Data processing method and apparatus for network application firewall server

Abstract

Provided in the embodiments of the present application are a data processing method and apparatus for a network application firewall server. The network application firewall server is provided with a buffer area. The method comprises: in the buffer area, storing a network protocol address which corresponds to a domain name accessing the network application firewall server, the network protocol address comprising corresponding server information; receiving a target request sent by a client, the target request comprising a target domain name; querying from the buffer area a target network protocol address corresponding to the target domain name; and forwarding the target request to a target server corresponding to the target network protocol address. In the embodiments of the present application, by means of an asynchronous mode, network protocol addresses corresponding to domain names that may need to be accessed are parsed in advance, such that no query needs to be initiated to a domain name system server again during subsequent access, thereby effectively reducing unnecessary delays caused by domain name parsing during back-to-origin processes of network application firewalls, and significantly improving the back-to-origin efficiency of network application firewalls.

Description

Data processing method and device for network application firewall server

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411705452.X, filed on November 26, 2024, entitled “Data Processing Method and Apparatus for Network Application Firewall Server”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of computer technology, and in particular to a data processing method and apparatus for a network application firewall server, an electronic device, and a storage medium. Background Technology

[0004] Most WAFs (Web Application Firewalls) on the market currently support both IP (Internet Protocol) origin pull and domain name origin pull configurations. When a user chooses domain name origin pull, the WAF first calls the DNS (Domain Name System) resolution service to query the target IP address corresponding to the target domain name, and then uses that IP address to perform the origin pull operation. Upon receiving the DNS query request, the DNS recursive resolver first checks its cache. If the IP address corresponding to the target domain name exists in the cache, it directly uses that IP address for the origin pull; otherwise, it sends a request to the root name server to query the target IP address corresponding to the target domain name.

[0005] With the increasing prevalence of cybersecurity threats, the efficiency and accuracy of WAF origin lookups have become paramount. Related DNS resolution methods may encounter performance bottlenecks and inaccuracies when faced with short TTLs (Time to Live) or frequently changing domain name resolutions. Furthermore, when the DNS cache expires, a new DNS query is typically required, which can lead to latency and increased system load, especially with short TTL settings. In such cases, the WAF's origin lookup efficiency significantly decreases, thus limiting the WAF's QPS (Queries Per Second). Summary of the Invention

[0006] This application provides a data processing method for a network application firewall server to solve or at least partially solve the above-mentioned problems.

[0007] Accordingly, embodiments of this application also provide a data processing device for a network application firewall server, an electronic device, and a storage medium to ensure the implementation and application of the above methods.

[0008] To address the aforementioned problems, this application discloses a data processing method for a network application firewall server. The network application firewall server is equipped with a cache and communicates with a client. The method includes:

[0009] The cache stores the network protocol addresses corresponding to the domain names of the access network application firewall servers; the network protocol addresses include the corresponding server information.

[0010] Receive the target request sent by the client, which includes the target domain name;

[0011] Retrieve the target network protocol address corresponding to the target domain name from the cache;

[0012] Forward the target request to the target server corresponding to the target network protocol address.

[0013] In some embodiments of this application, the network application firewall communicates with the management platform, and stores the network protocol address corresponding to the domain name accessing the network application firewall server in the cache, including:

[0014] Receive the domain name of the access network application firewall server sent by the management platform;

[0015] Load the configuration file for the domain name of the access network application firewall server;

[0016] Based on the configuration file, query the network protocol address corresponding to the domain name of the access network application firewall server to obtain the query results;

[0017] Store query results in the cache.

[0018] Network protocol addresses have corresponding validity periods, and the data processing methods of network application firewall servers also include:

[0019] When storing the network protocol address corresponding to the domain name of the access network application firewall server, record the validity period of the network protocol address;

[0020] Based on the refresh time threshold and the current remaining valid time, determine whether it is necessary to update the network protocol address corresponding to the domain name of the access network application firewall server;

[0021] If the remaining valid time reaches the refresh time threshold, then query the network protocol address corresponding to the domain name of the access network application firewall server again to obtain the refreshed network protocol address and the refreshed valid time.

[0022] Store the refreshed network protocol address and the refreshed validity period in the cache.

