method in the above embodiments is exemplified below in three specific scenarios in which the set of service ports includes registration and the IP address and port of the communication device as the service end.

[0086] Scenario one: the IP address of the registered communication device of user A is Cloud_IP_A, and an egress IP address of a company where user A is located is OA_OUT_IP_A. The session access control of the registered communication device is expected to meet the following requirements: (1) all communication device ports can access the website service published by the 443 port and the 80 port of the IP address Cloud_IP_A of the registered communication device; (2) only the IP address OA_OUT_IP_A is allowed to access the 22 port of the IP address Cloud_IP_A for operation and maintenance operation, i.e., only the IP address OA_OUT_IP_A is allowed to access the 22 port of the IP address Cloud_IP_A; (3) the registered communication device corresponding to the IP address Cloud_IP_A needs unrestricted access to external services to call external application programming interface (API) API services and perform vulnerability audits. For the above requirements, the first ACL shown in Table Two below and the second ACL shown in Table Three below can be configured:

[0087] Table Two

[0088] Table Three

[0089] Wherein, ANY in IP address means any IP address, ANY in port means any port; No.1 corresponds to the above requirement (1), No.2 corresponds to the above requirement (2), and No.3 corresponds to the above requirement (3).

[0090] The access request of scenario one is that an IP address IP_B which does not belong to OA_OUT_IP_A attempts to access the 22 port of Cloud_IP_A. Correspondingly, the access control process of the TCP communication session can include steps a1 to a3.

[0091] In step a1, IP_B sends a SYN packet to the 22 port of Cloud_IP_A through a random port random_b. According to the SYN packet, the session direction can be directly determined as the first session direction. Therefore, when the firewall detects the SYN packet, in combination with the fact that Cloud_IP_A is the IP address of the registered communication device, the first ACL is queried to determine that the access request does not conform to any one of the allowed access rules in the first ACL, and the access request should be rejected, so that the blocking measure is executed.

[0092] If the blocking of step a1 fails due to other various reasons. In step a2, the session direction can be determined again, the corresponding ACL is searched, and the blocking measure is executed.

[0093] In step a2, the 22 port of Cloud_IP_A sends a SYN+ACK packet to a random port random_b of IP_B. After the firewall detects the packet, since Cloud_IP_A is the IP address of the registered communication device and acts as the server, Cloud_IP_A and the 22 port are registered as the service port and written into the service port set. After detecting the SYN+ACK packet, in combination with the fact that Cloud_IP_A is the IP address of the registered communication device, the first ACL is queried to determine that the access request does not conform to any one of the allowed access rules in the first ACL, and the access request should be rejected, so that the blocking measure is executed.

[0094] If the blocking of step a2 fails due to other various reasons. In step a3, the session direction can be determined again, the corresponding ACL is searched, and the blocking measure is executed.

[0095] In step a3, the TCP communication session has been established, the firewall detects each first data packet transmitted between the 22 port of Cloud_IP_A and a random port random_b of IP_B, the 22 port of Cloud_IP_A in the first data packet is in the service port set, and Cloud_IP_A is in the registered IP address set, determines that the session direction is the first session direction, queries the first ACL, determines that the access request does not conform to any one of the allowed access rules in the first ACL, the access request should be rejected, and thus the blocking measure is executed.

[0096] Scenario two: the first ACL and the second ACL configured in scenario two are the same as those in scenario one, except that the access request in scenario two is that Cloud_IP_A accesses the service of the 80 port of IP_C, and IP_C is an IP address of an unregistered communication device. Correspondingly, the access control process of the TCP communication session can include steps b1 to b3.

[0097] In step b1, Cloud_IP_A sends a SYN data packet to the 80 port of IP_C through a random port random_a, and the session direction is directly determined to be the second session direction according to the SYN data packet. Therefore, when the firewall detects the SYN data packet, the second ACL is queried in combination with the fact that Cloud_IP_A is an IP address of a registered communication device, it is determined that the access request conforms to the allowed access rule in the second ACL, and the access request should be accepted, so that the access request is released.

