WO2015188579A1

WO2015188579A1 - Distributed virtual firewall apparatus and method, and firewall controller

Info

Publication number: WO2015188579A1
Application number: PCT/CN2014/090473
Authority: WO
Inventors: 耿兴元; 王良家; 丁杰
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-06-09
Filing date: 2014-11-06
Publication date: 2015-12-17
Also published as: CN105141571A

Abstract

A distributed virtual firewall apparatus and method, and a firewall controller. The apparatus comprises a firewall controller and a firewall module. The firewall controller is deployed on a cloud computing management node and is configured to deliver configuration information and firewall policy information to the firewall module. The firewall module is deployed on a host node, and is configured to detect and filter a network flow in a virtual switch vSwitch according to the received configuration information and the received firewall policy information. In the technical scheme, the firewall module can rapidly detect and filter the network flow in the virtual switch vSwitch according to the received configuration information and the received firewall policy, a performance bottleneck in networking is avoided, and the present invention has the characteristics of being rich and flexible in configuration policies, and the like.

Description

Distributed virtual firewall device, method and firewall controller

Technical field

The present invention relates to the field of computer network technologies, and in particular, to a distributed virtual firewall device, method, and firewall controller.

Background technique

In the related art cloud network security solution, the east-west network traffic control of the virtual network can be divided into a virtual switch-based configuration access control list (ACL) control policy and running virtual firewall software in the virtual machine. Two solutions. Based on the implementation scheme of the ACL control policy of the virtual switch, the configurable policy is not rich enough, the inflexibility, and the control policy cannot identify the data of the service layer. However, based on the implementation scheme of the virtual machine firewall software, the networking requirements are demanding and the configuration strategy is complicated. And performance bottlenecks and other shortcomings

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a distributed virtual firewall device, a method, and a firewall controller, which are used to solve the problem that the configurable policies in the related technologies are not rich and inflexible, and the control policies cannot identify the service layer data. problem.

To solve the above technical problem, an embodiment of the present invention provides a firewall controller, which is configured as a cloud computing management node, and includes an information collecting module and an information sending module, where

The information collection module is configured to collect configuration information and firewall policy information;

The information sending module is configured to send the configuration information and the firewall policy information to the firewall module.

Optionally,

The information collection module is further configured to receive firewall policy information set by the user;

The information sending module is further configured to send the firewall policy information that meets a preset condition to the firewall module.

Optionally, the information sending module is configured to send the firewall policy information that meets a preset condition to the firewall module in the following manner:

Comparing the firewall policy information with a preset implementation standard, and sending the firewall policy information to the firewall module when the firewall policy information meets the implementation standard.

Optionally, the information sending module is configured to compare the firewall policy information with a preset implementation standard in the following manner:

The firewall policy information is compared with the preset implementation criteria by means of a recursive tree Trie.

Optionally, the information sending module is configured to send configuration information and firewall policy information to the firewall module in the following manner:

The configuration information and the firewall policy information are sent to the firewall module by executing a command line interface through a Rest API interface or an agent.

To solve the above technical problem, an embodiment of the present invention provides a distributed virtual firewall device, including: a firewall controller and a firewall module;

The firewall controller is deployed on the cloud computing management node, and is configured to send configuration information and firewall policy information to the firewall module.

The firewall module is deployed on the host node, and is configured to filter or forward network traffic in the virtual switch vSwitch according to the received configuration information and the firewall policy information.

Optionally,

The firewall controller is further configured to receive the firewall policy information set by the user, and send the firewall policy information that meets the preset condition to the firewall module.

Optionally, the firewall controller is configured to send the firewall policy information that meets a preset condition to the firewall module in the following manner:

Comparing the firewall policy information with a preset implementation standard, when the firewall policy When the information is in compliance with the implementation standard, the firewall policy information is sent to the firewall module.