[0023] The data processing methods for network application firewall servers also include:

[0024] If a target request containing the target domain name is received when re-querying the network protocol address corresponding to the domain name of the access network application firewall server, then the current network protocol address corresponding to the target domain name is queried from the cache.

[0025] Forward the target request to the current server corresponding to the current network protocol address.

[0026] The data processing methods for network application firewall servers also include:

[0027] If forwarding the target request to the current server corresponding to the current network protocol address fails, wait for the cache to store the refreshed network protocol address;

[0028] Retrieve the refreshed network protocol address corresponding to the target domain name from the cache;

[0029] The target request is forwarded to the server corresponding to the refreshed network protocol address.

[0030] The data processing methods for network application firewall servers also include:

[0031] Get the number of accesses to the domain name of the access network application firewall server;

[0032] Based on the number of accesses, set the refresh time threshold for the network protocol address corresponding to the domain name accessing the network application firewall server.

[0033] In some embodiments of this application, the network application firewall includes a configuration synchronization component, which communicates with a management platform. The data processing method for the network application firewall server further includes:

[0034] By configuring the synchronization component, configuration update items issued by the management platform can be received;

[0035] Use the configuration update item to update the configuration corresponding to the configuration update item.

[0036] This application also discloses a data processing device for a network application firewall server. The network application firewall server is equipped with a cache area and is connected to a client for communication. The device includes:

[0037] The prefetch module is used to store the network protocol address corresponding to the domain name of the access network application firewall server in the cache; the network protocol address includes the corresponding server information;

[0038] The request receiving module is used to receive target requests sent by clients, including the target domain name;

[0039] The network protocol address acquisition module is used to query the target network protocol address corresponding to the target domain name from the cache.

[0040] The request forwarding module is used to forward the target request to the target server corresponding to the target network protocol address.

[0041] This application also discloses an electronic device, including: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a data processing method of one or more network application firewall servers as described in this application.

[0042] This application also discloses one or more machine-readable media storing executable code thereon, which, when executed, causes a processor to perform a data processing method of one or more network application firewall servers as described in this application.

[0043] Compared with the prior art, the embodiments of this application have the following advantages:

[0044] In this embodiment, the cache stores the network protocol address corresponding to the domain name accessing the network application firewall server; the network protocol address includes the corresponding server information; a target request sent by a client is received, the target request including the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache; and the target request is forwarded to the target server corresponding to the target network protocol address. This embodiment employs Domain Name System (DNS) prefetching technology, asynchronously resolving the network protocol address corresponding to a domain name that may need to be accessed in advance and storing it in the cache. This eliminates the need to query the DNS server again during subsequent accesses, effectively reducing unnecessary delays caused by domain name resolution during the origin retrieval process of the network application firewall and significantly improving the origin retrieval efficiency of the network application firewall. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 is a flowchart of the steps of an embodiment of a data processing method for a network application firewall server according to this application;

[0047] Figure 2 is a schematic diagram of a server according to an embodiment of a data processing method for a network application firewall server of this application;

[0048] Figure 3 is a flowchart of an embodiment of a data processing method for a network application firewall server according to this application;

[0049] Figure 4 is a structural block diagram of an embodiment of a data processing device for a network application firewall server according to this application;

[0050] Figure 5 is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0051] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] Referring to Figure 1, which is a flowchart of an embodiment of a data processing method for a network application firewall server according to this application, the method includes the following steps:

[0053] Step 101: Store the network protocol address corresponding to the domain name of the access network application firewall server in the cache area; the network protocol address includes the corresponding server information.

[0054] The network application firewall server in this embodiment of the application is equipped with a cache area for storing the network protocol address (i.e., IP address) corresponding to the queried domain name and communicating with the client used by the user.

[0055] In some embodiments of this application, the network application firewall server can be an OpenResty server (an OpenResty web platform based on Nginx and Lua). The OpenResty server supports origin pull methods such as domain name origin pull and / or IP address origin pull during origin pulls.

[0056] Referring to Figure 2, it is a schematic diagram of a server according to an embodiment of a data processing method for a network application firewall server of this application.

[0057] Figure 2 briefly illustrates the hardware structure when the network application firewall server is an OpenResty server. The hardware of an OpenResty server may include a processor, storage devices, input and output interfaces, communication interfaces, and a bus.

