WO2010000146A1

WO2010000146A1 - Method, firewalls and network system for realizing information backup

Info

Publication number: WO2010000146A1
Application number: PCT/CN2009/070979
Authority: WO
Inventors: 吴永清
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2008-07-04
Filing date: 2009-03-24
Publication date: 2010-01-07
Also published as: CN101316271B; CN101316271A

Abstract

A method, firewalls and a network system for realizing information backup are disclosed in the embodiments of the present invention. With the present invention, the information backup between at least two firewalls is realized. It comprises: receiving a message; when it is detected that the received message has made change in the recorded session information, backing up the changed session information to another firewall, so that the real-time coincidence of the recorded session information between the firewalls is realized.

Description

Method for realizing information backup, firewall and network system This application claims to be submitted to the Chinese Patent Office on July 4, 2008, the application number is 200810133021. 5, and the invention is entitled "Implementation of Information Backup Method, Firewall and Network System" Chinese Patent Priority of the application, the entire contents of which are incorporated herein by reference. Technical field

The present invention relates to the field of network communications, and in particular, to a method for implementing information backup, a firewall, and a network system. Background technique

As a monitoring and protection device in the network, the firewall plays an important role in the security of the network. At present, the mainstream firewall generally uses a stateful inspection firewall, and records the session information of each session through the firewall, and dynamically determines whether to discard the received message according to the recorded session information. The session information herein includes related parameters of session establishment, and status information of an existing session, such as a source address, a destination address, a message protocol type, a session state, and the like. In actual applications, in order to improve security and reliability, the firewall usually adopts dual-system hot standby networking mode, one of which is in working state and the other is in backup state. When the working state firewall fails, the backup state firewall takes over. Its work. This method can ensure the integrity of the session information of each session recorded by the firewall only when the packets are in the same path. Therefore, the networking configuration on specific applications is complicated. The prior art proposes a processing method for supporting inconsistent path back and forth between messages. The network in the prior art mainly includes: firewall 1, firewall 2; routers Rl, R2, R3, R4. If the traditional path is consistent with the path, the path is: R3->Firewall l->Rl->Firewall1->R3; However, when the path is inconsistent with the path, the path is: R3 -> Firewall l->Rl->R2->Firewall2->R4. In view of the inconsistency between the back and forth paths of the prior art messages, each The firewall periodically scans the recorded session information, and then backs up the session information to another firewall through the heartbeat between the firewalls. After one of the firewalls fails, the other firewall can back up according to the previously backed up session. Information, processing session business. In the research and practice of the prior art, the inventors found that the prior art has the following problems: Since the prior art uses periodic scanning and then backs up the session information, there is bound to be a delay, resulting in two firewall records. The session information cannot be completely consistent in real time, so some session services cannot be performed normally. For example, when one of the firewalls processes the session, the business related to the session cannot be performed normally because the latest session information of the session is not obtained in time.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a method for implementing information backup, a firewall, and a network system, so that the session information recorded between the firewalls is consistent in real time.

The embodiment of the present invention provides a method for implementing information backup, which is used to implement information backup between at least two firewalls, including: receiving a message; when detecting the received message, causing the recorded session information to change, Back up the changed session information to another firewall.

The embodiment of the invention further provides a firewall, comprising: a receiving unit, configured to receive a message; and a processing unit, configured to: when the received message is detected, the recorded session information changes, the changed session is Back up information to another firewall.

The embodiment of the present invention further provides a network system, including: a first firewall, configured to receive a packet, and detect whether the received packet changes the recorded session information, and if yes, send the changed session information. The second firewall is configured to receive the changed session information sent by the first firewall and perform backup.

The technical solution provided by the embodiment of the present invention ensures that the changed session information is backed up to another firewall when the received message is detected to be changed, thereby ensuring the use of the instant backup mechanism. The session information recorded between the firewalls is consistent in real time. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are to be regarded as Other drawings may also be obtained from these drawings without the inventive labor. FIG. 1 is a flowchart of a method for implementing information backup according to an embodiment of the present invention;

2 is a flowchart of a method for implementing information backup according to Embodiment 2 of the present invention;

3 is a flowchart of a method for implementing information backup according to Embodiment 3 of the present invention;

4 is a schematic structural diagram of a firewall according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a network system according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the invention provides a method for implementing information backup, which realizes that the session information recorded by the firewall is consistent in real time, so that the service of the session is normal. In the embodiment of the present invention, when the session information is backed up, the active/standby status of the firewall is not distinguished. When the first firewall is used as the primary firewall and the second firewall is used as the standby firewall, the session information can be backed up from the primary firewall to the standby firewall. The firewall is backed up to the main firewall.