Optionally, the firewall controller is configured to compare the firewall policy information with a preset implementation standard in the following manner:

Optionally,

The firewall controller is configured to send configuration information and firewall policy information to the firewall module in the following manner:

The configuration information and the firewall policy information are sent to the firewall module by executing a command line interface through a Rest API interface or an agent;

The firewall module is configured to filter or forward network traffic in the virtual switch vSwitch in the following manner:

The network traffic in the vSwitch is captured by a hook function hook.

To solve the above technical problem, an embodiment of the present invention provides a firewall control method, including:

Collect configuration information and firewall policy information;

Send the configuration information and firewall policy information to the firewall module.

Optionally, the method further includes:

Receive firewall policy information set by the user;

Sending the firewall policy information that meets the preset condition to the firewall module.

Optionally, the sending the firewall policy information that meets the preset condition to the firewall module includes:

Optionally, comparing the firewall policy information with a preset implementation standard, including:

Optionally, the sending the configuration information and the firewall policy information to the firewall module, including:

To solve the above technical problem, the embodiment of the present invention further provides a distributed virtual firewall method, including:

The firewall controller sends configuration information and firewall policy information to the firewall module.

The firewall module detects and filters the network traffic in the virtual switch vSwitch according to the received configuration information and the firewall policy information.

Optionally, the method further includes:

The firewall controller receives the firewall policy information set by the user, and sends firewall policy information that meets the preset condition to the firewall module.

Optionally, the firewall controller sends the firewall policy information that meets the preset condition to the firewall module, including:

The firewall controller compares the firewall policy information with a preset implementation standard, and sends the firewall policy information to the firewall module when the firewall policy information meets the implementation criteria.

Optionally, the firewall controller compares the firewall policy information with a preset implementation standard, including:

The firewall controller compares the firewall policy information with the preset implementation criteria by means of a recursive tree Trie.

Optionally,

The firewall controller sends configuration information and firewall policy information to the firewall module, including:

The firewall controller executes the command line interface through the Rest API interface or the agent, and the matching The information and the firewall policy information are sent to the firewall module;

The firewall module detects and filters the network traffic in the virtual switch vSwitch, including:

The firewall module captures network traffic in the vSwitch through a hook function hook.

With the above technical solution, the embodiment of the present invention has at least the following advantages:

The distributed virtual firewall device, the method, and the firewall controller provided by the embodiment of the present invention can quickly detect and filter the network traffic on the virtual switch vSwtich according to the received configuration information and the firewall policy, and avoid the networking. The performance bottleneck in the performance bottle has a rich and flexible configuration strategy.

BRIEF abstract

1 is a schematic diagram of a distributed virtual firewall device according to a first embodiment of the present invention;

2 is a schematic structural diagram of a firewall controller in a second embodiment of the present invention;

3 is a flowchart of a method for distributed virtual firewall in a third embodiment of the present invention;

4 is a flowchart of a firewall control method according to a fourth embodiment of the present invention;

FIG. 5 is a schematic diagram of application of a system deployment architecture in a fifth embodiment of the present invention.

Preferred embodiment of the invention

In order to solve the problem that the configurable policy in the related art is not rich enough, the inflexibility, and the control policy cannot identify the service layer data, the present invention provides a distributed virtual firewall device, method, and firewall controller, which are described below with reference to the accompanying drawings and embodiments. The invention is further described in detail. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

A first embodiment of the present invention is a distributed virtual firewall device.

FIG. 1 is a schematic diagram of a distributed virtual firewall device according to a first embodiment of the present invention.

As shown in FIG. 1 , the distributed virtual firewall device provided by the embodiment of the present invention includes: a firewall module 10 and a firewall controller 20.

Preferably, the distributed virtual firewall device provided by the embodiment of the present invention is applied to a cloud computing environment. in. For a host cluster in a cloud computing environment, a firewall module 10 is deployed on each host; a firewall controller 20 is deployed on the control node of the host cluster to perform unified management and policy configuration on all firewall modules in the entire cluster environment. among them:

The firewall module 10 is configured to receive configuration information and firewall policy information sent by the firewall controller 20, and detect and filter network traffic in the virtual switch vSwitch running in the kernel of the host virtualization layer according to the configuration information and the firewall policy information.