[0058] The processor can be a general-purpose CPU (Central Processing Unit) to execute relevant programs. Storage devices can be implemented using RAM (Random Access Memory), SSD (Solid State Drive), HDD (Hard Disk Drive), etc. Input and output interfaces are used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within the device or externally connected to provide corresponding functions. Input devices can include keyboards, mice, various sensors, etc., while output devices can include displays, speakers, indicator lights, etc. The communication interface is used to connect the communication module to enable communication and interaction between this device and other devices. The communication module can communicate via wired means (e.g., USB (Universal Serial Bus), network cable, etc.). The bus includes a pathway for transmitting information between the various components of the device (e.g., processor, storage devices, input / output interfaces, and communication interfaces).

[0059] Although Figure 2 only shows the processor, storage device, input / output interface, communication interface, and bus, in actual implementation, the OpenResty server may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the aforementioned OpenResty server may only include the components necessary for implementing the embodiments of this application, and not necessarily all components.

[0060] In step 101, for each domain name accessing the network application firewall server, its corresponding network protocol address is queried, thereby storing the network protocol address corresponding to the domain name accessing the network application firewall server in the cache. The network protocol address includes the server information corresponding to the network protocol address.

[0061] In step 101, the network protocol address corresponding to the domain name of the cache access network application firewall server is asynchronous with the network application firewall server request forwarding in subsequent steps. Therefore, the DNS query in step 101 will not block the network application firewall server request forwarding.

[0062] Step 102: Receive the target request sent by the client. The target request includes the target domain name.

[0063] The network application firewall (NFW) server receives target requests from clients, including the target domain name. The NFW server then needs to perform origin redirection for the target domain, forwarding the request to the server corresponding to the network protocol address associated with that domain.

[0064] Step 103: Query the target network protocol address corresponding to the target domain name from the cache.

[0065] After caching the network protocol address corresponding to the domain name accessing the network application firewall server, when performing a domain name origin lookup, there is no need to perform a DNS query again. It is only necessary to query the target network protocol address corresponding to the target domain name from the cache to obtain the target network protocol address corresponding to the target domain name, thus reducing the waiting time for DNS query.

[0066] Step 104: Forward the target request to the target server corresponding to the target network protocol address.

[0067] After obtaining the target network protocol address corresponding to the target domain name, a domain origin pull can be performed to forward the target request to the target server corresponding to the target network protocol address.

[0068] In this embodiment, the cache stores the network protocol address corresponding to the domain name accessing the network application firewall server; the network protocol address includes the corresponding server information; a target request sent by a client is received, the target request including the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache; and the target request is forwarded to the target server corresponding to the target network protocol address. This embodiment employs Domain Name System (DNS) prefetching technology, asynchronously resolving the network protocol address corresponding to a domain name that may need to be accessed in advance and storing it in the cache. This eliminates the need to query the DNS server again during subsequent accesses, effectively reducing unnecessary delays caused by domain name resolution during the origin retrieval process of the network application firewall and significantly improving the origin retrieval efficiency of the network application firewall.

[0069] In some embodiments of this application, the network application firewall communicates with the management platform. Step 101 includes:

[0070] Receive the domain name of the access network application firewall server sent by the management platform;

[0071] Load the configuration file for the domain name of the access network application firewall server;

[0072] Based on the configuration file, query the network protocol address corresponding to the domain name of the access network application firewall server to obtain the query results;

[0073] Store query results in the cache.

[0074] In some embodiments of this application, the network protocol address corresponding to the domain name accessing the network application firewall server is pre-queried and cached. This requires first receiving the domain name accessing the network application firewall server sent by the management platform. Users can add domain names to be protected on the management platform system, and the management platform can send the domain name to be protected as the domain name that needs to access the network application firewall server.

[0075] The network application firewall server loads the configuration files of the domain names accessing the network application firewall server upon startup. In some embodiments of this application, when the network application firewall server starts, the DNS prefetching module is asynchronously initialized in Lua (a scripting language) code using the ngx.timer.at function (a Lua API function provided by OpenResty for creating an asynchronous timer), thereby loading the configuration files of the accessed domain names.

[0076] According to the configuration file, for each domain name accessing the network application firewall server, its corresponding network protocol address is queried to obtain the query results, which can then be stored in the cache. In some embodiments of this application, a DNS prefetching module can be used to pre-query and cache the network protocol addresses corresponding to the domain names accessing the network application firewall server.