The embodiments of the present invention are described in detail below with reference to the accompanying drawings. The first embodiment of the present invention is a flowchart of a method for implementing information backup according to the embodiment of the present invention. The first firewall and the second firewall are used as an example for description. The method includes the following steps: Step 201: The first firewall receives the packet.

The first firewall receives packets of different protocol types, which may be ICMP (Internet).

Control Message Protocol (Internet Control Message Protocol) message, or UDP (User Datagram Protocol), or TCP (Transmitation Control Protocol) message .

Step 202: The first firewall backs up the changed session information to the second firewall when detecting the received message to change the recorded session information.

When the first firewall detects that the received message changes the recorded session information, the first firewall immediately backs up the changed session information to the second firewall.

The detection of the received message causes the recorded session information to change. It may be that the session information needs to be changed according to the received message and the session information is added, and the recorded session information may be changed. The original session state changes, and the session information needs to be updated to cause the recorded session information to change. It can be found that, in the first embodiment, when the recorded session information is changed when the received message is detected, the changed session information is immediately backed up to the second firewall, thereby ensuring the relationship between the second firewall and the first firewall. Session information is consistent in real time. In the specific application of the network system, the method for implementing the session information backup in the embodiment of the present invention is implemented in different manners according to different packet protocols. The following describes the embodiments of the present invention in detail with reference to different packet protocols. Embodiment 2: Referring to FIG. 2, it is a flowchart of a method for implementing information backup according to Embodiment 2 of the present invention. The second embodiment describes the processing flow when the firewall receives ICMP or UDP packets, with the first fire prevention. The wall and the second firewall are described as an example. Sessions based on UDP or ICMP are generally connectionless sessions. There is no change state of the session, and the processing is relatively simple. The specific steps in Figure 2 are as follows:

Step 301: The first firewall receives the ICMP or UDP packet. Step 302: The first firewall searches for the session corresponding to the received packet in the session information recorded by the first firewall. The first firewall records the session information related to the session, and the session information. Can be stored in dedicated memory. When receiving the packet, the first firewall searches for the related session corresponding to the packet in the session information recorded by the first firewall according to the related information carried in the packet. Step 303: According to the search result, it is determined whether there is a session. If there is a session, the process proceeds to step 306. If the session does not exist, the process proceeds to step 304. The first firewall can search for the related session corresponding to the message by using the session information recorded by the first firewall. It is found whether the session has been established before. If the session has been established, the related information of the session is stored, so that the presence session is obtained, and the process proceeds to step 306, otherwise it is determined that there is no session, and the process proceeds to step 304. Step 304: The first firewall establishes an ICMP or UDP session, and proceeds to step 305. The first firewall determines, according to the search result, that the session corresponding to the received message does not exist, and determines that the packet belongs to the permitted one according to the set access rule. The message is based on the received packet to establish an ICMP or UDP session, and the session information of the new session is added. The session information recorded by the first firewall has changed. If the first firewall determines that the packet is not allowed to pass, the packet is discarded, the process ends, and no session is established.

Step 305: Back up the session information of the ICMP or UDP session to the second firewall, and proceed to step 306; the first firewall uses the heartbeat line between the firewalls to set the session information of the ICMP or UDP session. Back up to the second firewall immediately to ensure that the session information between the second firewall and the first firewall is consistent in real time.

Step 306: Forward the ICMP or UDP message. It should be noted that, in the foregoing process, the backup session information is forwarded and the message is forwarded, for example, or the backup session information and the forwarded message are simultaneously performed, or the message is forwarded first and then the session information is backed up.

It can be found that, in the second embodiment, the changed session information is immediately backed up to the second firewall by detecting the newly established ICMP or UDP session after receiving the ICMP or UDP message, thereby ensuring the first The session information between the firewall and the first firewall is consistent in real time.

Embodiment 3: Referring to FIG. 3, it is a flowchart of a method for implementing information backup according to Embodiment 3 of the present invention. The third embodiment describes the processing flow when the firewall receives the TCP packet. The first firewall and the second firewall are used as an example for description. Because TCP-based sessions have various states, the process is relatively complex, but it is primarily backed up to another firewall when it detects a change in recorded session information. Here, the detected session information changes, including: adding session information when a new session is established, and the session is established but the session state is changed, resulting in session information update (such as modification or deletion of session information).