Optionally, in the cloud computing environment, the firewall module 10 provided by the embodiment of the present invention is disposed in a virtual machine monitor hypervisor virtualization core layer of the host. The firewall module 10 is configured to embed a hook function hook at the data receiving unified entrance of the virtual switch vSwitch, and the firewall module 10 is configured to capture all virtual network traffic of the virtual switch vSwitch running on the host virtualization layer kernel through the hook function, and the network is The traffic is subjected to unified detection and filtering of 2-7 layers, which realizes flexible control of east-west traffic in the cloud computing network. After the hook function is used to capture all the virtual network traffic of the virtual switch vSwitch running on the core of the host virtualization layer, the network traffic that needs to be forwarded by the vSwitch is still fetched and sent to the vSwtich for normal forwarding.

Optionally, the firewall module 10 provided in the embodiment of the present invention is not only configured to support processing of a network protocol header, but also configured to support processing according to a keyword configured by a user to process network traffic content and process the same. And the results are recorded.

The firewall controller 20 is deployed on the cloud management node, and is configured to send configuration information and firewall policy information to the firewall module 10.

Optionally, in the embodiment, the firewall controller 20 is configured to send the configuration information and the firewall policy to the firewall module 10 by using the expression state transfer Rest API interface or the command execution interface through the agent. The firewall controller 20 is further configured to receive the firewall policy information of the user or the cloud computing management node, and send the firewall policy information that meets the preset condition to the firewall module 10, that is, the firewall controller 20 is configured to set the firewall policy information with The preset implementation criteria are compared. When the firewall policy information meets the implementation criteria, the firewall controller 20 sends the firewall policy information to the firewall module 10. In the embodiment, the firewall controller 20 is configured to compare the firewall policy information with the preset implementation standard by using a recursive tree Trie, and check the consistency of the user configuration firewall policy request information, and the firewall controller 20 is configured to perform After pre-analysing and deriving the enforceability results, the firewall policy information is sent to the fire protection associated with the policy. The wall module 10, instead of sending all user-configured firewall policy information to all firewall modules 10, ensures the correctness and enforceability of the firewall policy information sent to the firewall module 10 so that the firewall module 10 can follow The received firewall policy information effectively detects and filters network traffic. If the firewall policy request information configured by the user does not pass the implementation standard preset by the firewall controller 20, the firewall controller 20 is configured to send feedback information to the user, and the user may modify the firewall policy request information according to the feedback information to satisfy The implementation standard preset by the firewall controller.

Optionally, the firewall controller 20 and the firewall module 10 can be completely decoupled in function and deployment, so that the firewall controller 20 and the firewall module 10 can operate independently. And the heartbeat between the firewall module 10 and the firewall controller 20 can also be configured. The firewall module 10 is configured to establish a connection between the firewall module 10 and the firewall controller 20 when the firewall controller 20 is detected to be working or working normally, and the firewall module 10 receives The configuration information and firewall policy sent from the firewall controller 20 are used to detect network traffic. The firewall module 10 is configured to detect and filter network traffic according to its own configuration information or a firewall policy configured by the user, when the firewall controller 20 is not detected or the firewall controller 20 is not working properly.

The firewall controller 20 provided by the embodiment of the present invention supports dual-master backup mode operation, and achieves high availability of the system.

A second embodiment of the present invention is a schematic structural diagram of a firewall controller.

As shown in FIG. 2, the firewall controller includes an information collecting module and an information sending module, where

The information sending module is configured to send configuration information and firewall policy information to the firewall module;

Optionally, the information sending module is configured to execute the command line interface by using a Rest API interface or an agent, and send the configuration information and the firewall policy information to the firewall module.

In the above embodiment,

The information sending module is further configured to send the firewall policy information that meets a preset condition Send to the firewall module.