[0098] In step b2, the 80 port of IP_C sends a SYN+ACK data packet to the random port random_a of Cloud_IP_A. The communication device corresponding to IP_C is the server of the TCP communication session, and the communication device corresponding to IP_C is an unregistered communication device, so the 80 port of IP_C is not written into the service port set. In addition, because the communication device corresponding to Cloud_IP_A is the client of the TCP communication session, it is determined that the session direction is the second session direction, the second ACL is queried, it is determined that the access request conforms to the allowed access rule in the second ACL, and the access request should be accepted, so that the access request is released.

[0099] In step b3, the TCP communication session has been established, the firewall detects each first data packet transmitted between the 80 port of IP_C and the random port random_a of Cloud_IP_A, the random port random_a of Cloud_IP_A and the 80 port of IP_C in the first data packet are not in the service port set, determines that the session direction is the second direction, queries the second ACL, determines that the access request accords with the allowed access rule in the second ACL, the access request should be accepted, thereby releasing the access request.

[0100] Scenario three: the IP address of the registered communication device of user A is Cloud_IP_A, the IP address of the registered communication device of user B is Cloud_IP_B, the session access control of the two registered communication devices hopes to meet the following requirements: (1) Cloud_IP_B opens the Web service of the 80 port to the outside; (2) Cloud_IP_A releases the service of the 80 port of Cloud_IP_B accessed by itself; (3) but Cloud_IP_B prohibits the access of Cloud_IP_A to the 80 port of Cloud_IP_B. For the above requirements, the first ACL shown in Table Four and the second ACL shown in Table Five can be configured as follows:

[0101] Table Four

[0102] Table Five

[0103] Among them, ANY in the IP address means any IP address, and ANY in the port means any port; the serial number 1 corresponds to the above requirement (1), the serial number 2 corresponds to the above requirement (2), and the serial number 3 corresponds to the above requirement (3).

[0104] The access request of scenario three is that Cloud_IP_A accesses the 80 port of Cloud_IP_B through a random port random_a. Correspondingly, the access control process of the TCP communication session can include steps c1 to c3.

[0105] In step c1, Cloud_IP_A will send a SYN data packet to Cloud_IP_B:80 through a random port random_a, determine that the session direction is Cloud_IP_A to Cloud_IP_B according to the SYN data packet, the communication device corresponding to Cloud_IP_A and the communication device corresponding to Cloud_IP_B are both registered communication devices, so the session direction includes the first session direction and the second session direction, query the first ACL and the second ACL, determine that the access request accords with the prohibited access rule in the first ACL and the second ACL, the access request should be rejected, thereby executing the blocking measure.

[0106] If the blocking in step c1 fails due to other various reasons. The session direction can be determined again in step c2, and the corresponding ACL is found to perform the blocking measure.

[0107] In step c2, the 80 port of Cloud_IP_B sends a SYN+ACK packet to the random port random_a of Cloud_IP_A, and the session direction is determined to be from Cloud_IP_A to Cloud_IP_B according to the SYN+ACK packet. Cloud_IP_B is the server in the TCP communication session, and the 80 port of Cloud_IP_B is written into the server port set. The communication device corresponding to Cloud_IP_A and the communication device corresponding to Cloud_IP_B are both registered communication devices, so the session direction includes the first session direction and the second session direction. The first ACL and the second ACL are queried, it is determined that the access request meets the prohibited access rule in the first ACL and the second ACL, the access request should be rejected, and thus the blocking measure is performed.

[0108] If the blocking in step c2 fails due to other various reasons. The session direction can be determined again in step c3, and the corresponding ACL is found to perform the blocking measure.

[0109] In step c3, the TCP communication session has been established, and the firewall detects each first packet transmitted between the 80 port of Cloud_IP_B and the random port random_a of Cloud_IP_A. The 80 port of Cloud_IP_B in the first packet is in the server port set, and the communication device corresponding to Cloud_IP_A and the communication device corresponding to Cloud_IP_B are both registered communication devices, so the session direction includes the first session direction and the second session direction. The first ACL and the second ACL are queried, it is determined that the access request meets the prohibited access rule in the first ACL and the second ACL, the access request should be rejected, and thus the blocking measure is performed.

[0110] Through the above scenario example, it can be obtained that by using the session access control method provided in the embodiments of the present application, the access control rules meeting various scenarios can be configured, such as the configuration of the access control rules of the scenario that the communication device of IP address A1 can access the communication device of IP address A2, but the communication device of IP address A2 is not allowed to access the communication device of IP address A1, so that the access control of the firewall can meet the actual scenario demand, the applicability and accuracy of the session access control of the firewall are improved, and the security of the session access control is guaranteed.