[0077] In some embodiments of this application, the query result may include the network protocol address corresponding to the domain name of the access network application firewall server, and the validity period corresponding to the network protocol address.

[0078] This application uses Domain Name System (DNS) prefetching technology to asynchronously resolve the network protocol address corresponding to the domain name that may be accessed in advance and store it in the cache. This eliminates the need to query the DNS server again during subsequent accesses, thereby effectively reducing unnecessary delays caused by domain name resolution during the origin return process of the network application firewall.

[0079] If the DNS system is attacked and goes offline, since the network protocol address corresponding to the domain name that may need to be accessed has been resolved in advance in this application embodiment, the target network protocol address corresponding to the target domain name can still be obtained from the cache when the DNS system is attacked and goes offline, so as to perform domain name return to the origin.

[0080] In some embodiments of this application, the network protocol address has a corresponding validity period, and the method further includes:

[0081] When storing the network protocol address corresponding to the domain name of the access network application firewall server, record the validity period of the network protocol address;

[0082] Based on the refresh time threshold and the current remaining valid time, determine whether it is necessary to update the network protocol address corresponding to the domain name of the access network application firewall server;

[0083] If the remaining valid time reaches the refresh time threshold, then query the network protocol address corresponding to the domain name of the access network application firewall server again to obtain the refreshed network protocol address and the refreshed valid time.

[0084] Store the refreshed network protocol address and the refreshed validity period in the cache.

[0085] In some embodiments of this application, the cached network protocol address can be updated periodically according to the validity period of the network protocol address, so that when performing domain name origin retrieval next time, there is no need to wait to re-query the network protocol address corresponding to the domain name.

[0086] Specifically, when storing the network protocol address corresponding to the domain name accessing the network application firewall server, the time-to-live (TTL) value of the network protocol address is recorded. Based on the refresh time threshold and the current remaining TTL, it is determined whether the network protocol address corresponding to the domain name accessing the network application firewall server needs to be updated. If the remaining TTL reaches the refresh time threshold, the network protocol address corresponding to the domain name accessing the network application firewall server needs to be queried again to obtain the refreshed network protocol address and refreshed TTL, and then stored in the cache.

[0087] For example, if the TTL value of a network protocol address is 600 seconds, the refresh time threshold can be set to 590 seconds. When this network protocol address has been cached for 590 seconds (meaning it expires in 10 seconds), the network protocol address corresponding to the domain name accessing the network application firewall server needs to be updated. This requires re-executing the steps of querying and caching the network protocol address corresponding to the domain name accessing the network application firewall server. The TTL value of the updated network protocol address is reset to 600 seconds.

[0088] The embodiments of this application actively update the network protocol address and its validity period before the network protocol address is about to expire. Therefore, even when facing short TTL and frequently changing domain name resolution, it can maintain high stability and response speed.

[0089] In some embodiments of this application, the method further includes:

[0090] If a target request containing the target domain name is received when re-querying the network protocol address corresponding to the domain name of the access network application firewall server, then the current network protocol address corresponding to the target domain name is queried from the cache.

[0091] Forward the target request to the current server corresponding to the current network protocol address.

[0092] In this embodiment of the application, if a target request including the target domain name is received during the process of updating the network protocol address corresponding to the domain name of the access network application firewall server, that is, when re-querying the network protocol address corresponding to the domain name of the access network application firewall server, and a domain name back-to-origin request is required, then the network protocol address before the update is used for the back-to-origin request first.

[0093] Specifically, the current network protocol address corresponding to the target domain name can be queried from the cache, and the target request can be forwarded to the current server corresponding to the current network protocol address.

[0094] In this embodiment of the application, during the process of updating the network protocol address corresponding to the domain name of the access network application firewall server, the network protocol address before the update can still be used for origin retrieval, which significantly improves the origin retrieval efficiency of the network application firewall.

[0095] In some embodiments of this application, the method further includes:

[0096] If forwarding the target request to the current server corresponding to the current network protocol address fails, wait for the cache to store the refreshed network protocol address;

[0097] Retrieve the refreshed network protocol address corresponding to the target domain name from the cache;

[0098] The target request is forwarded to the server corresponding to the refreshed network protocol address.