Optionally, the information sending module is configured to send the firewall policy information that meets the preset condition to the firewall module, and the method includes: setting the firewall policy information to be compared with a preset implementation standard, Sending the firewall policy information to the firewall module when the firewall policy information meets the implementation criteria;

Optionally, the information sending module is configured to compare the firewall policy information with a preset implementation standard, including: setting the firewall policy information to the preset by using a recursive tree Trie The implementation criteria are compared.

A third embodiment of the present invention is a distributed virtual firewall method in cloud computing.

FIG. 3 is a flowchart of a method for distributed virtual firewall in cloud computing according to a third embodiment of the present invention.

As shown in FIG. 3, in step 301, the firewall controller sends the configuration information and the firewall policy to the firewall module.

Preferably, the distributed virtual firewall in the cloud computing provided by the embodiment of the present invention is used in a cloud computing environment. For a host cluster in a cloud computing environment, a firewall module is deployed on each host. A firewall controller is deployed on the control node of the host cluster to implement unified management and policy configuration for all firewall modules in the entire cluster environment.

In the implementation, the firewall controller preferably delivers the configuration information and the firewall policy of the firewall module through the expression state transfer Rest API interface or the execution of the command interface through the agent. The firewall controller further receives the firewall policy information of the user or the cloud computing management node, and sends the firewall policy information that meets the preset condition to the firewall module. The firewall controller compares the firewall policy information with the preset implementation criteria. When the firewall policy information meets the implementation criteria, the firewall controller sends the firewall policy information to the firewall module. In the embodiment, the firewall controller preferably compares the firewall policy information with the preset implementation standard by using a recursive tree Trie, and checks the consistency of the user configuration firewall policy request information, and the firewall controller performs pre-analysis and obtains After the implementation result, the firewall policy information is sent to the firewall module related to the policy, instead of sending all the configured firewall policy information to all firewall modules, thus ensuring the firewall policy sent to the firewall module. The correctness of the information and It can be implemented so that the firewall module can effectively detect and filter network traffic according to the received firewall policy information. If the firewall policy request information configured by the user does not pass the implementation standard preset by the firewall controller, the firewall controller sends a feedback message to the user, and the user can modify the firewall policy request information according to the feedback information to meet the firewall controller pre-configuration. Established implementation standards.

Step 302: The firewall module detects and filters the network traffic in the virtual switch vSwitch according to the received configuration information and the firewall policy.

Optionally, in the cloud computing environment, the firewall module provided by the embodiment of the present invention is based on a host virtual machine monitor hypervisor virtualization core layer. The firewall module implants a hook function hook at the data receiving unified entrance of the virtual switch vSwitch. The firewall module captures all virtual network traffic of the virtual switch vSwitch running on the host virtualization layer kernel through the hook function, and performs 2-7 on the network traffic. Uniform detection and filtering of layers to achieve flexible control of east-west traffic in cloud computing networks. After the hook function is used to capture all the virtual network traffic of the virtual switch vSwitch running on the core of the host virtualization layer, the network traffic that needs to be forwarded by the vSwitch is still fetched and sent to the vSwtich for normal forwarding.

Optionally, the firewall module provided by the embodiment of the present invention not only supports the processing of the network protocol header, but also processes the keyword according to the user configuration to process the network traffic content and record the processing result.

Optionally, the firewall controller and the firewall module can be completely decoupled in function and deployment, so that the firewall controller and the firewall module can operate independently. And the heartbeat between the firewall module and the firewall controller can be configured. When the firewall module detects that the firewall controller exists or works normally, the firewall module establishes a connection with the firewall controller, and the firewall module receives the configuration information sent by the firewall controller and The firewall policy detects network traffic. When the firewall module does not detect the firewall controller or detects that the firewall controller is not working properly, the firewall module can detect and filter the network traffic according to its own configuration information or the firewall policy configured by the user.

The firewall controller provided by the embodiment of the invention supports dual-master backup mode operation, and achieves high availability of the system.