[0111] The second aspect of the present application provides a session access control apparatus. FIG. 7 is a structural schematic diagram of the session access control apparatus according to an embodiment of the present application. As shown in FIG. 7, the session access control apparatus 500 can include a receiving module 501, an access control list (ACL) determining module 502, and an access control module 503.

[0112] The receiving module 501 can be configured to receive a first data packet.

[0113] The first data packet includes a data packet transmitted after a transmission control protocol (TCP) communication session is established.

[0114] The ACL determining module 502 can be configured to determine a first ACL and / or a second ACL as a target ACL based on an Internet protocol (IP) address and a port in the first data packet, a service port set, and a registered IP address set.

[0115] The service port set includes an IP address and a port of a communication device registered as a service end, or includes an IP address and a port of a communication device not registered as a service end. The service end is a receiver of the TCP communication session. The registered IP address set includes an IP address of a registered communication device. The first ACL corresponds to a first session direction of the registered communication device, and the second ACL corresponds to a second session direction of the registered communication device.

[0116] The access control module 503 can be configured to perform an access control operation according to the target ACL.

[0117] In some embodiments, the ACL determining module 502 can be specifically configured to determine a session direction of a registered communication device in the TCP communication session according to whether the service port set includes the IP address and the port in the first data packet, and whether the registered IP address set includes the IP address in the first data packet; and determine the first ACL and / or the second ACL as the target ACL according to the session direction of the registered communication device in the TCP communication session.

[0118] In some examples, the first packet includes two sets of IP addresses and ports, and the service port set includes IP addresses and ports of the communication device that are registered and are the service end. The access control list determination module 502 can be specifically configured to: if the service port set includes one set of IP addresses and ports in the first packet, and the registered IP address set includes the IP address in the one set of IP addresses and ports, determine that the session direction of the registered communication device in the TCP communication session includes the first session direction; if the service port set does not include any one set of IP addresses and ports in the first packet, and the registered IP address set includes the IP address in the one set of IP addresses and ports in the first packet, determine that the session direction of the registered communication device in the TCP communication session includes the second session direction; and if the service port set includes one set of IP addresses and ports in the first packet, and the registered IP address set includes the IP addresses in the two sets of IP addresses and ports in the first packet, determine that the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction.

[0119] In some examples, the first packet includes two sets of IP addresses and ports, and the service port set includes IP addresses and ports of the communication device that are not registered and are the service end. The access control list determination module 502 can be specifically configured to: if the service port set includes one set of IP addresses and ports in the first packet, and the registered IP address set does not include the IP address in the one set of IP addresses and ports, determine that the session direction of the registered communication device in the TCP communication session includes the second session direction; if the service port set does not include any one set of IP addresses and ports in the first packet, and the registered IP address set includes the IP address in the one set of IP addresses and ports in the first packet, determine that the session direction of the registered communication device in the TCP communication session includes the first session direction; and if the service port set does not include any one set of IP addresses and ports in the first packet, and the registered IP address set includes the IP addresses in the two sets of IP addresses and ports in the first packet, determine that the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction.

[0120] In some examples, the access control list determination module 502 can be specifically configured to: in a case where the session direction of the registered communication device in the TCP communication session includes the first session direction, determine the first ACL as the target ACL; in a case where the session direction of the registered communication device in the TCP communication session includes the second session direction, determine the second ACL as the target ACL; and in a case where the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction, determine the first ACL and the second ACL as the target ACL.

[0121] In some embodiments, the set of service ports includes IP addresses and ports of the communication device that are registered and are the service end.

[0122] The receiving module 501 can also be configured to receive a second data packet before receiving the first data packet, the second data packet having a request and acknowledgement identity, the second data packet including a source IP address and a source port and a destination IP address and a destination port.

[0123] The access control module 503 can also be configured to, if the set of registered IP addresses includes the source IP address in the second data packet, write the source IP address and the source port in the second data packet into the set of service ports, perform the access control operation according to the first ACL; and if the set of registered IP addresses includes the destination IP address in the second data packet, perform the access control operation according to the second ACL.