The specific steps in Figure 3 are as follows:

Step 401: The first firewall receives the TCP packet. Step 402: The first firewall searches for the session corresponding to the received packet in the session information recorded by the first firewall. The first firewall records the session information related to the session, and the session information may be stored. In dedicated memory. When receiving a packet, the first firewall is based on the related information carried in the packet. Find the related session corresponding to the packet in the session information recorded by itself. Step 403: According to the search result, it is determined whether there is a session. If there is a session, the process proceeds to step 404. If the session does not exist, the process proceeds to step 406. The first firewall can search for the relevant session corresponding to the message by using the session information recorded by the first firewall. It is found whether the session has been established before. If the session has been established, the related information of the session is stored, so that the presence session is obtained, and the process proceeds to step 404, otherwise it is determined that there is no session, and the process proceeds to step 406.

Step 404: Determine whether the received message belongs to a message that changes the session state of the existing session. If yes, go to step 405, otherwise go to step 410. In the TCP message, the message changing the session state may be SYN + ACK. Packet, ACK message,

The RST message is either an F IN message or the like. The SYN + ACK message is a connection establishment request response flag message, which is used to respond to the connection establishment request; the ACK message is a response flag message. In a TCP connection, except for the first message, that is, the SYN message, all the messages are sent. This field is set to respond to the previous message; the RST message is the reset flag message; the F IN message is the end flag message. It should be noted that this is just an example. As for other messages that will also change the state of the session, they will not be listed one by one.

In step 405, the updated session information is backed up to the second firewall, and the process proceeds to step 410. After the first firewall determines that the received message belongs to the message that changes the session state of the existing session, the first firewall updates the session information of the corresponding session. The session information has changed. The first firewall passes the heartbeat line between the firewalls, and immediately backs up the updated session information of the TCP to the second firewall to ensure that the session information between the second firewall and the first firewall is in real time.

Step 406: Determine whether the message is a SYN message, if yes, proceed to step 408, otherwise proceed to step 407; Step 407, discarding the packet, and ending the process; Step 408, the first firewall establishes a TCP session, and proceeds to step 409;

After the SYN packet is received, the TCP session is established. Therefore, after the received packet is a SYN packet, the TCP session is established according to the packet, and the session information of the session is added. The session information recorded by the firewall has changed. In step 409, the newly recorded session information is backed up to the second firewall, and the process proceeds to step 41 0. The first firewall backs up the session information recorded by the newly established session to the second firewall through the heartbeat line between the firewalls. Ensure that the session information between the second firewall and the first firewall is consistent in real time. Step 4 1 0. Forward the packet. It should be noted that, in the foregoing process, the backup session information is forwarded and the message is forwarded, for example, or the backup session information and the forwarded message are simultaneously performed, or the message is forwarded first and then the session information is backed up.

For example, the principle is similar for the case of N + 1 backup networking (N is greater than 2) in a network system. The foregoing embodiment describes a method for implementing information backup in detail. Correspondingly, the embodiment of the present invention provides a firewall and a network system. Please refer to FIG. 4 , which is a schematic structural diagram of a firewall according to an embodiment of the present invention. As shown in FIG. 4, the firewall includes: a receiving unit 51 and a processing unit 52.

The receiving unit 51 is configured to receive a message.

The processing unit 52 is configured to back up the changed session information to another firewall when detecting the received message to change the recorded session information.

The processing unit 52 further includes: a storage unit 52 1 , a searching unit 522 , and a first processing list Yuan 52 3.

The storage unit 521 is configured to record session information. The searching unit 522 is configured to search for the session corresponding to the message in the session information recorded by the storage unit 521.

The first processing unit 52 3 is configured to: after the searching unit 522 does not find the session corresponding to the packet, establish a session according to the packet, and add session information of the session to the storage unit 521. The newly added session information is backed up to the other firewall. At this time, the packet processed by the first processing unit 523 can be an SYN packet in an ICMP packet, a UDP packet, or a TCP packet.

The processing unit 52 further includes: a second processing unit 524. The second processing unit 524 is configured to, after the searching unit 522 finds the session corresponding to the packet, further, when determining that the packet belongs to a message that changes the session state, the storage unit 521 is configured according to the The message updates the session information corresponding to the session, and backs up the updated session information to the another firewall. Updating the session information corresponding to the session, as described herein, includes: modifying or deleting session information corresponding to the session. The message belonging to the change session state includes: a SYN + ACK packet in the TCP certificate, an ACK packet, an RST packet, or a F I N message.