A fourth embodiment of the present invention is a flow chart of a firewall control method.

4 is a flow chart of a firewall control method in a fourth embodiment of the present invention.

Step 401 collects configuration information and firewall policy information.

Step 402 sends the configuration information and firewall policy information to the firewall module.

Optionally, the step 402 sends the configuration information and the firewall policy information to the firewall module by executing a command line interface by using a Rest API interface or an agent.

Optionally, in addition to collecting the configuration information and the firewall policy information, the step 401 further receives the firewall policy information set by the user, and sends the firewall policy information that meets the preset condition to the firewall module.

The fifth embodiment of the present invention is applied in a system deployment architecture and a specific implementation.

As shown in FIG. 5, in the embodiment, the upper layer represents a cloud computing management node, and the firewall controller is deployed on the cloud computing management node. In the embodiment, the active/standby mode is adopted, that is, the firewall controller host Control1 and the firewall controller standby device Control2 are used, so that in the case of a problem with the firewall host, the firewall standby machine can be operated to ensure the entire system. The normal operation.

The lower layer in FIG. 5 is a host node, and a firewall module is deployed on the host node, wherein the firewall module is connected to the corresponding virtual switch vSwitch. Three hosts are preferably given in the figure. The node may have multiple host nodes in other embodiments, and the number of host nodes of the present invention is not limited thereto.

As shown in the first host node in Figure 5, the firewall module FW1 performs network traffic monitoring and filtering on the virtual switch vSwitch1 according to the configuration information and firewall policy issued by the firewall controller Control1, and the firewall module FW1 can also be configured according to the firewall policy configured by the user. The request information performs network traffic detection and filtering on the virtual switch vSwitch1. The firewall policy information configured by the user must be sent to the firewall module FW1 through the pre-analysis of the firewall controller. If the firewall policy information configured by the user does not pass the firewall controller preset implementation. Standard, then the firewall controller will send feedback information to the user, the user can modify the firewall policy request information according to the feedback information, in order to meet the implementation standards preset by the firewall controller. In the embodiment, the network traffic detection filtering control process for the virtual switch vSwitch of the firewall module on other host nodes is not enumerated here.

The distributed virtual firewall device, the method and the firewall controller provided by the invention can quickly detect and filter the network traffic on the virtual switch vSwtich according to the received configuration information and the firewall policy, and avoid the performance bottleneck in the networking. It has the characteristics of rich and flexible configuration strategy.

The technical means and functions of the present invention for achieving the intended purpose can be more deeply and specifically understood by the description of the specific embodiments. However, the accompanying drawings are only for the purpose of illustration and description, and are not intended to limit.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Optionally, all or part of the steps of the foregoing embodiments may also be implemented by using an integrated circuit, and the steps may be separately fabricated into integrated circuit modules, or multiple modules thereof or The steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Variations or substitutions are readily conceivable within the scope of the present invention by those skilled in the art and are within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The distributed virtual firewall device, the method, and the firewall controller provided by the foregoing technical solution can quickly detect and filter the network traffic on the virtual switch vSwtich through the firewall module according to the received configuration information and the firewall policy, and avoid the networking. The performance bottleneck is characterized by rich and flexible configuration strategies.

Claims

A firewall controller configured on a cloud computing management node, including an information collecting module and an information sending module, where

The information collection module is configured to collect configuration information and firewall policy information;

The information sending module is configured to send the configuration information and the firewall policy information to the firewall module.
The firewall controller of claim 1

The information collection module is further configured to receive firewall policy information set by the user;

The information sending module is further configured to send the firewall policy information that meets a preset condition to the firewall module.
The firewall controller according to claim 2, wherein the information sending module is configured to send the firewall policy information that meets a preset condition to the firewall module in the following manner:

Comparing the firewall policy information with a preset implementation standard, and sending the firewall policy information to the firewall module when the firewall policy information meets the implementation standard.
The firewall controller of claim 3, wherein the information transmitting module is configured to compare the firewall policy information with a preset implementation standard in the following manner:

The firewall policy information is compared with the preset implementation criteria by means of a recursive tree Trie.
The firewall controller of claim 1, wherein the information sending module is configured to send configuration information and firewall policy information to the firewall module in the following manner:

The configuration information and the firewall policy information are sent to the firewall module by executing a command line interface through a Rest API interface or an agent.
A distributed virtual firewall device includes: a firewall controller and a firewall module;

The firewall controller is deployed on the cloud computing management node, and is configured to send configuration information and firewall policy information to the firewall module.