[0124] In some examples, the access control module 503 can also be configured to, if the set of registered IP addresses includes the destination IP address but not the source IP address in the second data packet, and the set of service ports includes the destination IP address and the destination port in the second data packet, delete the destination IP address and the destination port in the second data packet from the set of service ports.

[0125] In some embodiments, the set of service ports includes IP addresses and ports of the communication device that are unregistered and are the service end.

[0126] The receiving module 501 can also be configured to receive a second data packet before receiving the first data packet, the second data packet having a request and acknowledgement identity, the second data packet including a source IP address and a source port and a destination IP address and a destination port.

[0127] The access control table determination module 502 can also be configured to, if the set of registered IP addresses includes the destination IP address but not the source IP address in the second data packet, write the source IP address and the source port in the second data packet into the set of service ports, perform the access control operation according to the second ACL; if the set of registered IP addresses includes the source IP address but not the destination IP address in the second data packet, perform the access control operation according to the first ACL; and if the set of registered IP addresses includes the source IP address and the destination IP address in the second data packet, perform the access control operation according to the first ACL and the second ACL.

[0128] In some examples, the access control table determination module 502 can also be configured to, if the set of registered IP addresses includes the source IP address but not the destination IP address in the second data packet, and the set of service ports includes the destination IP address and the destination port in the second data packet, delete the destination IP address and the destination port in the second data packet from the set of service ports.

[0129] In some embodiments, the receiving module 501 can also be configured to receive a third data packet before receiving the first data packet, the third data packet having a request identifier, the third data packet including a source IP address and a source port and a destination IP address and a destination port.

[0130] The access control list determining module 502 can also be configured to perform an access control operation according to the first ACL if the set of registered IP addresses includes the destination IP address in the third data packet, and perform an access control operation according to the second ACL if the set of registered IP addresses includes the source IP address in the second data packet.

[0131] In some embodiments, the access control list determining module 502 can also be configured to perform a predetermined access control policy when a session direction of one registered communication device includes both the first session direction and the second session direction.

[0132] The predetermined access control policy includes performing an access control operation according to the first ACL, or performing an access control operation according to the second ACL, or performing an access control operation according to both the first ACL and the second ACL.

[0133] In some embodiments, the ACL includes the first ACL and / or the second ACL. The access control list determining module 502 can also be configured to, when the ACL includes access prohibition rules, block a TCP communication session to which a data packet belongs if the data packet matches any of the access prohibition rules, and when the ACL includes access permission rules, block a TCP communication session to which a data packet belongs if the data packet does not match any of the access permission rules. The data packet includes at least one of the first data packet, the second data packet, and the third data packet.

[0134] It should be noted that the session access control apparatus 500 is an apparatus corresponding to the above-mentioned session access control method, and all implementation manners in the above-mentioned method embodiments are applicable to the embodiments of the apparatus, and the same technical effects can be achieved.

[0135] The third aspect of the present application further provides a firewall device. FIG. 8 is a structural schematic diagram of a firewall device according to an embodiment of the present application. As shown in FIG. 8, the firewall device 600 includes a memory 601, a processor 602, and a computer program stored in the memory 601 and executable on the processor 602.

[0136] In some examples, the processor 602 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement one or more embodiments of the present application.

[0137] The memory 601 can include a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage medium (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the session access control method according to the embodiments of the present application.

[0138] The processor 602 runs a computer program corresponding to the executable program code stored in the memory 601 by reading the executable program code, for implementing the session access control method in the above-described embodiments.

[0139] In some examples, the firewall device 600 can further include a communication interface 603 and a bus 604. As shown in FIG. 8, the memory 601, the processor 602, and the communication interface 603 are connected through the bus 604 and complete communication among each other.

[0140] The communication interface 603 is mainly used to implement communication between various modules, devices, units, and / or apparatuses in the embodiments of the present application. An input device and / or an output device can also be accessed through the communication interface 603.

[0141] Bus 604 includes a hardware, software, or both that couples components of firewall device 600 to each other. As an example and not by way of limitation, bus 604 can include an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front-side bus (FSB), a Hyper Transport (HT) interconnect, an industry standard architecture (ISA) bus, an InfiniBand™ interconnect, a low pin count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a serial advanced technology attachment (SATA) bus, a video electronics standards board (VESA) local bus (VLB), or another suitable bus or a combination of two or more of these. Where appropriate, bus 604 can include one or more buses. Although this application describes and shows a particular bus, this application contemplates any suitable bus or interconnect.