Please refer to FIG. 5 , which is a schematic structural diagram of a network system according to an embodiment of the present invention. As shown in FIG. 5, the network system includes: a first firewall 61 and a second firewall 62. The first firewall 61 is configured to receive a message, and detect whether the received message changes the recorded session information, and if yes, send the changed session information.

The second firewall 62 is configured to receive the changed session information sent by the first firewall 61 and perform backup.

The first firewall 61 further includes: a receiving unit and a processing unit.

a receiving unit, configured to receive a message.

a processing unit, configured to search, in the recorded session information, a session corresponding to the packet, when not After the session corresponding to the packet is found, a session is established according to the packet, and session information of the session is added, and the newly added session information is backed up to the other firewall. After the processing unit finds the session corresponding to the packet, and further, when determining that the packet belongs to a message that changes the session state, the processing unit updates the session information corresponding to the session according to the packet, and the The updated session information is backed up to the other firewall. For a more specific structure of the first firewall 61, refer to the structure shown in FIG. 4 above, which will not be described in detail herein. It should be noted that the first firewall 61 and the second firewall 62 described herein are opposite, and the second firewall 62 may have the structure shown in FIG. 4 described above.

In summary, the technical solution provided by the embodiment of the present invention backs up the changed session information to another firewall when the recorded session information is changed after detecting the received message, thereby The backup mechanism ensures that the session information recorded between the firewalls is consistent in real time. Further, the technical solution provided by the embodiment of the present invention provides different processing procedures for different types of received messages, and the application is more flexible. A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. In execution, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), or a Random Accu s Memory (RAM). It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Claim

A method for implementing information backup, which is used for implementing information backup between at least two firewalls, and is characterized in that:

Receiving a message;

When the received message is detected to change the recorded session information, the changed session information is backed up to another firewall.

The method for implementing information backup according to claim 1, wherein, when detecting the received message to change the recorded session information, backing up the changed session information to another firewall The steps include:

Searching for the session corresponding to the packet in the recorded session information. After the session corresponding to the packet is not found, the session is established according to the packet, and the session information of the session is added, and the new session is added. The session information is backed up to the other firewall.

The method for implementing information backup according to claim 2, wherein the packet is in an Internet Control Message Protocol (ICMP) packet, a User Datagram Protocol (UDP) packet, or a Transmission Control Protocol (TCP) packet. The connection establishment request SYN message.

The method for implementing information backup according to claim 2, wherein the method further comprises:

After the session corresponding to the message is found, when the message is changed to the session state, the session information corresponding to the session is updated according to the message, and the updated session information is updated. Back up to the other firewall.

The method for implementing information backup according to claim 4, wherein the updating the session information corresponding to the session comprises: modifying or deleting the session information corresponding to the session.

The method for implementing information backup according to claim 4 or 5, wherein the message belonging to the changed session state comprises: a connection establishment request response flag SYN plus ACK in the transmission control protocol TCP message Text, response flag ACK ^ 艮 text, reset flag RST ^ 艮 text or End sign FIN ^艮文.

7. A firewall, comprising:

a receiving unit, configured to receive a message;

The processing unit is configured to back up the changed session information to another firewall when detecting the received message to change the recorded session information.

The firewall according to claim 7, wherein the processing unit comprises: a storage unit, configured to record session information;

a searching unit, configured to search for a session corresponding to the message in the session information recorded by the storage unit;

a first processing unit, configured to: after the searching unit does not find the session corresponding to the packet, establish a session according to the packet, add session information of the session to the storage unit, and add the new session The added session information is backed up to the other firewall.

The firewall according to claim 8, wherein the processing unit further comprises:

a second processing unit, configured to: when the searching unit finds the session corresponding to the packet, further, when determining that the packet belongs to a message that changes the session state, the storage unit is configured according to the packet Updating the session information corresponding to the session, and backing up the updated session information to the another firewall.

A network system, comprising: a first firewall, configured to receive a message, and detect whether the received message changes the recorded session information, and if yes, send the changed session information. ;

The second firewall is configured to receive the changed session information sent by the first firewall and perform backup.

The network system according to claim 10, wherein the first firewall comprises: a receiving unit, configured to receive a message; a processing unit, configured to search for a session corresponding to the packet in the recorded session information, and after the session corresponding to the packet is not found, establish a session according to the packet, and add session information of the session, The newly added session information is backed up to the other firewall.

The network system according to claim 11, wherein the processing unit, after finding the session corresponding to the packet, further determining that the packet belongs to a message changing the session state, according to The message updates the session information corresponding to the session, and backs up the updated session information to the another firewall.