[0099] In some embodiments of this application, if the network protocol address before the update is used for origin pull during the update of the network application firewall server domain name, but the forwarding of the target request to the current server corresponding to the current network protocol address fails, it is necessary to wait for the refreshed network protocol address to be queried.

[0100] Specifically, if forwarding the target request to the current server corresponding to the current network protocol address fails, it is necessary to wait for the refreshed network protocol address to be queried and the refreshed network protocol address stored in the cache. Then, the refreshed network protocol address corresponding to the target domain name is queried from the cache, and the target request is forwarded to the server corresponding to the refreshed network protocol address.

[0101] In this embodiment of the application, when forwarding the target request to the current server corresponding to the current network protocol address fails, the network protocol address can be refreshed in the cache before returning to the origin, thereby improving the stability of the network application firewall's return to the origin.

[0102] In some embodiments of this application, the method further includes:

[0103] Get the number of accesses to the domain name of the access network application firewall server;

[0104] Based on the number of accesses, set the refresh time threshold for the network protocol address corresponding to the domain name accessing the network application firewall server.

[0105] In some embodiments of this application, the refresh time threshold of the corresponding network protocol address can be set according to the number of times the domain name accesses the network application firewall server.

[0106] In some embodiments of this application, the refresh time threshold for the network protocol address corresponding to a domain name with a high number of accesses can be set to a shorter time, while the refresh time threshold for the network protocol address corresponding to a domain name with a low number of accesses can be set to a longer time, or even set to not update at all. It is also possible to periodically obtain the access count of domain names accessing the network application firewall server and set the refresh time threshold based on the new access count, for example, setting a shorter refresh time threshold for the network protocol address corresponding to a domain name that previously had a low number of accesses but now has an increased number of accesses.

[0107] In one example, both domain A and domain B have a TTL of 600 seconds. However, domain A receives more accesses per unit time, so its refresh time threshold can be set to 300 seconds; domain B receives fewer accesses per unit time, so its refresh time threshold can be set to 590 seconds. If, after periodically obtaining the number of accesses per unit time, it is found that the number of accesses to domain B per unit time has increased, the refresh time threshold for domain B can be reset to 400 seconds based on the number of accesses. The above specific settings for the refresh time threshold are merely examples; those skilled in the art can set them according to actual circumstances.

[0108] In this embodiment, each domain name has a corresponding refresh time threshold. Based on the number of accesses, the refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set, which greatly reduces the query pressure on the network application firewall server and does not reduce the performance of the network application firewall server as the number of accessed domain names increases.

[0109] Referring to Figure 3, it is a flowchart of an embodiment of a data processing method for a network application firewall server according to this application.

[0110] Figure 3 shows a detailed flowchart of a data processing method for a network application firewall server according to an embodiment of this application, including the following steps:

[0111] Step 301: Start the WAF system.

[0112] Step 302: Initialize the DNS prefetch module.

[0113] Step 303: Load the configuration file of the connected domain name.

[0114] Step 304: The DNS prefetch module performs a DNS query.

[0115] Step 305: Store the retrieved IP address in the local cache.

[0116] Step 306: Refresh DNS queries periodically based on the TTL value.

[0117] Step 307: Check if there are any origin server requests.

[0118] Step 308: If there is a request to return to the origin, check if the old IP address can be used to return to the origin.

[0119] Step 309: If the old IP address can be used for origin pull, then use the old IP address for origin pull; if the old IP address cannot be used for origin pull, wait for the new DNS query result, and then use the new IP address for origin pull.

[0120] In some embodiments of this application, the network application firewall includes a configuration synchronization component, which communicates with a management platform. The method further includes:

[0121] By configuring the synchronization component, configuration update items issued by the management platform can be received;

[0122] Use the configuration update item to update the configuration corresponding to the configuration update item.

[0123] In some embodiments of this application, the network application firewall may further include a configuration synchronization component and a management platform system. In one example, if the network application firewall server is an OpenResty server, when a user modifies configuration items such as WAF protection configuration and origin server configuration, the management platform system can send the latest configuration items from the webpage to the configuration synchronization component. The configuration synchronization component then calls the OpenResty API interface to synchronize the latest configuration to the OpenResty server when the configuration changes.

[0124] In some embodiments of this application, configuring a synchronization component can be used to configure a synchronization component for an Agent.