The firewall module is deployed on the host node, and is configured to filter or forward network traffic in the virtual switch vSwitch according to the received configuration information and the firewall policy information.
The distributed virtual firewall device of claim 6

The firewall controller is further configured to receive the firewall policy information set by the user, and send the firewall policy information that meets the preset condition to the firewall module.
The distributed virtual firewall device according to claim 7, wherein the firewall controller is configured to send the firewall policy information that meets a preset condition to the firewall module in the following manner:

Comparing the firewall policy information with a preset implementation standard, and sending the firewall policy information to the firewall module when the firewall policy information meets the implementation standard.
The distributed virtual firewall device of claim 8, wherein the firewall controller is configured to compare the firewall policy information with a preset enforceability criteria in the following manner:

The firewall policy information is compared with the preset implementation criteria by means of a recursive tree Trie.
A distributed virtual firewall device according to claim 6, wherein

The firewall controller is configured to send configuration information and firewall policy information to the firewall module in the following manner:

The configuration information and the firewall policy information are sent to the firewall module by executing a command line interface through a Rest API interface or an agent;

The firewall module is configured to filter or forward network traffic in the virtual switch vSwitch in the following manner:

The network traffic in the vSwitch is captured by a hook function hook.
A firewall control method includes:

Collect configuration information and firewall policy information;

Send the configuration information and firewall policy information to the firewall module.
The method of claim 11 further comprising:

Receive firewall policy information set by the user;

Sending the firewall policy information that meets the preset condition to the firewall module.
The method of claim 12, wherein the sending the firewall policy information that meets a preset condition to the firewall module comprises:

Comparing the firewall policy information with a preset implementation standard, and sending the firewall policy information to the firewall module when the firewall policy information meets the implementation standard.
The method of claim 13 wherein said comparing said firewall policy information with a predetermined enforceability criteria comprises:

The firewall policy information is compared with the preset implementation criteria by means of a recursive tree Trie.
The method of claim 11, wherein the sending the configuration information and the firewall policy information to the firewall module comprises:

The configuration information and the firewall policy information are sent to the firewall module by executing a command line interface through a Rest API interface or an agent.
A distributed virtual firewall method includes:

The firewall controller sends configuration information and firewall policy information to the firewall module.

The firewall module detects and filters the network traffic in the virtual switch vSwitch according to the received configuration information and the firewall policy information.
The distributed virtual firewall method of claim 16, further comprising:

The firewall controller receives the firewall policy information set by the user, and sends firewall policy information that meets the preset condition to the firewall module.
The distributed virtual firewall method according to claim 17, wherein the firewall controller sends the firewall policy information that meets the preset condition to the firewall module, including:

The firewall controller compares the firewall policy information with a preset implementation standard. When the firewall policy information meets the implementation standard, the firewall policy information is sent to the firewall module.
The distributed virtual firewall method according to claim 18, wherein the firewall controller compares the firewall policy information with a preset implementation standard, including:

The firewall controller compares the firewall policy information with the preset implementation criteria by means of a recursive tree Trie.
The distributed virtual firewall method of claim 16 wherein

The firewall controller sends configuration information and firewall policy information to the firewall module, including:

The firewall controller executes the command line interface through the Rest API interface or the agent, and sends the configuration information and the firewall policy information to the firewall module.

The firewall module detects and filters the network traffic in the virtual switch vSwitch, including:

The firewall module captures network traffic in the vSwitch through a hook function hook.