[0142] A computer readable storage medium storing computer program instructions is provided in the fourth aspect of the present application. The computer program instructions, when executed by a processor, can implement the session access control method in the above embodiments and achieve the same technical effects. To avoid repetition, details are not described herein. The computer readable storage medium can include a non-transitory computer readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, without limitation.

[0143] A computer program product is provided in the fifth aspect of the present application. The computer program product includes a computer program. When the computer program is executed by a processor, the session access control method in the above embodiments is implemented and the same technical effects are achieved. To avoid repetition, details are not described herein.

[0144] It should be clarified that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. For the device embodiments, equipment embodiments, computer-readable storage medium embodiments, and computer program product embodiments, the relevant parts can be referred to the description section of the method embodiments. This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0145] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0146] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for session access control, comprising: receiving a first packet, the first packet comprising a packet transmitted after a transmission control protocol (TCP) communication session is established; determining a first access control list (ACL) and / or a second ACL as a target ACL based on a network protocol (IP) address and a port in the first packet, a service port set and a registered IP address set, the service port set comprising IP addresses and ports of communication devices registered as service end, or comprising IP addresses and ports of communication devices not registered as service end, the service end being a receiver of the TCP communication session, the registered IP address set comprising IP addresses of registered communication devices, the first ACL corresponding to a first session direction of the registered communication devices, and the second ACL corresponding to a second session direction of the registered communication devices; performing an access control operation according to the target ACL.

2. The method of claim 1, wherein, The determining the first ACL and / or the second ACL as the target ACL based on the IP address and the port in the first packet, the service port set and the registered IP address set comprises: determining a session direction of a registered communication device in the TCP communication session according to whether the service port set comprises the IP address and the port in the first packet, and whether the registered IP address set comprises the IP address in the first packet; determining the first ACL and / or the second ACL as the target ACL according to the session direction of the registered communication device in the TCP communication session.

3. The method of claim 2, wherein, The first packet comprises two sets of IP addresses and ports, and the service port set comprises IP addresses and ports of communication devices registered as service end. The determining the session direction of the registered communication device in the TCP communication session according to whether the service port set comprises the IP address and the port in the first packet, and whether the registered IP address set comprises the IP address in the first packet comprises: if the service port set comprises one set of IP addresses and ports in the first packet, and the registered IP address set comprises an IP address in the one set of IP addresses and ports, determining that the session direction of the registered communication device in the TCP communication session comprises the first session direction; if the service port set does not comprise any set of IP addresses and ports in the first packet, and the registered IP address set comprises an IP address in one set of IP addresses and ports in the first packet, determining that the session direction of the registered communication device in the TCP communication session comprises the second session direction; if the service port set comprises one set of IP addresses and ports in the first packet, and the registered IP address set comprises IP addresses in both sets of IP addresses and ports in the first packet, determining that the session direction of the registered communication device in the TCP communication session comprises the first session direction and the second session direction.

4. The method of claim 2, wherein, The first data packet includes two sets of IP addresses and ports, and the service port set includes IP addresses and ports of the communication device which is not registered and acts as a service end; The determining of the session direction of the registered communication device in the TCP communication session according to whether the service port set includes the IP addresses and ports in the first data packet and whether the registered IP address set includes the IP addresses in the first data packet includes: If the service port set includes one set of IP addresses and ports in the first data packet and the registered IP address set does not include the IP addresses in the one set of IP addresses and ports, the determining of the session direction of the registered communication device in the TCP communication session includes the second session direction; If the service port set does not include any set of IP addresses and ports in the first data packet and the registered IP address set includes the IP addresses in one set of IP addresses and ports in the first data packet, the determining of the session direction of the registered communication device in the TCP communication session includes the first session direction; If the service port set does not include any set of IP addresses and ports in the first data packet and the registered IP address set includes the IP addresses in two sets of IP addresses and ports in the first data packet, the determining of the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction.

5. The method of claim 2, wherein, The determining of the target ACL according to the session direction of the registered communication device in the TCP communication session includes: If the session direction of the registered communication device in the TCP communication session includes the first session direction, the first ACL is determined as the target ACL; If the session direction of the registered communication device in the TCP communication session includes the second session direction, the second ACL is determined as the target ACL; If the session direction of the registered communication device in the TCP communication session includes the first session direction and the second session direction, the first ACL and the second ACL are determined as the target ACL.