[0125] Specifically, the network application firewall can receive configuration update items issued by the management platform through the configuration synchronization component, and use the configuration update items to update the configuration corresponding to the configuration update items.

[0126] This application embodiment can update the configuration of the network application firewall by configuring a synchronization component and a management platform.

[0127] In this embodiment, the cache stores the network protocol address corresponding to the domain name accessing the network application firewall server; the network protocol address includes the corresponding server information; a target request sent by a client is received, the target request including the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache; and the target request is forwarded to the target server corresponding to the target network protocol address. This embodiment employs Domain Name System (DNS) prefetching technology, asynchronously resolving the network protocol address corresponding to a domain name that may need to be accessed in advance and storing it in the cache. This eliminates the need to query the DNS server again during subsequent accesses, effectively reducing unnecessary delays caused by domain name resolution during the origin retrieval process of the network application firewall and significantly improving the origin retrieval efficiency of the network application firewall.

[0128] For the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all embodiments of this application, and the actions involved are not necessarily essential to the embodiments of this application.

[0129] Based on the above embodiments, this application also provides a data processing device for a network application firewall server, which is applied in electronic devices such as terminal devices and servers.

[0130] Referring to Figure 4, a structural block diagram of an embodiment of a data processing device for a network application firewall server according to this application is shown, which may specifically include the following modules:

[0131] The prefetch module 401 is used to store in the cache the network protocol address corresponding to the domain name of the access network application firewall server; the network protocol address includes the corresponding server information;

[0132] The request receiving module 402 is used to receive a target request sent by the client, the target request including the target domain name;

[0133] The network protocol address acquisition module 403 is used to query the target network protocol address corresponding to the target domain name from the cache.

[0134] The request forwarding module 404 is used to forward the target request to the target server corresponding to the target network protocol address.

[0135] In some embodiments of this application, the network application firewall communicates with the management platform, and the prefetch module 401 includes:

[0136] The domain name receiving submodule is used to receive the domain name of the access network application firewall server sent by the management platform;

[0137] The configuration loading submodule is used to load the configuration files for the domains of the access network application firewall server;

[0138] The network protocol address query submodule is used to query the network protocol address corresponding to the domain name of the access network application firewall server based on the configuration file and obtain the query result;

[0139] The network protocol address caching submodule is used to store query results in the cache area.

[0140] In some embodiments of this application, the network protocol address has a corresponding validity period, and the apparatus further includes:

[0141] The validity period recording module is used to record the validity period of the network protocol address when storing the network protocol address corresponding to the domain name of the access network application firewall server.

[0142] The refresh judgment module is used to determine whether it is necessary to update the network protocol address corresponding to the domain name of the access network application firewall server based on the refresh time threshold and the current remaining valid time.

[0143] The network protocol address refresh module is used to query the network protocol address corresponding to the domain name of the access network application firewall server again if the current remaining valid time reaches the refresh time threshold, so as to obtain the refreshed network protocol address and the refreshed valid time.

[0144] The refresh cache module is used to store the refreshed network protocol address and the refreshed validity period in the cache area.

[0145] In some embodiments of this application, the apparatus further includes:

[0146] The first query module is used to query the current network protocol address corresponding to the target domain name from the cache if a target request including the target domain name is received when re-querying the network protocol address corresponding to the domain name of the access network application firewall server.

[0147] The first forwarding module is used to forward the target request to the current server corresponding to the current network protocol address.

[0148] In some embodiments of this application, the apparatus further includes:

[0149] The refresh waiting module is used to wait for the cache to store the refreshed network protocol address if forwarding the target request to the current server corresponding to the current network protocol address fails.

[0150] The second query module is used to query the refreshed network protocol address corresponding to the target domain name from the cache.

[0151] The second forwarding module is used to forward the target request to the server corresponding to the refreshed network protocol address.

[0152] In some embodiments of this application, the apparatus further includes:

[0153] The access count acquisition module is used to acquire the access count of the domain name accessing the network application firewall server;

[0154] The refresh time threshold setting module is used to set the refresh time threshold for the network protocol address corresponding to the domain name accessing the network application firewall server based on the number of accesses.

[0155] In some embodiments of this application, the network application firewall includes a configuration synchronization component, which is communicatively connected to a management platform. The apparatus further includes:

[0156] The configuration update receiving module is used to receive configuration update items issued by the management platform through the configuration synchronization component;

[0157] The configuration update module is used to update the configuration corresponding to the configuration update item.

[0158] In this embodiment, the cache stores the network protocol address corresponding to the domain name accessing the network application firewall server; the network protocol address includes the corresponding server information; a target request sent by a client is received, the target request including the target domain name; the target network protocol address corresponding to the target domain name is queried from the cache; and the target request is forwarded to the target server corresponding to the target network protocol address. This embodiment employs Domain Name System (DNS) prefetching technology, asynchronously resolving the network protocol address corresponding to a domain name that may need to be accessed in advance and storing it in the cache. This eliminates the need to query the DNS server again during subsequent accesses, effectively reducing unnecessary delays caused by domain name resolution during the origin retrieval process of the network application firewall and significantly improving the origin retrieval efficiency of the network application firewall.

[0159] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0160] This application provides one or more machine-readable media storing instructions that, when executed by one or more processors, cause an electronic device to perform a data processing method as described in the above embodiments for one or more network application firewall servers. In this application, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0161] Embodiments of this application can be implemented as an apparatus configured using any suitable hardware, firmware, software, or any combination thereof, and may include electronic devices such as terminal devices, servers (clusters), etc. Figure 5 schematically illustrates an exemplary apparatus 500 that can be used to implement the various embodiments of this application.

[0162] For some embodiments of this application, FIG5 illustrates an exemplary device 500 having one or more processors 502, a control module (chipset) 504 coupled to at least one of the processors 502, a memory 506 coupled to the control module 504, a non-volatile memory (NVM) / storage device 508 coupled to the control module 504, one or more input / output devices 510 coupled to the control module 504, and a network interface 512 coupled to the control module 504.

[0163] Processor 502 may include one or more single-core or multi-core processors, and processor 502 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 500 can serve as a terminal device, server (cluster), or other device in the embodiments of this application.

[0164] In some embodiments, the apparatus 500 may include one or more computer-readable media (e.g., memory 506 or NVM / storage device 508) having instructions 514 and one or more processors 502 that are combined with the one or more computer-readable media and configured to execute the instructions 514 to implement the module and thus perform the actions in this application.

[0165] In some embodiments of this application, the control module 504 may include any suitable interface controller to provide any suitable interface to at least one of the processors 502 and / or any suitable device or component communicating with the control module 504.

[0166] The control module 504 may include a memory controller module to provide an interface to the memory 506. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0167] Memory 506 may be used, for example, to load and store data and / or instructions 514 for device 500. For some embodiments of this application, memory 506 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 506 may include double data rate type 4 synchronous dynamic random access memory (DDR4 SDRAM).

[0168] In some embodiments of this application, the control module 504 may include one or more input / output controllers to provide an interface to the NVM / storage device 508 and (one or more) input / output devices 510.

[0169] For example, NVM / storage device 508 may be used to store data and / or instructions 514. NVM / storage device 508 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0170] NVM / storage device 508 may include storage resources that are physically part of a device on which device 500 is mounted, or that can be accessed by the device without needing to be part of the device. For example, NVM / storage device 508 may be accessed via a network through one or more input / output devices 510.

[0171] One or more input / output devices 510 may provide an interface for device 500 to communicate with any other suitable device. Input / output devices 510 may include communication components, audio components, sensor components, etc. A network interface 512 may provide an interface for device 500 to communicate via one or more networks. Device 500 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, etc., or combinations thereof.

[0172] In some embodiments of this application, at least one of the processors 502 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 504. In some embodiments of this application, at least one of the processors 502 may be logically packaged with one or more controllers of the control module 504 to form a system-in-package (SiP). In some embodiments of this application, at least one of the processors 502 may be integrated with the logic of one or more controllers of the control module 504 on the same die. In some embodiments of this application, at least one of the processors 502 may be integrated with the logic of one or more controllers of the control module 504 on the same die to form a system-on-a-chip (SoC).

[0173] In various embodiments, device 500 may be, but is not limited to, a terminal device such as a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, device 500 may have more or fewer components and / or different architectures. For example, in some embodiments, device 500 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0174] The detection device can use a main control chip as a processor or control module, and sensor data, position information, etc. can be stored in a memory or NVM / storage device. The sensor group can be used as an input / output device, and the communication interface can include a network interface.