6. The method of claim 1, wherein, The service port set includes IP addresses and ports of the communication device which is registered and acts as a service end; Before the receiving of the first data packet, the method further includes: receiving a second data packet, the second data packet having a request and an acknowledgement identity, the second data packet including a source IP address and a source port and a destination IP address and a destination port; If the registered IP address set includes the source IP address in the second data packet, the source IP address and the source port in the second data packet are written into the service port set, and an access control operation is performed according to the first ACL; If the registered IP address set includes the destination IP address in the second data packet, an access control operation is performed according to the second ACL.

7. The method of claim 6, further comprising: if the registered IP address set includes the destination IP address in the second data packet but not the source IP address, and the service port set includes the destination IP address and the destination port in the second data packet, then the destination IP address and the destination port in the second data packet are deleted from the service port set.

8. The method of claim 1, wherein, the service port set includes an IP address and a port of a communication device that is not registered and serves as a service end; before the first data packet is received, further comprising: receiving a second data packet, the second data packet having a request and a confirmation identity, the second data packet including a source IP address and a source port and a destination IP address and a destination port; if the registered IP address set includes the destination IP address in the second data packet but not the source IP address, then the source IP address and the source port in the second data packet are written into the service port set, and an access control operation is performed according to the second ACL; if the registered IP address set includes the source IP address in the second data packet but not the destination IP address, then an access control operation is performed according to the first ACL; if the registered IP address set includes the source IP address and the destination IP address in the second data packet, then an access control operation is performed according to the first ACL and the second ACL.

9. The method of claim 8, further comprising: if the registered IP address set includes the source IP address in the second data packet but not the destination IP address, and the service port set includes the destination IP address and the destination port in the second data packet, then the destination IP address and the destination port in the second data packet are deleted from the service port set.

10. The method of claim 1, before the first data packet is received, further comprising: receiving a third data packet, the third data packet having a request identity, the third data packet including a source IP address and a source port and a destination IP address and a destination port; if the registered IP address set includes the destination IP address in the third data packet, then an access control operation is performed according to the first ACL; if the registered IP address set includes the source IP address in the second data packet, then an access control operation is performed according to the second ACL.

11. The method of claim 1, further comprising: in a case where a session direction of a registered communication device simultaneously includes the first session direction and the second session direction, performing a predetermined access control policy; wherein the predetermined access control policy includes: performing an access control operation according to the first ACL; or performing an access control operation according to the second ACL; or performing an access control operation according to the first ACL and the second ACL.

12. The method of any one of claims 1 to 11, wherein, the ACL includes the first ACL and / or the second ACL, performing an access control operation according to the ACL includes: in a case where the ACL includes an access prohibition rule, if a data packet meets any one of the access prohibition rules, then a TCP communication session to which the data packet belongs is blocked; If the data packet does not conform to any of the access-allowed rules, the TCP communication session to which the data packet belongs is blocked. The data packet includes at least one of the first data packet, a second data packet, and a third data packet. 13.A session access control apparatus, comprising: a receiving module configured to receive a first data packet, the first data packet including a data packet transmitted after a transmission control protocol (TCP) communication session is established; an access control list (ACL) determining module configured to determine a first ACL and / or a second ACL as a target ACL based on a network protocol (IP) address and a port in the first data packet, a service port set, and a registered IP address set, the service port set including an IP address and a port of a communication device registered as a service end, or including an IP address and a port of a communication device not registered as a service end, the service end being a receiver of the TCP communication session, the registered IP address set including an IP address of a registered communication device, the first ACL corresponding to a first session direction of the registered communication device, and the second ACL corresponding to a second session direction of the registered communication device; an access control module configured to perform an access control operation according to the target ACL.

14. A firewall device comprising: a processor and a memory storing computer program instructions; the processor implements the session access control method according to any one of claims 1 to 12 when executing the computer program instructions. 15.A computer readable storage medium, the computer readable storage medium storing computer program instructions, the computer program instructions being executed by a processor to implement the session access control method according to any one of claims 1 to 12. 16.A computer program product, comprising a computer program, the computer program being executed by a processor to implement the session access control method according to any one of claims 1 to 12.

Images