[0175] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0176] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0177] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a data processing terminal device, such as a general-purpose computer, special-purpose computer, embedded processor, or other programmable network application firewall server, to create a machine such that the instructions, which execute through the processor of the computer or other programmable network application firewall server, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0178] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable network application firewall server to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0179] These computer program instructions may also be loaded onto a computer or other programmable network application firewall server's data processing terminal device, causing a series of operational steps to be performed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0180] Although some embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including some embodiments of the present application as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0181] Finally, in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0182] The data processing method and apparatus for a network application firewall server, an electronic device, and a storage medium provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A data processing method of a network application firewall server, characterized by, The network application firewall server is provided with a cache area and is in communication connection with a client, and the method comprises the following steps: In the cache area, a network protocol address corresponding to a domain name accessing the network application firewall server is stored; the network protocol address comprises corresponding server information; A target request sent by the client is received, and the target request comprises a target domain name; A target network protocol address corresponding to the target domain name is queried from the cache area; The target request is forwarded to a target server corresponding to the target network protocol address.

2. The method of claim 1, wherein, The network application firewall is in communication connection with a management platform, and the step of storing, in the cache area, the network protocol address corresponding to the domain name accessing the network application firewall server comprises the following steps: The domain name accessing the network application firewall server sent by the management platform is received; A configuration file of the domain name accessing the network application firewall server is loaded; According to the configuration file, a network protocol address corresponding to the domain name accessing the network application firewall server is queried to obtain a query result; The query result is stored in the cache area.

3. The method of claim 1, wherein, The network protocol address has a corresponding valid time, and the method further comprises the following steps: When the network protocol address corresponding to the domain name accessing the network application firewall server is stored, the valid time of the network protocol address is recorded; According to a refresh time threshold and a current remaining valid time, it is judged whether the network protocol address corresponding to the domain name accessing the network application firewall server needs to be updated; If the current remaining valid time reaches the refresh time threshold, the network protocol address corresponding to the domain name accessing the network application firewall server is re-queried to obtain a refreshed network protocol address and a refreshed valid time; The refreshed network protocol address and the refreshed valid time are stored in the cache area.

4. The method of claim 3, wherein, The method further comprises the following steps: If the target request comprising the target domain name is received when the network protocol address corresponding to the domain name accessing the network application firewall server is re-queried, a current network protocol address corresponding to the target domain name is queried from the cache area; The target request is forwarded to a current server corresponding to the current network protocol address.

5. The method of claim 4, wherein, The method further comprises the following steps: If the target request fails to be forwarded to the current server corresponding to the current network protocol address, the cache area is waited to store the refreshed network protocol address; The target domain name is queried from the cache area to obtain the refreshed network protocol address corresponding to the target domain name; The target request is forwarded to a server corresponding to the refreshed network protocol address.

6. The method of claim 3, wherein, The method further comprises the following steps: An access frequency of the domain name accessing the network application firewall server is obtained; According to the access frequency, a refresh time threshold of the network protocol address corresponding to the domain name accessing the network application firewall server is set.

7. The method of claim 1, wherein, The network application firewall comprises a configuration synchronization component in communication connection with a management platform, and the method further comprises the following steps: The configuration synchronization component receives a configuration update item issued by the management platform; The configuration update item is used to update the configuration corresponding to the configuration update item.

8. A data processing apparatus of a network application firewall server, characterized by: The network application firewall server is provided with a cache area and is in communication connection with a client, and the device comprises: A pre-fetching module is configured to store a network protocol address corresponding to a domain name accessing the network application firewall server in the cache area, and the network protocol address comprises corresponding server information; A request receiving module is configured to receive a target request sent by the client, and the target request comprises a target domain name; A network protocol address obtaining module is configured to query a target network protocol address corresponding to the target domain name from the cache area; A request forwarding module is configured to forward the target request to a target server corresponding to the target network protocol address.

9. An electronic device, comprising: Comprise: A processor; And A memory having executable code stored thereon, when the executable code is executed, causes the processor to execute the data processing method of the network application firewall server as claimed in one or more of claims 1-7.

10. One or more machine-readable media having stored thereon executable code that, when executed, cause a processor to perform the data processing method of the network application firewall server as claimed in one or more of claims 1-7.

Images